Protect Your Mission: A Practical Cybersecurity Framework for Nonprofits

The leadership team called us into the conference room for an urgent meeting.

One of our colleagues had emailed several years’ worth of payroll records to someone claiming to be the president of the organization, who said they were going into an important meeting and needed these files urgently. But, it wasn’t the president; it was a cybercriminal.

Leadership had to drop everything to deal with the situation. Key priorities were set aside, significant costs incurred, and even former staff had to be informed of the breach.

And now, that cybercriminal has my social security number, address, phone number, and salary information – enough information to open accounts in my name and impersonate me.

This was a small organization. We all knew each other and worked closely. The person who made this mistake was trustworthy and good at their job. They were simply trying to help a leader they knew and trusted.

Yet, it happened, and it led to severe consequences for the organization and everyone in it.

Cybersecurity as a Leadership Priority

This incident took place when it was still possible to identify a phishing email by misspellings, poor grammar, wonky formatting, or an offer too good to be true. Today, AI makes it possible to fix imperfections, personalize messages using publicly available data, and launch attacks at a scale and speed never before possible. 

The threat landscape has completely changed, and our sector is a prime target. Small- and medium-sized nonprofits are one of the most targeted industries for high-severity cyberattacks. We hold valuable data and are overstretched and under resourced. In 2024, the nonprofit sector experienced a 30% year-over-year increase in weekly cyberattacks. 

If you lead an organization of any size, cybersecurity must be a leadership priority. You and your team are stewards of sensitive and valuable data belonging to the people and communities you serve, your donors, and your staff. A data breach can undermine the trust you rely on to deliver on your mission.

The good news is the highest impact interventions are easy and inexpensive to implement.

Framework for Approaching Cybersecurity

Start by asking yourself these questions:

• How do I protect my identity?
• How can I see what my organization has?
• How can I control what people can and cannot do in our systems?
• How do I build a culture of security?

Protect Your Identity

Cybercriminals want your login credentials. If they can log in, they can walk right through the front door of your systems undetected, then access, modify, and control your data.

Make your passwords as strong as possible.

• Enforce a minimum of 12-15 characters including mixed cases, numbers, and special characters.
• Require unique passwords for every system.
• Never share passwords through unsecure channels, such as email or DM.

Keep your logins secure with a password manager.

• These tools can generate strong, unique passwords, store them securely in an encrypted vault, and flag weak or breached passwords.
• Each team member only needs to remember one password (to their vault), making a password manager one of the few tools that makes your digital life more secure and easier to manage.
• When you consider the average cost of a nonprofit data breach could reach up to $2 million, the modest subscription cost is well worth the investment.

Enable multi-factor authentication (MFA).

• MFA adds a secondary verification step, such as a code sent to your phone or authenticator app.
• Even if your password is stolen, an attacker can’t get in without the code.
• Pairing a strong password with MFA can reduce account compromise risk by 99%.

Finally, be ready to adopt newer methods when they become available.

• Passkeys are quickly replacing the password and MFA combination and are far more resistant to phishing. Enable passkeys wherever you can. 

Know What You Have

You can’t protect something you don’t know you have. Ensure you have visibility into your systems and devices so you can monitor activity, respond to anomalies, and turn off access that is no longer needed.

Start by creating inventories of every device and software your organization uses.

• For hardware, log every device – include the model, serial number, who has it, and what it accesses.
• For software, document every tool your organization has procured, what it’s used for, who manages it, which staff have access, costs, and renewal timelines.
• When a security incident occurs, a complete and up-to-date inventory will ensure you can identify everything that needs to be secured so you can close off all vulnerabilities.

Pay attention to hardware and software updates.

• Updates often include fixes for newly discovered vulnerabilities, which attackers will try to exploit.
• If you lack internal IT support, a managed services provider can help handle device management and patching on your behalf.

Control Who Can Do What

When an attack gets through – and despite best efforts, one likely will – minimize the impact by ensuring breached accounts can’t access more than they need to.

Apply the Principle of Least Privilege. 

• Give users access only to systems and data they need to perform their roles.
• For example: in a file sharing system, your HR Manager might manage a folder containing job applications, the hiring manager might have view-only access, and staff outside the hiring team shouldn’t see it at all.
• By restricting access to only those who need it, you can limit the potential for exposure during a breach.

Define clear onboarding and offboarding processes.

• When someone joins your team, provision only what their role requires.
• When someone leaves, revoke access immediately and completely.
• Accounts left active after a departure are a common and easily overlooked entry point for attackers. 

Finally, put together a basic incident response plan before you need it.

• It can be a single page and should identify who gets notified, what their roles are, who leads the response, and what happens first.
• When an incident happens, knowing the plan in advance will provide clarity and help focus your efforts where they need to be in a stressful situation.

Cyberawareness & Training

Safeguarding your data and systems depends on people. Your team will be the first responders to social engineering attacks, like phishing, so it’s critical to equip them with the knowledge and skills to recognize when something doesn’t look right. 

• Free and low-cost training resources are widely available online.
• Phishing simulation services can send test emails to your team, helping them learn to recognize attacks in a safe environment and giving you data on where additional training is needed.

Most importantly, nurture a culture of openness and curiosity.

• Encourage your team to pause before clicking a link, ask questions, and get a second opinion when something feels off.
• Psychological safety is key. Teams that encourage pausing and asking questions catch more actual threats than teams that lead with rules and consequences.

Conclusion

Nonprofit leaders must prioritize cybersecurity, even in the smallest organizations. You don’t need deep technical knowledge or a large budget to safeguard the data your team stewards. Focus on protecting your identity, maintaining visibility into what you have, controlling what people can do in your systems, and fostering a culture of curiosity and psychological safety. 

If you’re unsure where to start, or you’d like a partner as you think through your organization’s cybersecurity approach, I’d be happy to connect.