Cyber Security and Resilience

Cyber resilience is an organisation’s ability to anticipate, withstand, respond to, and recover from cyber incidents while continuing to deliver its core functions. In the third sector, it is understood as a governance issue, not just a technical one. It encompasses leadership, risk management, organisational culture, and continuity of services, as well as cyber security controls.

Why Cyber Resilience Matters

Cyber incidents can disrupt services, compromise sensitive data, and damage trust. As organisations become more digitally dependent, cyber resilience becomes part of overall organisational resilience and sustainability. For many charities and public bodies, digital systems now underpin essential functions such as service delivery, communications, finance, and data management. A cyber incident can therefore have immediate and wide-ranging consequences. For example:

A ransomware attack may prevent access to case management systems, stopping frontline services
Phishing or fraud incidents can lead to financial loss or unauthorised payments
Data breaches may expose personal or sensitive beneficiary information, with safeguarding and legal implications
Loss of email or IT systems can disrupt coordination, decision-making, and external communications

Beyond operational impact, cyber incidents can also affect reputation and trust. Stakeholders including beneficiaries, funders, regulators, and partners expect organisations to handle data responsibly and maintain reliable services. A significant incident can undermine confidence and, in some cases, lead to regulatory scrutiny especially if personal data is compromised. For boards, this is not simply about preventing attacks, but ensuring the organisation can continue to operate and deliver its mission under adverse conditions. Cyber resilience supports this by combining prevention and cyber security with preparedness, response, and recovery.

Governance Context

Trustees are responsible for identifying and managing risks to their organisation, including cyber risks. This is reflected in expectations of the Office of the Scottish Charity Regulator (OSCR).

From a governance perspective, this means boards should:

Recognise cyber risk as part of overall organisational risk
Ensure appropriate controls, policies, and oversight are in place
Monitor and review risks regularly

Cyber resilience should therefore be treated as a standing governance issue, not delegated solely to technical staff.

Key Governance Principles

Risk-Based Approach

Cyber resilience should be embedded within the organisation’s existing risk management framework . This includes identifying risks, assessing their impact, and reviewing them regularly. Cyber risk sits alongside financial, operational, and reputational risks.

Preparedness and Continuity

A core feature of cyber resilience is maintaining services during disruption. Organisations are expected to have proportionate plans in place to respond to incidents and recover effectively.

Leadership and Culture

Effective cyber resilience depends on leadership and organisational culture. Guidance from Scottish Council for Voluntary Organisations emphasises that responsibility is shared across the organisation, with boards setting the tone and expectations.

Accountability and Reporting

Organisations should have clear processes for responding to incidents, recording what happens, and reporting serious issues where required. This reflects wider governance expectations around transparency and accountability.

Secure by Design

The Scottish Government promotes a “secure by design” approach, where resilience is built into systems and services from the outset rather than added later.

Practical Governance Actions

From a governance perspective, organisations should:

include cyber risk in the risk register and review it regularly
develop a plan to ensure good stewardship of assets by protecting funds, data, and systems through implementation of robust and secure procedural systems

develop a plan for continuity of services (ensuring the organisation can function during disruption)
consider the legal and regulatory compliance issues such as data protection and reporting obligations
provide appropriate training and awareness
review and learn from incidents

These actions should be proportionate to the organisation’s size, complexity, and risk exposure.

Summary

Cyber resilience is now a core governance responsibility. It requires active board oversight, integration into risk management, and a focus on continuity as well as protection. Strong cyber resilience supports compliance, protects beneficiaries, and helps maintain public trust in an increasingly digital environment.