This new resource covers essential security practices, affordable tools, risk assessments, funding resources, and training recommendations, all tailored for mission-driven organizations with limited technical capacity.
Why Cybersecurity Matters for Nonprofits
Nonprofits are increasingly targeted by cybercriminals due to their valuable data, donor databases, payment systems, and sometimes limited security infrastructure.
A single breach can jeopardize client safety, erode donor trust, and interrupt mission-critical services. From food banks to advocacy groups, any organization that stores sensitive information is a potential target.
A survey by the Nonprofit Technology Network found that 68% of nonprofits had no documented incident response plan and 59% did not provide regular cybersecurity training to staff. Meanwhile, phishing, ransomware, and account compromise remain top threats facing the sector.
Top Cybersecurity Threats Facing Nonprofits
| Threat | Description |
| Phishing Attacks | Fake emails tricking staff into revealing passwords or sending money |
| Ransomware | Malware that encrypts data and demands payment for access |
| Business Email Compromise | Impersonation of executives or vendors to divert funds |
| Insider Threats | Unintentional or malicious actions by staff or volunteers |
| Weak Password Practices | Shared, reused, or non-secure login credentials |
| Unpatched Software | Outdated systems with known vulnerabilities |
Essential Security Practices for Nonprofits
| Practice | Why It Matters |
| Use Multi-Factor Authentication (MFA) | Prevents unauthorized access even if passwords are compromised |
| Back Up Critical Data | Ensures recovery in case of ransomware or accidental deletion |
| Staff Cybersecurity Training | Empowers users to detect phishing and follow best practices |
| Apply Software Updates Promptly | Fixes known security flaws in systems and plugins |
| Limit Access Based on Role | Reduces risk by restricting sensitive systems to relevant staff |
| Use Reputable Antivirus & Firewalls | Detects malware and blocks known threats |
Low-Cost and Free Security Tools for Nonprofits
| Tool | Purpose | Cost/Access |
| Cloudflare Zero Trust | Secure logins and access | Free for nonprofits |
| Google Workspace Security Tools | Phishing protection, device management | Included with Google for Nonprofits |
| Cisco Umbrella | Web filtering and DNS protection | Discounted via TechSoup |
| LastPass | Password management | Nonprofit discount via Tech Impact |
| Malwarebytes | Endpoint protection | Free & discounted licenses |
| Microsoft Defender for Endpoint | Advanced threat protection | Discounted through Microsoft for Nonprofits |
Cybersecurity Policies Every Nonprofit Should Have
- Acceptable Use Policy: Outlines what staff and volunteers are allowed to do on organizational systems and devices, helping prevent misuse and shadow IT risks.
- Password Policy: Defines password complexity, expiration, and storage rules to reduce the likelihood of unauthorized access.
- Data Retention and Backup Policy: Specifies how long different types of data must be retained and how backups are created, tested, and stored securely.
- Incident Response Plan: Provides a step-by-step process for detecting, reporting, and recovering from cybersecurity incidents, ensuring fast and coordinated action.
- Remote Work and BYOD Policy: Establishes secure practices for staff using personal devices or accessing systems off-site, including VPN use, encryption, and patching.
- Vendor Risk Management Guidelines: Ensures that third-party providers meet security standards and outlines how vendors are assessed, approved, and monitored over time.
How to Conduct a Basic Cybersecurity Risk Assessment (Even Without a Dedicated IT Team)
Most nonprofits don’t have a CISO or cybersecurity analyst on staff. But you can still perform a meaningful internal risk assessment using a simple framework.
Step 1: Identify What You Need to Protect
Start with a quick inventory of your digital assets. Focus on:
- Donor and beneficiary data (names, emails, donation history, personal stories)
- Financial and banking systems
- Internal documents (grant proposals, contracts, board records)
- Email accounts and shared drives
- Third-party tools (CRM, cloud storage, accounting software)
Step 2: Identify Who Has Access
List who can access each category of data:
- Are former staff or volunteers still able to log in?
- Do interns have access to financial documents?
- Are accounts shared informally?
Restrict access to “need-to-know” only. Use role-based permissions wherever possible.
Step 3: Assess How Data Could Be Compromised
Ask:
- What happens if a donor database is leaked?
- Could someone impersonate our executive director to reroute a wire transfer?
- What if our Gmail account gets hacked?
This helps prioritize what systems to protect first.
Step 4: Evaluate Your Existing Protections
Do you:
- Use multi-factor authentication (MFA)?
- Have regular backups (offsite and offline)?
- Provide staff cybersecurity training?
- Use strong passwords and a password manager?
- Monitor admin accounts and logins?
If the answer is “no” to most, those are your quick wins.
Step 5: Document and Prioritize Risks
Use a simple grid:
| Risk | Impact (High/Med/Low) | Likelihood | Next Step |
| Donor info stolen via phishing | High | Medium | Add MFA, train staff |
| Shared email account misused | Medium | High | Move to individual logins |
| Outdated plugin vulnerability | High | Low | Enable auto-updates |
Step 6: Review Quarterly
Even a basic spreadsheet-based risk tracker can improve decision-making and security posture. Revisit it quarterly or when launching new programs/tools.
Case Study: A Real-World Nonprofit Cyberattack
In 2020, hackers used a spoofed email address to impersonate the founder of Roots of Peace, a nonprofit focused on landmine removal. The email requested urgent wire transfers for field operations. Because the communication appeared legitimate and aligned with ongoing international work, staff approved the transfers.
The result? The nonprofit lost over $1.3 million through a combination of phishing and business email compromise. The attackers had conducted enough research on the organization’s structure and language patterns to fool even experienced team members. The attack not only caused significant financial loss but also strained donor trust and temporarily disrupted field operations.
Lessons from This Case:
- Social engineering tactics are increasingly sophisticated and often mimic internal voices or suppliers.
- MFA, staff verification procedures, and training could have flagged the suspicious request.
- Nonprofits must train staff to question urgency + wire transfer requests, even from apparent leaders.
- The absence of technical protections (like SPF/DKIM email authentication) can make spoofed emails harder to detect.
This incident really shows that cybersecurity is something to be done on an operational level. Nonprofits, especially those doing international work or relying on grant transfers, are (sadly) prime targets for these attacks.
Training and Awareness Recommendations
- Conduct mandatory cybersecurity training for new staff and volunteers
- Run phishing simulations using tools like Cofense or KnowBe4
- Create plain-language guides for recognizing scams and reporting suspicious emails
- Hold annual refresher workshops and tabletop exercises
Cyber Insurance and Legal Considerations
- Review whether your general liability insurance covers cyber incidents
- Consider cyber liability insurance for organizations handling donor or client PII
- Know your obligations under laws like GDPR, HIPAA (if applicable), or state-level breach notification laws
- Document and test your incident response procedures regularly
How Non-profits Can Vet and Manage Third-Party Vendors
Nonprofits often rely on third-party vendors to handle everything from donations and CRM platforms to cloud storage, communications, and payroll. These tools can be essential to your mission, but they also introduce cybersecurity risk—especially when they store or transmit sensitive data like donor information, client records, or payment details. If a vendor is compromised, your nonprofit may still bear the consequences in terms of trust, liability, and operational disruption.
Why Vendor Risk Matters
According to the latest data breach statistics, the average data breach costs over $4M in 2025.
For nonprofits, this breach could be from a donation platform with outdated encryption, a CRM vendor with poor internal access controls, or even a web developer with backdoor admin privileges.
When a breach occurs, donors won’t care whether it was “your vendor’s fault”. They’ll typically hold your organization responsible for protecting their data.
Questions to Ask Before Choosing a Vendor
Before signing a contract or connecting a new platform to your systems, ask:
- Do they support multi-factor authentication (MFA)?
Any platform storing sensitive data should allow (or require) MFA for all user logins. - What certifications do they hold?
Look for vendors that are SOC 2 compliant, ISO 27001 certified, or PCI-DSS compliant if they process payments. - How do they handle data privacy and breach notification?
Ask to see their privacy policy and terms of service. Do they outline how and when they will notify you of a breach? - Do they store data securely and within legal jurisdictions?
Make sure your vendor’s hosting practices comply with relevant privacy laws (e.g., GDPR, CCPA, HIPAA, if applicable). - Will they sign a data processing agreement (DPA)?
If your nonprofit operates in the EU or handles sensitive personal data, a DPA is often legally required.
Best Practices for Managing Vendors
Vetting isn’t a one-time task. Ongoing vendor management helps ensure security standards are maintained over time.
- Maintain a vendor inventory
Keep a central list of all vendors, tools, and platforms your organization uses. This is especially true for people with access to email, financials, donor data, or internal files. - Limit data access
Apply the principle of least privilege. Only give vendors access to the specific tools or data they need. Don’t forget to remove access when no longer necessary (hard to keep track of, but worth it). - Review contracts and renewals with security in mind
Treat renewals as an opportunity to renegotiate terms, ask for updated documentation, or switch to a more secure provider. - Ensure offboarding is part of your workflow. If a vendor relationship ends, make sure their access is revoked across all systems and passwords are changed if shared credentials were used (though ideally they weren’t).
Include Vendors in Your Incident Response Plan
If a breach does occur, vendors should be part of your response process. Your plan should answer:
- Who is responsible for notifying and coordinating with vendors?
- What systems rely on each vendor?
- How will you temporarily replace or work around a vendor outage?
- Where are your backups stored, and how can you recover data if the vendor fails?
Building a Culture of Security in Your Organization
For nonprofits, where data includes sensitive donor records, client case files, and strategic program details, a single lapse in security can have outsized consequences. Yet many organizations mistakenly view cybersecurity as the responsibility of the IT person or consultant. To build true resilience, nonprofits must embed a culture of security across every level of the organization.
Leadership Sets the Tone
This starts with leadership. The board of directors and executive team must set the tone by acknowledging cybersecurity as a core operational risk. This level of urgency/focus can even be on par with financial accountability or compliance. Including cybersecurity in strategic plans and quarterly risk assessments signals that it’s not an afterthought. When leadership allocates time, budget, and visibility to cybersecurity, staff take it seriously.
Cybersecurity should also become a standing item in board and leadership meetings. Even simple metrics—like number of staff trained, simulated phishing results, or incident response test completions—can help track progress and accountability. It also ensures leaders stay informed about evolving risks and compliance responsibilities (such as state-level data breach laws or HIPAA/PCI obligations).
But strategy alone isn’t usually enough to help with your organization’s cybersecurity without follow-up habits and visibility. So you’ll want to weave cybersecurity expectations into daily operations, team communications, and HR processes. Training is a key part of this. Cybersecurity basics should be included in every staff and volunteer onboarding (even for non-IT roles). Annual refresher training should be mandatory for all, especially those with access to donor data, financial systems, or client records.
Use role-specific examples to make training meaningful. A program coordinator might need to understand how to recognize fake grant documents or phishing emails that target nonprofits. A volunteer manager should know the risks of using shared passwords or public Wi-Fi to manage a volunteer roster.
Evaluations and performance reviews can also include a brief review of digital hygiene practices, such as following password policies, reporting suspicious activity, or completing required training. This creates positive reinforcement and integrates security into routine accountability.
Empowering Staff Through Recognition and Collaboration
Recognizing good behavior is another underused strategy. Staff who report phishing attempts or identify vulnerabilities should be publicly thanked in team meetings or internal newsletters. Consider setting up a “Security Star” recognition program or gamifying internal phishing tests with leaderboards and small rewards.
Collaboration is also essential. IT or external tech consultants should have a clear line of communication with department heads and frontline teams. Security is more effective when staff feel empowered to raise concerns (like suspicious emails, unauthorized access, or gaps in protection) without fear of blame.
Finally, consider building a cross-functional “security champions” group that includes representatives from different departments. This group can help tailor security messages, surface pain points, and promote best practices peer-to-peer.
In short, a strong security culture turns every staff member into a human firewall. It reduces the chances of breaches, accelerates response times, and builds a more resilient, trusted nonprofit. With board support, consistent training, and positive reinforcement, nonprofits can make cybersecurity part of their core DNA.
Grants and Resources for Cybersecurity Capacity Building
Fortunately, there are several grants and free resources that are ideal for non-profits looking to increase their organization’s cybersecurity capabilities.
| Resource | Description |
| TechSoup | Software discounts, training, and security guidance |
| NTEN | Nonprofit tech community with cybersecurity resources |
| CyberPeace Institute | Supports civil society orgs under digital threat |
| CISA Nonprofit Security Tools | Federal guidance and alerts for critical infrastructure orgs |
| Microsoft for Nonprofits | Free and discounted tools, grants, and training |
Final Takeaway
Even with limited resources, nonprofits can build strong digital defenses with the right tools, training, and policies. Start with a risk assessment, educate your team, and implement basic protections. Your important mission deserves to be protected from digital harm.