It is Cyber Security Awareness Month, but given the amount of coverage I have given the subject matter in recent months, you might be justified in thinking, not this again. But actually, I am going address it from a quite different yet important perspective, and one you may well not have considered at all.
The starting point for this is that charities need to have something more valuable than what can put in a bank account, more of an asset than acquired experience, knowledge, commitment and even people. The thing of supreme value is reputation and with it trust. You may remember a few years ago that through the behaviour of a only handful of Oxfam staff in Haiti, the charity that employs more than 8,000 people with an excess of 20,000 volunteers in the UK alone, looked like it may be on the point of collapse. It suffered serious financial, operational and recruitment harm.
After years of high standing in the eyes of many, Oxfam became a public pariah that resulted in governments wanting no more to do with it. In the UK more than 7,000 regular donors cancelled direct debits. The real cost may never be truly known, but with the shadow of the scandal still hanging over Oxfam, the reputational damage and everything that goes with it may take another decade or more to recover.
As the great business financial investor and philanthropist Warren Buffett says, ‘Trust is like the air we breathe. When it’s present, nobody really notices, when it’s absent, everybody notices.‘ For charities, trust is everything, and the reality is that is what cyber criminals threaten most. Not just financial loss, but reputational loss.
Charities data is more valuable than many realise
One of the big problems of cyber security is that many charities do not really see themselves as targets – there are more attractive potential victims, it is always somebody else. Partly this is due to the human defence characteristic of thinking bad things happen to someone else. On the other hand, there are some people who are very cautious, even paranoid, but by and large the big bad scenarios are reserved for others, and observed safely from distance through the media.
However, the fact is that nearly all charities are tempting cyber targets because they hold information that is valuable to criminals, including:
- Donor records
- Personal contact details
- Financial information
- Volunteer information
- Sensitive beneficiary data
- Safeguarding records
The Charity Commission points out that charities are prime victims because they often rely heavily on digital services for fundraising, communications and service provision.
The question senior charity managers and trustees increasingly and reassuringly ask themselves is, ‘How secure are we from cyber threat?’, which is undoubtedly an important and good thing, but there is now a crucial caveat to this which is, ‘How secure are the digital service supplies that we use?’ The reason being that if they, the digital service suppliers are hacked, they frequently open an easy route to a charity’s most sensitive data. We saw that on a large sale in the summer with major charity software provider Beacon CRM.
In fact, the majority of charities rely on external providers for:
- CRM systems
- Online donations
- Email marketing
- Website hosting
- Cloud storage
- Microsoft 365 and other productivity tools
Like a domino falling, when the defences of a service provider topple the impact can incorporate thousands of charities. The cyber security front line is now complex and requires careful management, and it is no longer isolated to IT management. When the future of a charity is on the line it means the responsibility is at board level and it incorporates the following:
- Governance
- Risk management
- Regulatory compliance
- Organisational robustness
What is more, the Charity Commission makes it clear that trustees are responsible for managing risks appropriately. Trustees do not need to become cyber security experts, but they do need to ensure a solid protocol is in place to prevent cyber attack becoming a problem.
Why crisis planning is so important should the worst happen
No organisation can reduce cyber vulnerability to entirely nothing, and those that survive an attack best and bounce back quickest are those with a crisis plan that limits damage and incorporates both technical and communications provision. Such a plan should include firstly informing the Information Commissioners Office and all those on relevant databases. This has to be done by law. The there is then a need for:
- A public relations crisis management plan that is rehearsed at least once a year
- Informing relevant third parties (donors, sponsors, partners, grant funders any other relevant third parties, plus staff and volunteers
- Briefing staff and volunteers on what to say and how much to say if asked, because they will be asked
- Make it known who staff and volunteers should contact for information, and who they should direct third party enquiries to
- Establish provision for keeping core services maintained during crisis
- Keep all important data permanently backed up
- Create a recovery framework
Good preparation for cyber attack happening is frequently the make or break difference between successfully riding out the storm with reputation intact, potentially going under, and everything in between.
For those that need public relations crisis management advice and support, the CAS marketing and communications department can provide as much or little as is needed. This is based on extensive experience, and planning and handling situations for central government agencies, celebrities, and leading brands and charities. Contact me and I can put you in touch with the right person.
One more benefit of being ready
A robust plan is not just about stopping attacks, or mitigating damage if it occurs. There is benefit in demonstrating preparedness to donors, funders, beneficiaries, partners, staff and volunteers. It creates assurance that a charity is professionally run, is worth giving grants and donations to, working with, working for and volunteering for. It bolsters positive branding, and knowing robust protection and readiness exists has a subliminal positive influence on nearly all aspects of charity function.
As ever, if you would like advice on any of the above, then please contact me.
