# Top tips for trustees: Make space for cyber Looking at data from [**SCVO’s Good Governance Checkup**](https://governance.checkup.scot/), we see that lots of trustees aren’t sure whether cyber resilience is a board responsibility and how this area of risk should be managed – so how should you be tackling cyber risk? ## You are already managing risk Every governance body has to think about potential risks their organisation might face and how to control them. Exactly how you do this will vary, every voluntary organisation is different in their attitude to risk and what they are prepared to tolerate based on their unique set up.   You’re likely already managing risk as part of your daily operations and strategic planning, even if you haven’t realised it. You can take it further through board discussions on business resilience, considering and maybe even planning how your organisation would continue to operate when a risk undoubtedly materialises. Driving a culture of accountability and resilience within an organisation is so important, everyone plays a role in spotting risks and taking appropriate action to help stay safe. ## Start asking questions about cyber Cyber risk is just another type of risk, and so should be managed in the same way as all business risks. Unfortunately the third sector is not exempt from cyber attacks. According to 2025 UK Cyber Security Breaches Survey, almost one in three charities experienced some form of cyber security breach or attack in the past year.  Trustees are responsible for recognising cyber risks and keeping up-to-date with common threats to help inform their understanding of risk and mitigation. Ensuring these risks are well managed means that boards can be confident of their organisation’s cyber position. As a trustee, you can obtain a level of assurance by asking… * **Are we taking appropriate technical steps to protect our systems and data from common threats?** Make sure your organisation has taken practical steps to improve your organisation’s cyber security, e.g. backing up data, keeping mobiles and laptops safe, preventing malware, avoiding phishing attacks and using strong passwords. * **Do our staff and volunteers understand their role in helping us stay safe online?** Giving your team the right awareness and basic training can help reinforce key cyber security principles and make your organisation less vulnerable. * **Do our staff and volunteers know how to report anything suspicious?** People on the front line will likely be the first to notice a cyber incident or suspected phishing activity, it’s important they know how to report so you can quickly work out what’s happening. * **Have we recently tested our cyber incident response plan?** You can reduce a lot of the stress and risk of a cyber attack by having an up-to-date incident response plan prepared in advance. Acting now can make a big difference in helping protect your organisation from the inevitable. ## Reach out if you need help For further information check out [**SCVO's Cyber Resilience page**](https://scvo.scot/support/digital/cyber-resilience), where you can keep up to date with all things cyber, and/or get in touch with our Cyber Resilience Co-Ordinator if you’d like to chat through in more detail. * * * --- ## About SCVO SCVO (Scottish Council for Voluntary Organisations) is the national membership organisation for Scotland's voluntary sector. Our role is to champion the role of voluntary organisations in Scotland and to support them to do work that has a positive impact. SCVO supports members and the wider voluntary sector with all aspects of setting up and running a voluntary organisation. SCVO represents the needs and concerns of the voluntary sector to the Scottish government in Holyrood and UK government and Westminster. Through our learning and events programme SCVO offers training and development opportunities to the sector. Members access an extensive membership benefits package including specialist, in-depth, 1-to-1 guidance from our Information Services team and from professional service partners. Access to exclusive membership networks (including comms, employers, governance and policy) supports members to grow their connections, stay up to date, exchange ideas and views with peers, and learn through tailored learning opportunities. SCVO members enjoy free access to Funding Scotland Premium to stay on top of funding opportunities to support their organisation’s financial resilience. Discounts and savings on SCVO products and services (including our HR service, managed IT support, payroll service and events and training) and partner offers provide members with support to allow them to focus on delivering their organisation’s goals. Further SCVO products and services include [extensive digital support](https://scvo.scot/support/digital), a climate action resource [Growing Climate Confidence](https://climateconfident.scot), a voluntary sector publication [Third Force News](https://tfn.scot) and a voluntary sector jobs and recruitment service [Goodmoves](https://goodmoves.org). For more information on SCVO membership, visit [SCVO membership](https://scvo.scot/membership)