The Grant Form Wants Proof, Not Poetry: Building a Charity Cyber Pack in 45 Minutes

It is 2026, and the grant application has changed. The question used to be a polite paragraph about keeping data safe. Now it arrives as a table with a character limit: 'Describe your organisation's approach to cyber security.' For a small UK charity with three staff, a volunteer bookkeeper and a trustee board that meets quarterly, that can feel like being asked to write a business continuity plan on the back of a bus ticket.

Good news: most funders are not asking for ISO 27001. They are asking whether you have the basics, and whether you can show your working. A one-page answer pack, assembled in 45 minutes, is usually enough. You do not need a consultant or a new platform. You need five pieces of evidence and a straight face.

What the funder is actually checking

Grant panels are risk-averse. They want to know that money and personal data will not vanish because a laptop was left on a train. They are not scoring you on whether you have a SIEM, a red team or a zero-trust architecture. They are checking for the same things a small charity regulator or insurer would look for: someone is responsible, you know what you hold, you can get it back, you know who to tell, and staff have been told what to do.

The Charity Commission and NCSC have both spent years pointing small charities at proportionate guidance. The funder's question is a nudge in the same direction. Treat it as a prompt to write down what you already do, not an exam you are failing.

The one-page answer pack

Keep it to a single side of A4. Five headings. Plain English. A date at the top so you know when it was last true.

1. A named owner (and a deputy)

'Everyone is responsible for cyber security' is true and useless. Funders want a person. Write:

'Our cyber security lead is [name], [role]. In their absence, [name], [role], covers. The board receives a short update at each trustee meeting.'

If the owner is the office manager who already does five jobs, say so. That is honest. Add a deputy. The point is not a full-time security team; it is a route for decisions.

2. A short asset list

You do not need a configuration management database. You need a table of the systems that would ruin your week if they disappeared or leaked. For most small charities that is: laptops and phones, Microsoft 365 or Google Workspace, the donor or CRM system, the finance package, the website, and any shared drive. Add where each lives and who has admin rights; that last column is often the eye-opener.

3. The date of your last backup test

'We back up daily' is a statement of hope until someone restores something. Write the date you last tested a restore, what you restored, and who did it. If you have never tested, do not invent a date. Write: 'Backups run daily. A restore test is scheduled for [date within the next 30 days] and will be repeated quarterly.' A funder will respect a dated plan more than a vague claim.

4. The incident contact route

If a staff member thinks an email is dodgy or a laptop is missing, who do they tell, and how? Write the first step, the out-of-hours step, and the escalation step. For example: 'Staff report suspected incidents to the office manager by phone or email. Out of hours, they call the duty trustee. The office manager logs the incident and contacts our IT supplier and insurer as needed.' Add Action Fraud and NCSC reporting only if you will actually use them; a route nobody knows is not a route.

5. Evidence of staff training

Not 'we train staff annually' — a date, a format and a list of who attended. It might be a 30-minute session on phishing and passwords, a short quiz, or a recorded email briefing. If the last session was two years ago, say when the next one is. Funders are looking for the habit, not a certificate mill.

The 45-minute exercise

Set a timer. Do not aim for perfect. Aim for a dated page.

Minutes 0-5: Open the grant question and copy the exact wording. Note the deadline. Put the date at the top of a blank document.

Minutes 5-15: Write the named owner and deputy. Add the board reporting line. Write the incident route as three steps: report, log, escalate.

Minutes 15-25: Build the asset table from memory, then check it against your finance system and CRM. Add admin rights where you know them. Mark unknowns as 'to confirm'.

Minutes 25-35: Find the last backup restore date. If there is none, book a test in the calendar and write the date. Add the training date and attendance evidence. If you have no evidence, schedule a 30-minute session before the deadline.

Minutes 35-45: Write the one-page answer in plain paragraphs. Read it aloud. Delete any sentence that sounds like a brochure. Send it to the trustee lead for a second pair of eyes.

That is the pack. It will not win a security award. It will answer the question.

Wording that satisfies without bluffing

A short paragraph can cover most of it:

'Our cyber security lead is [name], [role]. We maintain a list of key systems, including [systems], and review admin access when staff leave. Our last backup restore test was [date]. Staff report suspected incidents to [role], who logs them and escalates to [role] and our IT supplier. All staff completed [training] on [date].'

Notice what is missing: 'robust', 'world-class', 'military-grade'. Funders have seen those words. They are looking for verbs in the past tense: tested, reviewed, completed, logged.

If you cannot answer a section

Do not fill the gap with fiction. Write the gap and the date you will close it. 'We do not currently test restores. A test is booked for 14 January 2027 and will be repeated quarterly.' That is a better answer than a made-up date, and it gives you a to-do list you can actually finish.

Keep the page alive

Review the pack before each grant round, not once a year in a panic. Update the backup test date, the training date and any new system. Put the review date on the page. After two or three rounds, the 45 minutes becomes 15.

The grant form is not a trap. It is a prompt to write down the things a small charity already does — and to notice the one or two things it has been meaning to fix. That is a useful outcome, even if the funding does not come through.