For most nonprofits, a few high-impact controls give the most protection per dollar: multi-factor authentication, tested backups, email security and staff training. After those come device management, least-privilege access, vendor checks and an incident plan. Nonprofits are attractive targets because they hold donor payment and personal data, move grant money, and often rely on volunteers and shared accounts. The checklist below is ordered by impact.
Why nonprofits get targeted
- Donor and beneficiary data has value to criminals.
- Finance teams handle large, irregular payments (grants, programme partners), which is ideal for wire fraud.
- Staff turnover, volunteers and shared logins weaken access control.
- Lean IT means alerts go unwatched, especially outside office hours.
The checklist
| # | Control | What "done" looks like |
|---|---|---|
| 1 | Multi-factor authentication | On for every staff and volunteer account in email, file storage, the donor CRM and finance systems; no shared accounts without MFA |
| 2 | Backups you've restored | Automatic backups of Microsoft 365 or Google Workspace and file data, one copy isolated, restore tested at least annually (backup vs disaster recovery) |
| 3 | Email security | Advanced phishing filtering; SPF, DKIM and DMARC on your domain to stop spoofing of your name to donors |
| 4 | Payment verification | Any new or changed bank details are confirmed by phone on a known number, never by email alone |
| 5 | Security awareness training | Short, regular training plus phishing simulations for staff and active volunteers (what works) |
| 6 | Managed devices | Laptops encrypted, updated automatically and running EDR; lost devices can be wiped |
| 7 | Least-privilege access | Admin rights limited; accounts removed the day someone leaves; quarterly access review of the donor database |
| 8 | Donor payment data | Use a PCI-compliant payment processor; never store full card numbers in spreadsheets or the CRM |
| 9 | Vendor and app inventory | A list of every SaaS tool holding donor or beneficiary data, with an owner and its security terms |
| 10 | Incident response plan | Two pages: who decides, who to call (IT, insurer, counsel, bank), how to notify donors if required |
| 11 | 24/7 monitoring | Someone watches security alerts outside office hours: a managed provider if you have no internal team |
| 12 | Safe AI use | A short acceptable-use policy: what data staff may put into AI tools (see our AI readiness framework for nonprofits) |
Making it work on a nonprofit budget
- Use the nonprofit pricing and programmes offered by major software vendors (Microsoft, Google and others). Check current eligibility, as offers change.
- Prioritise controls 1–4 first: they're mostly configuration, not new spend.
- Consider cyber insurance. Insurers will ask about MFA, backups and EDR, so this checklist doubles as application prep.
- Report progress to the board in one page: % MFA coverage, last restore test, training completion.
What good looks like
The Ocean Foundation, a global conservation nonprofit, chose Defensible "for the depth of their cyber expertise and knowledge of our legacy systems". The team assessed its needs, made clear recommendations and helped it regain control of all its systems. Read the full story.
Volunteers and staff turnover
Nonprofits often have more people joining and leaving than companies of the same size. Make access changes routine:
- Onboarding: individual account, MFA set up on day one, access only to the systems the role needs, a 15-minute security briefing.
- Role changes: remove access that's no longer needed when someone moves teams or finishes a project.
- Offboarding: disable accounts the same day, transfer file ownership, recover devices, and change any shared passwords they knew.
Scenario: a fake grant payment request
A finance coordinator gets an email that appears to come from a programme partner, replying in a real thread, with new bank details for a grant disbursement. With this checklist in place, the result is different at each step: MFA makes it harder to take over the partner's or your own mailbox (control 1); email security flags the look-alike domain (control 3); and the call-back rule stops the payment even if the email looks legitimate (control 4). Without them, the money is usually gone within hours.
One-page board report
| Measure | Target |
|---|---|
| Accounts with MFA enforced | 100% |
| Last successful backup restore test | Within 12 months |
| Staff and volunteers who completed training this year | ≥ 90% |
| Devices encrypted and managed | 100% |
| Open high-risk findings | Trending down quarter over quarter |
Frequently Asked Questions
What is the most important cybersecurity step for a small nonprofit?
Turning on multi-factor authentication for every account, especially email and the donor database. It blocks most account-takeover attacks.
Do nonprofits have to comply with data breach laws?
Generally yes. State breach-notification laws apply based on the personal data involved, not on tax status, and some sectors add their own rules.
How much should a nonprofit spend on cybersecurity?
It varies with size and data. Start with low-cost, high-impact controls (MFA, backups, email security, training) before larger investments.
Can volunteers have access to donor data?
Only with individual accounts, MFA, the minimum access needed, and removal when they leave.
Protect your mission without a big IT team. Defensible provides managed IT and cybersecurity for nonprofits, from MFA and backups to 24/7 monitoring and AI policy. Talk to Our Nonprofit Team.
