Funded Cyber Health Places for Schools and Charities
A free, expert cyber health assessment for organisations that protect the people who need it most. Funded through ICCSO's community partners, with a limited number of places available each quarter. Schools, trusts and charities hold some of the most sensitive data in the country: safeguarding records, pupil and beneficiary details, donor information. Most do so without a dedicated security specialist, and every pound spent on IT is a pound not spent on learners or the cause. ICCSO Funded Cyber Health Places give eligible organisations a clear, independent picture of their cyber risk, and a practical plan to reduce it, at no cost. As a UK community interest organisation, we exist to strengthen cyber resilience where it matters most, not to sell to it.
Know where you stand before an attacker does
A single cyber incident can close classrooms, expose safeguarding information or put vulnerable beneficiaries at risk. Governors, trustees, insurers and funders are all asking harder questions about how cyber risk is managed. A funded place gives you the evidence and the plan to answer them with confidence.
What a funded place includes
Cyber Health assessment: a structured review of governance, user access, backups, devices, email security and staff awareness. Cyber Health Report: a clear risk rating and plain-English findings, plus a one-page summary ready for your governors or trustees. Cyber Essentials readiness check: a clear view of how close you are to certification, increasingly expected by funders, commissioners and insurers. Findings review: a 45-minute session with an ICCSO advisor. 90-day action plan. Incident response starter template. 3-month check-in. Free ICCSO membership and a Cyber Health Assessed badge. A route forward: optional preferential access to ICCSO's Cyber Aware, Cyber Secure and Cyber Resilient programme levels. There is no cost and no obligation.
Who can apply
Funded places are open to UK organisations without dedicated in-house cyber security expertise: state-funded schools and Multi-Academy Trusts; registered charities, community interest companies and social enterprises. Priority is given to organisations that hold sensitive or safeguarding data, serve vulnerable or disadvantaged communities, have no dedicated IT security staff, or have recently experienced an incident or near miss. Organisations that received a funded place in the previous 12 months are not eligible.
How it works
Apply online: complete a short application form. It takes around 10 minutes. We review applications: an ICCSO panel considers need, the sensitivity of data held and community impact. Hear back quickly: every applicant hears from us within one week of the closing date. Your assessment: successful organisations complete their Cyber Health assessment over around six weeks. Your plan: receive your report, review the findings with an ICCSO advisor and leave with a clear 90-day action plan.
Current intake
Intake dates and the number of places for schools and trusts and for charities and non-profits are published on this page for each intake.
Frequently asked questions
Is it really free?
Yes. A funded place costs your organisation nothing, and there is no obligation to buy anything afterwards.
Who funds the places?
Places are funded through ICCSO's community partners, organisations that support our mission to strengthen cyber resilience in the community.
Is ICCSO trying to sell us software or services?
No. ICCSO is a UK community interest organisation. Our guidance is independent, and we will give you an honest view of where you stand, even if our free resources are all you need.
We're a small organisation with no IT staff. Is this for us?
Absolutely. Funded places are designed for organisations like yours. Everything is in plain English and scheduled around your capacity.
How much time will it take?
Around 2 hours of your team's time over six weeks, including the questionnaire, a short kick-off call and the findings review.
What happens to our information?
Your information is handled confidentially and used only to deliver your assessment. Findings are only ever shared in anonymised form, with your consent.
What if we're not selected?
You'll be offered free access to our Cyber Health self-assessment tool and priority consideration in the next intake. Access is not automatic: register or log in to your ICCSO account, then ask ICCSO to grant Cyber Health access to your organisation. Priority consideration does not guarantee a place.
We think we've already had a cyber incident. Can you help?
If you're dealing with a live incident, report it to Report Fraud at reportfraud.police.uk (the national service that replaced Action Fraud in December 2025), or in Scotland call Police Scotland on 101, and follow NCSC guidance, including reporting at report.ncsc.gov.uk. If personal data is affected you may need to report a breach to the ICO, and charities should consider reporting a serious incident to the Charity Commission. You're still welcome to apply for a funded place to strengthen your resilience afterwards.