What type of IT policy does your organisation need?

Section 1: Organisational Size and Structure

Score: 0/25

More than 50 total staff 10 points

25-50 total staff 5 points

Under 25 total staff 0 points

More than 100 active volunteers with system access 5 points

High staff turnover (>30% annually) 5 points

Multiple management layers (3+ levels) 5 points

Section 2: Geographic and Operational Complexity

Score: 0/20

Operations in 5+ countries 10 points

Operations in 2-4 countries 5 points

Single country operations 0 points

Physical offices in multiple locations 5 points

Fully remote or hybrid workforce 5 points

Section 3: Data Sensitivity and Volume

Score: 0/30

Health/medical information 10 points ⚠️ High Risk

Financial records beyond basic donations 8 points ⚠️ High Risk

Children’s data (under 16) 10 points ⚠️ High Risk

Government-classified information 10 points ⚠️ High Risk

Database with 10,000+ individual records 5 points

Database with 1,000-10,000 individual records 3 points

Regular processing of sensitive categories (race, religion, political views) 7 points

Section 4: Technology Infrastructure

Score: 0/25

Using 10+ different software systems/platforms 8 points

Custom-built applications or databases 7 points

Cloud services across multiple providers 5 points

Legacy systems requiring special security considerations 5 points

Integration between multiple critical systems 5 points

Self-hosted critical infrastructure 5 points

Section 5: Compliance and Regulatory Requirements

Score: 0/30

Subject to GDPR (EU operations or EU citizen data) 10 points ⚠️ High Risk

Subject to HIPAA (US health data) 10 points ⚠️ High Risk

Subject to state privacy laws without non-profit exemption 8 points ⚠️ High Risk

Government contracts with security requirements 10 points ⚠️ High Risk

Payment Card Industry (PCI) compliance required 7 points

Sector-specific regulations (education, healthcare) 5 points

Cross-border data transfers regularly 5 points

Section 6: Risk Profile

Score: 0/25

Previous data breach or security incident 10 points ⚠️ High Risk

High public profile or controversial mission area 8 points

Handles payments/financial transactions online 5 points

Regular target of cyber attacks or activism 7 points

Significant donor database with wealth information 5 points

Intellectual property or proprietary research 5 points

Section 7: Resource Availability

Score: 0/15

Annual budget over £10 million 8 points

Annual budget £1-10 million 4 points

Dedicated IT staff (2+ people) 7 points

Part-time IT staff or consultant 3 points

No dedicated IT resources 0 points

Section 8: Advanced Technology Usage

Score: 0/20

Active AI/ML deployment in operations 8 points ⚠️ High Risk

Extensive BYOD environment (>50% of staff) 5 points

IoT devices in operations 5 points

Blockchain or cryptocurrency involvement 7 points

Significant social media presence for service delivery 3 points

API integrations with external partners 5 points

❗ Critical Triggers (Automatic Advanced Policy Requirement)

Processing health records under HIPAA or equivalent ❗ Critical

Providing services directly to vulnerable populations with their data ❗ Critical

Operating in countries with strict data localisation laws (China, Russia) ❗ Critical

Managing government classified or controlled information ❗ Critical

Under current regulatory investigation or remediation ❗ Critical

Cyber insurance requires specific policy documentation ❗ Critical

Major donor or funder requires advanced IT governance ❗ Critical

Experienced significant data breach in past 2 years ❗ Critical

What type of IT policy does your organisation need?

IT Policy Complexity Assessment

Section 1: Organisational Size and Structure

Section 2: Geographic and Operational Complexity

Section 3: Data Sensitivity and Volume

Section 4: Technology Infrastructure

Section 5: Compliance and Regulatory Requirements

Section 6: Risk Profile

Section 7: Resource Availability

Section 8: Advanced Technology Usage

❗ Critical Triggers (Automatic Advanced Policy Requirement)

Your Assessment Results

Need help putting this into practice?