Many businesses assume that they have transferred their liabilities and risk when their data is in a cloud provider’s hands. In most cases this is not the position and there is little protection in terms of liability with your cloud providers.

In July 2020, The National Trust became one of the latest victims to issue a data breach alert, after cloud computing service Blackbaud was attacked. The growing cyber attacks have so far also affected charities such as Sue Ryder, Young Minds as well as dozens of universities. 

Although Blackbaud have said the data compromised did not include bank account or payment card details, a source has told the BBC that in some cases it involved donors’ details including:

• Names, ages and addresses
• Car licence details
• Employers
• Estimated wealth and identified assets

Using cloud-based services for your charity's data

During a webinar we recently hosted, a question was raised regarding mitigating the need for cyber protections due to cloud based services being purchased. Provided that you have systems, policies and procedures in place to keep data secure, using the cloud as a backup option is suitable and provides benefits to re-instate data and potentially defeat ransomware demands, which are increasing.

About the author

James Anscombe Cert CII is a respected industry leader with over 10 years' business development experience protecting clients in the charity insurance sector. His professional area of expertise is working with and developing new clients within the not-for-profit sector, offering the best solutions to each individual charity to protect organisations for the long term.

Charity insurance from Towergate

Every charity is unique, so the policy that’s right for your needs to be specially tailored to your needs. At Towergate, we’ll take the time to get to know your charity and work closely with you to draw up and cost a charity insurance policy that will give you the peace of mind that you’re covered in any event. Call us for a quote when you’re ready on 0330 123 5274, or read more about our specialist charity insurance.

Ensuring your charity's cloud-based data is secure

Certain things that you may need to consider when using a cloud-based service, however, include:

• Who has the access and authority to modify backups?
• How secure are your backups, could a ransomware attack overwrite previous backups, have you ensured your cloud provider keeps multiple versions of backed up data?
• What support will your cloud provider provide in the event of an attack?
• Will your cloud provider accept responsibility for attacks via their systems?
• Do you have client or other service providers software on your systems, is this clear to your cloud provider and are there any additional terms or restrictions from a third-party perspective?
• Does your cloud provider have multi-factor authentication to protect backups?

Such steps should assist to mitigate the risk of ransomware and other cyber-attacks. It is essential that you manage data as securely and as closely as you would if this was stored on your own systems. There are also Information Commissioner and GDPR issues around data that is sensitive or personal that is then made public: this is still your risk and liability.

Protect your charity with cyber insurance

Cyber insurance can help protect your business against a range of cyber threats and exposures, including cybercrime, data breaches and system interruption.

Top activity areas for cyber-criminals include:

• Ransomware
• Phishing
• Data leakage
• Hacking
• Insider threat

Cover can be purchased to protect against GDPR breaches, as part of a cyber protection policy. Get a cyber insurance quote online or call us on 0330 678 1221.

What cyber insurance does my charity need?

Quickly discover the level of protection you need by taking our simple three-minute cyber risk assessment test.