Cyber insurance is becoming an increasingly important consideration for churches, charities and Christian organisations but insurance alone won't protect you from a cyber attack.
The reality is simple: buying cyber insurance is easy; making a successful claim may not be. Insurers increasingly expect organisations to demonstrate good cyber security practices before they will provide comprehensive cover or pay a claim.
Churches and Charities Are No Longer "Too Small" to Be Targeted
Many organisations still believe cyber criminals only target large corporations such as Marks & Spencer or the British Library.
Unfortunately, that's no longer true.
Small and medium-sized charities, churches and community organisations are now among the most common targets because they often have:
Limited IT budgets
Fewer dedicated cyber security resources
Valuable financial and personal data
Volunteers and staff with varying levels of cyber awareness
Cyber criminals are increasingly using automated tools that search the internet for vulnerable organisations. In many cases, attacks begin within seconds of a new internet connection becoming visible.
Human Error Remains the Biggest Risk
Around 90% of cyber incidents involve some form of human error.
That doesn't necessarily mean someone has done something careless—it simply means attackers are becoming exceptionally good at manipulating people.
Common examples include:
Clicking on convincing phishing emails
Reusing passwords across multiple websites
Falling victim to fake invoice requests
Responding to WhatsApp or email messages impersonating senior leaders
Downloading infected files from fraudulent websites
Artificial Intelligence has made these attacks even more convincing, allowing criminals to create realistic emails and messages in seconds.
Strong Passwords Are Essential. But They're Not Enough
A long, unique password remains one of your best defences.
However, cyber criminals now use sophisticated techniques that can bypass even accounts protected with Multi-Factor Authentication (MFA) through advanced phishing attacks.
The message from the webinar was clear:
Multi-Factor Authentication is essential, but it should never be your only line of defence.
Instead, organisations should build multiple layers of protection.
Think in Layers, Not Single Solutions
There is no single product that makes an organisation cyber secure.
Instead, experts recommend a "defence in depth" approach, combining multiple safeguards including:
Strong password policies
Multi-Factor Authentication
Staff cyber awareness training
Email filtering
Endpoint protection
Secure cloud backups
Continuous monitoring
Incident response planning
Each layer makes it harder for attackers to succeed.
Cyber Essentials An Excellent Starting Point
For many churches and charities, the best place to begin is Cyber Essentials.
This UK Government-backed certification helps organisations establish the essential security controls needed to reduce cyber risk.
Benefits include:
Better protection against common attacks
Greater confidence for trustees and leadership teams
Improved eligibility for some grants and contracts
Stronger position when applying for cyber insurance
Only a relatively small proportion of UK organisations currently hold Cyber Essentials certification, making it a worthwhile investment for organisations looking to improve their resilience.
Cyber Insurance Is More Affordable Than Many People Think
One of the biggest misconceptions is that cyber insurance is prohibitively expensive.
In reality, policies can often start from around £100 per year, depending on the size and nature of the organisation.
However, the cheapest policy is not necessarily the best policy.
Organisations should understand:
What is actually covered
What security controls insurers expect
What could invalidate a claim
The support available during a cyber incident
Good cyber insurance doesn't simply pay claims it provides access to specialist incident response teams who can help organisations recover quickly after an attack.
As the exclusive insurance partner of the CSC Buying Group, Unity Insurance Services understands the unique risks faced by churches, charities, schools and Christian organisations. Their specialist team can help CSCBG members review their existing cyber insurance arrangements, identify any gaps in cover, explain insurer requirements, and recommend policies that provide appropriate protection for their organisation. They can also advise on the cyber security measures that insurers increasingly expect to see in place, helping members improve both their resilience and their ability to secure comprehensive cover at competitive premiums.
If you're unsure whether your organisation has the right level of cyber protection, Unity Insurance Services can provide a no-obligation review to help you understand your options and ensure your organisation is properly protected.
The Cost of Not Being Prepared
A cyber attack can affect far more than your IT systems.
Potential consequences include:
Loss of sensitive donor or member information
Business interruption
Regulatory investigations
ICO reporting requirements
Financial losses
Reputational damage
Loss of public trust
For charities and churches, protecting reputation is often just as important as protecting data.
Practical Steps Every Organisation Should Take
Whether you're a church, Christian charity, school or ministry, there are several practical actions you can take today:
Review your password policy.
Enable Multi-Factor Authentication wherever possible.
Train staff and volunteers to recognise phishing attacks.
Include cyber risk on your organisational risk register.
Ensure regular, tested backups are in place.
Develop a cyber incident response plan.
Consider working towards Cyber Essentials certification.
Review whether your cyber insurance provides the protection your organisation really needs.
You're Not Asking If You'll Be Targeted, You're Asking When
Perhaps the strongest message from the webinar was this:
Cyber resilience isn't about assuming your organisation won't be attacked.
It's about ensuring you're prepared when an attack happens.
By combining good cyber security practices with appropriate cyber insurance, churches and charities can significantly reduce both the likelihood and the impact of cyber incidents.
Need Help?
As trusted partners of CSC Buying Group:
SCG Consulting can help organisations understand their current cyber risks, improve their security posture and work towards Cyber Essentials certification.
Unity Insurance Services can provide expert guidance on cyber insurance, helping organisations understand their risks, compare cover and ensure they have appropriate protection in place.
If you'd like to discuss improving your organisation's cyber resilience, contact the CSC Buying Group team at buy@cscbg.org.uk and we'll be happy to introduce you to the appropriate specialist.