What Does Cybersecurity for Nonprofits Look Like?

Nonprofits are often tasked to do the impossible — effect real change with as few resources as possible. A lower “cost per change” enables you to provide more services and to entice philanthropists by demonstrating your ability to solve important problems at a relatively low cost.

Starting in the late 1990s with the dot-com boom, many nonprofits realized that technology afforded by the Internet could help them do just that. Fast forward to the past three years, and the promise of AI has accelerated nonprofit leaders’ thinking in this space.

Leveraging technology to help your nonprofit accelerate is important and commendable. But very often, we embrace and disseminate a new technology without the due diligence of asking the most important question — what risks am I opening myself and my organization up to?

The topic of cybersecurity is something that every nonprofit should contend with. What are we doing to make sure that our systems and people are secure, while not holding them back from the tools that can make their work more efficient, ultimately bringing them more satisfaction as they accomplish your mission?

It Starts with Culture

Nonprofits need to actively have this conversation internally. It is very easy to download the newest app and connect it to everything that you can think of because your friend told you how awesome of a tool it is.

Staff need to remember that every connection is an exposure to risk. They need to clearly understand who is the ‘cybersecurity czar’ in your organization who has the knowledge and permission to authorize tool exploration.

Training should be designed, mandated, and embraced. The field of cybersecurity is very developed with many experts out there. Most likely members of your lay leadership have indeed dealt with this topic in some capacity. Build out a formal function that tackles these issues, and let them guide you through this process while not severely hampering or scaring your staff.

What Types of Things Should We Be Working On?

There are six primary areas that I would encourage nonprofits to address when it comes to cybersecurity.

• Identity and Access Management: Ensuring that all your systems are accessed by only the people who should have access, while making sure that the person accessing is really who you think it is. A simple first step is to ensure two-factor authentication is enabled.

• Donor and Constituent Data: Know where Personally Identifiable Information (PII) and payment data live, minimize what you keep, restrict who can export it, and vet third-party platforms (CRM, payment processors, event tools) since those vendors hold most of the risk.

• Email and Phishing: Staff training, protocols like SPF, DKIM and DMARC so that your domain can't be spoofed in outbound emails, and a clear process for verifying payment or wire-change requests. Business email compromise targeting finance and development teams is where nonprofits can lose real money.

• Device Management and Maintenance: Managed laptops, automatic updates, and endpoint protection, especially with remote and part-time staff on personal devices.

• Backups and Recovery: What systems and devices need to be backed up, and what is the process to ensure it gets done? If a system goes offline or is accidentally wiped, what business impact will it have on your organization?

• Governance: A basic set of policies built in conjunction with your board that helps you minimize risk and keep your organization safe. Acceptable Use Policy, data retention, and access management policies are the basic building blocks. Cybersecurity insurance should be considered and acquired as well.

Why Should We Do This?

If you’ve read this far and don’t understand the importance of this topic, then forward this article to someone else in your organization who will be able to convince you. This is the unexciting part of our mission-driven work, but it must be discussed and fit to the needs of your organization.

A misstep in any one of those areas can genuinely hamper your ability to accomplish your mission, either temporarily or for good.

An organization with a thorough plan for its cybersecurity builds a team ready to harness the exponential power of technology in doing more good for your most important constituents.