Cyber Security and Resilience - Revision history

Adminwiki: /* Key Governance Principles */

2026-09-26T12:53:30Z

Key Governance Principles

← Older revision		Revision as of 12:53, 26 September 2026
Line 25:		Line 25:
	'''Risk-Based Approach'''		'''Risk-Based Approach'''

	Cyber resilience should be embedded within the organisation’s existing risk management framework . This includes identifying risks, assessing their impact, and reviewing them regularly. Cyber risk sits alongside financial, operational, and reputational risks.		Cyber resilience should be embedded within the organisation’s existing risk management framework . This includes identifying risks, assessing their impact, and reviewing them regularly. Cyber risk sits alongside financial, operational, and [[Reputational Risk\|reputational risks]].

	'''Preparedness and Continuity'''		'''Preparedness and Continuity'''

Adminwiki: /* Why Cyber Resilience Matters */

2026-09-26T12:53:01Z

Why Cyber Resilience Matters

← Older revision		Revision as of 12:53, 26 September 2026
Line 10:		Line 10:
	* [[Information Governance\|Data breaches]] may expose personal or sensitive beneficiary information, with [[Safeguarding\|safeguarding]] and legal implications		* [[Information Governance\|Data breaches]] may expose personal or sensitive beneficiary information, with [[Safeguarding\|safeguarding]] and legal implications
	* Loss of email or IT systems can disrupt coordination, decision-making, and external communications		* Loss of email or IT systems can disrupt coordination, decision-making, and external communications
	Beyond operational impact, cyber incidents can also affect reputation and trust. Stakeholders including beneficiaries, funders, regulators, and partners expect organisations to handle data responsibly and maintain reliable services. A significant incident can undermine confidence and, in some cases, lead to regulatory scrutiny especially if personal data is compromised.		Beyond operational impact, cyber incidents can also [[Reputational Risk\|affect reputation]] and trust. Stakeholders including beneficiaries, funders, regulators, and partners expect organisations to handle data responsibly and maintain reliable services. A significant incident can undermine confidence and, in some cases, lead to regulatory scrutiny especially if personal data is compromised.
	For boards, this is not simply about preventing attacks, but ensuring the organisation can continue to operate and deliver its mission under adverse conditions. Cyber resilience supports this by combining prevention and cyber security with preparedness, response, and recovery.		For boards, this is not simply about preventing attacks, but ensuring the organisation can continue to operate and deliver its mission under adverse conditions. Cyber resilience supports this by combining prevention and cyber security with preparedness, response, and recovery.

Adminwiki: /* Further resources and links */

2026-04-19T12:02:06Z

Further resources and links

← Older revision		Revision as of 12:02, 19 April 2026
Line 67:		Line 67:

	[https://www.ncsc.gov.uk/cyberessentials/overview National Cyber Security Centre]		[https://www.ncsc.gov.uk/cyberessentials/overview National Cyber Security Centre]
	The TSI learning portal includes an online course - Cyber Security for Small Organisations and Charities
			The [https://tsi-learning.scot/ TSI learning portal] includes an online course - Cyber Security for Small Organisations and Charities

Adminwiki at 12:01, 19 April 2026

2026-04-19T12:01:19Z

← Older revision		Revision as of 12:01, 19 April 2026
Line 67:		Line 67:

	[https://www.ncsc.gov.uk/cyberessentials/overview National Cyber Security Centre]		[https://www.ncsc.gov.uk/cyberessentials/overview National Cyber Security Centre]
			The TSI learning portal includes an online course - Cyber Security for Small Organisations and Charities

Adminwiki: /* Why Cyber Resilience Matters */

2026-04-06T17:57:40Z

Why Cyber Resilience Matters

← Older revision		Revision as of 17:57, 6 April 2026
Line 8:		Line 8:
	* A ransomware attack may prevent access to case management systems, stopping frontline services		* A ransomware attack may prevent access to case management systems, stopping frontline services
	* Phishing or fraud incidents can lead to financial loss or unauthorised payments		* Phishing or fraud incidents can lead to financial loss or unauthorised payments
	* Data breaches may expose personal or sensitive beneficiary information, with safeguarding and legal implications		* [[Information Governance\|Data breaches]] may expose personal or sensitive beneficiary information, with [[Safeguarding\|safeguarding]] and legal implications
	* Loss of email or IT systems can disrupt coordination, decision-making, and external communications		* Loss of email or IT systems can disrupt coordination, decision-making, and external communications
	Beyond operational impact, cyber incidents can also affect reputation and trust. Stakeholders including beneficiaries, funders, regulators, and partners expect organisations to handle data responsibly and maintain reliable services. A significant incident can undermine confidence and, in some cases, lead to regulatory scrutiny especially if personal data is compromised.		Beyond operational impact, cyber incidents can also affect reputation and trust. Stakeholders including beneficiaries, funders, regulators, and partners expect organisations to handle data responsibly and maintain reliable services. A significant incident can undermine confidence and, in some cases, lead to regulatory scrutiny especially if personal data is compromised.

Adminwiki: /* Further resources and links */

2026-04-06T17:55:09Z

Further resources and links

← Older revision		Revision as of 17:55, 6 April 2026
Line 62:		Line 62:
	SCVO - [https://scvo.scot/support/digital/cyber-resilience Cyber Resilience]		SCVO - [https://scvo.scot/support/digital/cyber-resilience Cyber Resilience]

	~~Socttish~~ Government - [https://www.gov.scot/publications/strategic-framework-cyber-resilient-scotland/ Cyber Resilient Scotland: strategic framework]		Scottish Government - [https://www.gov.scot/publications/strategic-framework-cyber-resilient-scotland/ Cyber Resilient Scotland: strategic framework]

			UK Government - [https://www.gov.uk/government/publications/cyber-essentials-scheme-overview Cyber Essentials]

			[https://www.ncsc.gov.uk/cyberessentials/overview National Cyber Security Centre]

Adminwiki: /* Why Cyber Resilience Matters */

2026-04-06T17:53:05Z

Why Cyber Resilience Matters

← Older revision		Revision as of 17:53, 6 April 2026
Line 10:		Line 10:
	* Data breaches may expose personal or sensitive beneficiary information, with safeguarding and legal implications		* Data breaches may expose personal or sensitive beneficiary information, with safeguarding and legal implications
	* Loss of email or IT systems can disrupt coordination, decision-making, and external communications		* Loss of email or IT systems can disrupt coordination, decision-making, and external communications
	Beyond operational impact, cyber incidents can also affect reputation and trust. ~~Stakeholders—including~~ beneficiaries, funders, regulators, and ~~partners—expect~~ organisations to handle data responsibly and maintain reliable services. A significant incident can undermine confidence and, in some cases, lead to regulatory scrutiny especially if personal data is compromised.		Beyond operational impact, cyber incidents can also affect reputation and trust. Stakeholders including beneficiaries, funders, regulators, and partners expect organisations to handle data responsibly and maintain reliable services. A significant incident can undermine confidence and, in some cases, lead to regulatory scrutiny especially if personal data is compromised.
	For boards, this is not simply about preventing attacks, but ensuring the organisation can continue to operate and deliver its mission under adverse conditions. Cyber resilience supports this by combining prevention and cyber security with preparedness, response, and recovery.		For boards, this is not simply about preventing attacks, but ensuring the organisation can continue to operate and deliver its mission under adverse conditions. Cyber resilience supports this by combining prevention and cyber security with preparedness, response, and recovery.

Adminwiki: Created page with "Cyber resilience is an organisation’s ability to anticipate, withstand, respond to, and recover from cyber incidents while continuing to deliver its core functions. In the third sector, it is understood as a governance issue, not just a technical one. It encompasses leadership, risk management, organisational culture, and continuity of services, as well as cyber security controls. ==Why Cyber Resilience Matters== Cyber incidents can disrupt services, compromise sensit..."

2026-04-05T11:03:09Z

Created page with "Cyber resilience is an organisation’s ability to anticipate, withstand, respond to, and recover from cyber incidents while continuing to deliver its core functions. In the third sector, it is understood as a governance issue, not just a technical one. It encompasses leadership, risk management, organisational culture, and continuity of services, as well as cyber security controls. ==Why Cyber Resilience Matters== Cyber incidents can disrupt services, compromise sensit..."

New page

Cyber resilience is an organisation’s ability to anticipate, withstand, respond to, and recover from cyber incidents while continuing to deliver its core functions.
In the third sector, it is understood as a governance issue, not just a technical one. It encompasses leadership, risk management, organisational culture, and continuity of services, as well as cyber security controls.

==Why Cyber Resilience Matters==
Cyber incidents can disrupt services, compromise sensitive data, and damage trust. As organisations become more digitally dependent, cyber resilience becomes part of overall organisational resilience and sustainability.
For many charities and public bodies, digital systems now underpin essential functions such as service delivery, communications, finance, and data management. A cyber incident can therefore have immediate and wide-ranging consequences.
For example:
* A ransomware attack may prevent access to case management systems, stopping frontline services
* Phishing or fraud incidents can lead to financial loss or unauthorised payments
* Data breaches may expose personal or sensitive beneficiary information, with safeguarding and legal implications
* Loss of email or IT systems can disrupt coordination, decision-making, and external communications
Beyond operational impact, cyber incidents can also affect reputation and trust. Stakeholders—including beneficiaries, funders, regulators, and partners—expect organisations to handle data responsibly and maintain reliable services. A significant incident can undermine confidence and, in some cases, lead to regulatory scrutiny especially if personal data is compromised.
For boards, this is not simply about preventing attacks, but ensuring the organisation can continue to operate and deliver its mission under adverse conditions. Cyber resilience supports this by combining prevention and cyber security with preparedness, response, and recovery.

==Governance Context==
Trustees are responsible for identifying and [http://Risk%20Management managing risks] to their organisation, including cyber risks. This is [https://www.oscr.org.uk/news/building-cyber-resilience-in-scotland-s-third-sector-a-strategic-call-to-action/ reflected in expectations] of the [[Office of the Scottish Charity Regulator (OSCR)]].

From a governance perspective, this means boards should:
* Recognise cyber risk as part of overall organisational risk
* Ensure appropriate controls, policies, and oversight are in place
* Monitor and review risks regularly
Cyber resilience should therefore be treated as a standing governance issue, not delegated solely to technical staff.

==Key Governance Principles==
'''Risk-Based Approach'''

Cyber resilience should be embedded within the organisation’s existing risk management framework . This includes identifying risks, assessing their impact, and reviewing them regularly. Cyber risk sits alongside financial, operational, and reputational risks.

'''Preparedness and Continuity'''

A core feature of cyber resilience is maintaining services during disruption. Organisations are expected to have proportionate plans in place to respond to incidents and recover effectively.

'''Leadership and Culture'''

Effective cyber resilience depends on leadership and organisational culture. Guidance from Scottish Council for Voluntary Organisations emphasises that responsibility is shared across the organisation, with boards setting the tone and expectations.

'''Accountability and Reporting'''

Organisations should have clear processes for responding to incidents, recording what happens, and reporting serious issues where required. This reflects wider governance expectations around transparency and accountability.

'''Secure by Design'''

The Scottish Government promotes [https://www.gov.scot/publications/cloud-principles/pages/principle-2-be-secure-by-design/ a “secure by design” approach], where resilience is built into systems and services from the outset rather than added later.

==Practical Governance Actions==
From a governance perspective, organisations should:
* include cyber risk in the risk register and review it regularly
* develop a plan to ensure good stewardship of assets by protecting funds, data, and systems through implementation of robust and secure procedural systems

* develop a plan for continuity of services (ensuring the organisation can function during disruption)
* consider the legal and regulatory compliance issues such as data protection and reporting obligations
* provide appropriate training and awareness
* review and learn from incidents
These actions should be proportionate to the organisation’s size, complexity, and risk exposure.

==Summary==
Cyber resilience is now a core governance responsibility. It requires active board oversight, integration into risk management, and a focus on continuity as well as protection.
Strong cyber resilience supports compliance, protects beneficiaries, and helps maintain public trust in an increasingly digital environment.

==Further resources and links==

SCVO - [https://scvo.scot/support/digital/cyber-resilience Cyber Resilience]

Socttish Government - [https://www.gov.scot/publications/strategic-framework-cyber-resilient-scotland/ Cyber Resilient Scotland: strategic framework]