This Inaugural Third Sector 'How Prepared is the Third Sector to Secure it's Information' Survey Data, is taken from 34 Responses to an Academic BSc Information Security Degree Dissertation and the resulting survey.

1. UK's FIRST EVER
THIRD SECTOR CYBER
SECURITY SURVEY 2015
6
7 8
Of Third Sector Organisations see
a Large Organisation or Business
that has suffered a Data Breach
but do NOT in any way; relate
this risk to their own
Organisation.
This Inaugural Third Sector 'How Prepared is the Third Sector to Secure it's Information' Survey Data, is taken from 34 Responses to
an Academic (Hons) Information Security Degree Dissertation and the resulting Survey.
Content is Copyright of Information Security Know How Ltd. - 2015 © Unless Otherwise Stated - All Rights Reserved
Learn more @ WWW.ISKnow.How
Are aware of the increasing
threat of 'Insider Attacks' and
the risks that they pose to all.
Of Organisations collect Sensitive Client Data
such as Health or Financial Records, Names
and Addresses, Dates of Birth etc.
Of UK Third Sector
Organisations know what
Cyber Security is all
about.
Do NOT utilise a Strong Password
Policy; which combines Upper &
Lower Case Letters, Numbers or
Symbols.
3
2
1
Believe that they know
what 'Social Engineering '
is.
Have appropriate Cyber Security Insurance for
the additional protection of this data, in the
event of a Data Breach.
However, Only half have an Active
Cyber Security Policy in place.
Only 1/4 of Charities follow
principles set by Information
Commissioners Office (ICO) to help
protect their most valuable data.
Of Staff or Volunteers are
NOT Appropriately Trained in
any aspect of Cyber Security.
82%
Of Charities have
NEVER Tested
their Data
Security
4
ONLY
Stated, that they either would
NOT know if they had Suffered a
Data Breach, or they were NOT
SURE if they'd be Aware.
Understand the Gravity of what a
Cyber Security Data Breach can
do to their Organisations
Reputation.
Do NOT have a structure in place,
to check if any of their 3rd Party
Suppliers, have their own Cyber
Security Policies and adhere to
them.
Of Third
Have NEVER used their Regulatory Body
for Cyber Security Advice or Guidance.
Sector Organisations
71%
Do NOT know, if their Regulatory
Body offers relevant Cyber
Security Advice, or Guidance at
source.
Do NOT know what
Pen-Testing is, what it involves or
indeed what it's benefits are.
Allow their Staff or
Volunteers to utilise their
own devices.
Do NOT currently have an Active
Bring Your Own Device (BYOD)
Policy in place within the
Organisation.
5
Of the above, are NOT aware of
how to increase the detection of
this risk group, or indeed how to
prevent the situation.
Do NOT have a nominated Data
Protection Officer within their
Organisation.
Are NOT aware of ISO 27001,
Cyber Essentials or Cyber
Essentials Plus.
Are also NOT aware, that being
accredited to these standards,
can quite possibly reduce their
Organisations Insurance
Premium(s).
85%