(image from pexels.com)
By Brian Cute
You run programs, raise funds, and coordinate volunteers on systems that carry donor information, beneficiary records, payment details, and staff communications.
If one phish slips through or one old laptop goes unpatched, the harm does not end with your inbox. It can ripple to clients who miss services, supporters who lose trust, teams who spend weeks recovering instead of serving, and cause irreparable harm to your organization’s reputation.
Here is the good news. You can raise your organization’s security floor with practical moves that fit how nonprofits work. You do not need a huge budget or a dedicated security team. You need a short list of habits, a few right-sized tools, and partners that share your public-interest values.
Nonprofit Cyber Reality Check
As a nonprofit leader, you face a distinct set of exposures:
- Personally identifiable information from donors and beneficiaries;
- Health, education, or case notes that are sensitive by nature;
- Payment processing across events, online portals, and field programs;
- Staff and volunteers who use personal devices that you do not manage;
- Legacy systems that feel “too old to touch” but still run critical workflows; and,
- A small IT team, or no formal IT team at all, and limited time.
Advances in AI also change how you calculate threat risks. AI lowers the cost of phishing, deepfakes, credential stuffing, and reconnaissance. Attackers can generate convincing messages at volume, spin up fake voices, and automate password guessing faster than your team can triage alerts. That means “good enough” security from five years ago is not good enough this year.
The challenge you face as a leader of a nonprofits is not only technical. It is mostly about capacity. You need simple steps that staff will follow, repeatable processes you can run each quarter, and solutions that reflect your bandwidth.
Practical, Mission-Aligned Security
Small actions add up. A sensible “Core 4” cybersecurity foundation can raise your baseline quickly:
- Use strong passwords stored in a password manager;
- Enable multifactor authentication (MFA) wherever available;
- Learn to recognize and report scams; and,
- Keep software and devices updated.
These are not slogans. They’re the foundation for preventing account takeovers and drive-by malware. Even partial adoption across your organization will dramatically reduce risk.
To make these steps easier, several public-interest groups and coalitions offer free or low-cost cybersecurity toolkits designed for nonprofits. They bundle how-to guides, checklists, and vetted tools so you can take action without spending weeks researching options.
One such example is the Mission-Based Cybersecurity Toolkit by the Global Cyber Alliance (GCA), which includes curated resources for smaller organizations. Also consider sharing short AI safety one-pagers or infographics from trusted organizations to help staff and volunteers use generative AI tools responsibly — covering what to share, how to verify outputs, and how to protect accounts.
Moves you can make today include:
- Roll out a single password manager to all staff and key volunteers. Set organizational policies so the tool generates unique, long passwords by default.
- Require multifactor authentication (MFA, also sometimes called 2FA) wherever possible, starting with email, your donor management system, and payroll.
- Turn on automatic updates on laptops and phones and stop using devices that can no longer get updates.
- Run a quick phishing awareness refresher during your next staff meeting. Use real examples from your inbox to make it concrete.
- Add a protective domain name system (DNS) such as Quad9 to your network and devices so known malicious domains are blocked before a click becomes a compromise.
People, Process And Partners
Technology is only half of your posture. The other half is the way you work. Here are six steps to consider:
Policies — Keep short, actionable policies for passwords, data handling, and acceptable use. Write them in clear language that’s easily digestible by your teams.
Access discipline — Use role-based access so people only access accounts and systems they need to do their job. Additionally, establish an iron-clad practice that ensures access is removed the same day someone leaves. Review access levels regularly.
Onboarding and offboarding — Add security steps to your human resources checklist. New hires get the password manager, MFA, and the AI safety one-pager. Departing staff have accounts disabled and laptops wiped.
Backups — Back up critical data on a regular basis, store at least one copy offline or in a separate tenant and test a restore each quarter.
Tabletop drills — Once per quarter, walk through a basic incident scenario. Decide in advance who notifies funders, who talks to the board, and how you keep services running. These types of “firedrills” will pay dividends in the occurrence of an actual incident.
Designate a “security champion.” This is not a new hire. It is a staff member who convenes a 30-60 minute “security stand-up” once a month, checks that the Core 4 stay in place, and keeps a short list of improvement goals for the next quarter.
Real Help From The Nonprofit Ecosystem
You do not have to build a security stack from scratch or evaluate every vendor on your own. Several nonprofit collaborations curate free or low-cost solutions for missions like yours.
Nonprofit Cyber Solutions Index – This index catalogs free or affordable capabilities from cybersecurity nonprofits across identity protection, email security, backups, incident response, information sharing, and more. It is a fast way to see what public-interest organizations already provide and to compare options that respect your constraints.
Common Good Cyber – This initiative maps tools and services that improve Internet safety in the public interest and mobilizes philanthropic support to scale what works. Reviewing the mapping helps you find proven defenses and informs conversations with funders about underwriting core protections.
Protective DNS with Quad9 – Protective DNS blocks connections to known malicious domains so many attacks fail silently. Quad9 is a free, privacy-respecting resolver used by nonprofits, schools, individuals, and enterprises worldwide. You can deploy it by updating network settings or installing device resolvers, and it delivers quick wins across laptops and phones, including bring-your-own-device environments.
Ask for nonprofit pricing – Many reputable vendors offer discounts on password managers, email security, backup services, and training. You do not have to accept list prices. Make “nonprofit pricing” part of your standard procurement script.
10 Wins You Can Implement This Month
Use the list below as your 30-day action plan.
- Select your security champion and schedule a 60-minute monthly stand-up. Give that person permission to chase loose ends.
- Inventory your accounts and devices. List email domains, cloud services, and laptops. If you cannot list them, you cannot protect them.
- Require MFA on email, donor management, payroll, and cloud storage. Extend it to social media logins used by your communications team.
- Adopt a password manager and enforce unique passwords. Turn on sharing for team vaults so people do not keep credentials in spreadsheets.
- Switch your DNS to Quad9 on the office network and staff laptops. Add it to a simple bring-your-own-device guide for volunteers.
- Enable automatic updates on every device. Create a five-minute checklist for staff to follow before travel or events.
- Run a backup test for your donor database and shared drive. Document how long a restore takes and where to find the backup keys.
- Hold a phishing drill using real-world examples from recent attempts. Teach people to report suspicious messages and celebrate quick reporting.
- Publish a short, easy to follow AI guidance procedure. Require approvals before posting AI-generated content under your organization’s brand.
- If needed, plan for Windows 10 end of life (EoL) support. Identify devices that need an upgrade, price options, and add milestones to your Q4 board report.
Building The Future Workforce
Point your staff and interns to free online cybersecurity micro-courses (from GCA, Coursera, or regional training programs) that cover backups, phishing, MFA, software updates, and asset inventory. These are bite-sized lessons designed for non-specialists, and they help your team build shared language around risk. Use them to onboard new hires and volunteers, or to refresh seasoned staff.
You can also connect with universities and training programs in your region. Many programs focus on practical AI and cybersecurity skills and look for capstone projects with real impact. Partnering with a local program gives you access to emerging talent while giving students hands-on experience solving real nonprofit problems.
The Takeaway
Start with small, steady steps:
- Adopt a nonprofit-friendly cybersecurity toolkit.
- Explore indexes and initiatives that map free or affordable solutions.
- Enable MFA and protective DNS today.
- Appoint a security champion to keep progress moving.
You don’t need perfection, you need momentum. Every step you take strengthens the trust that beneficiaries, donors, and communities place in you. Cybersecurity is not just about protecting data; it’s about safeguarding the lifeline of your mission.
*****
Brian Cute is interim chief executive officer and director of the Capacity & Resilience Program for the Global Cyber Alliance, an international nonprofit organization that mobilizes collective action.
