A Practical Cybersecurity Plan for Small Nonprofits

Small nonprofits often hold donor contact details, employee records, volunteer information, and account credentials without having a dedicated IT team. A practical nonprofit cybersecurity plan starts with knowing what information you have, limiting access, and practicing how to respond when something goes wrong.

The Federal Trade Commission offers cybersecurity resources specifically applicable to charities and nonprofits. Use this guide as an operational starting point, then review the requirements that apply to your organization, vendors, and the information you handle.

1. Make a simple data map

List the systems where your organization keeps information: email, donation platform, accounting software, cloud storage, website forms, laptops, and paper files. For each, record what data it contains, who needs access, and which vendor supports it.

Keep only information you need. Set a retention period for records and securely dispose of information when it is no longer needed, consistent with legal, funder, and organizational requirements.

2. Protect accounts first

Require unique passwords and multifactor authentication wherever available, especially for email, banking, donor systems, and administrator accounts. Use a reputable password manager so staff do not reuse or share passwords in unsecured documents.

Create individual accounts instead of shared logins. Remove access promptly when a staff member or volunteer leaves or changes roles. Review administrator access periodically.

3. Reduce phishing and payment fraud

Train staff and volunteers to pause before opening unexpected attachments, entering credentials from an email link, or changing payment instructions. Verify unusual requests to transfer funds or update vendor banking details through a known phone number or separate trusted channel.

Agree on an internal process for approving payments and changing financial information. A second person reviewing high-risk changes can catch mistakes and impersonation attempts.

4. Secure devices and backups

Keep operating systems, browsers, and security software current. Protect laptops and phones with screen locks and encryption where available. Avoid accessing sensitive records over unsecured public networks.

Back up important files regularly and make sure at least one backup is protected from routine account access. Periodically confirm that the organization can restore a file; a backup that cannot be recovered does not help during an incident.

5. Check vendors and sharing settings

Before adopting a platform, identify what information it stores, how staff access it, and how to reach the vendor if an account is compromised. Limit access to donor lists and shared folders by role. Review public links and remove those that no longer need to exist.

6. Write a one-page incident plan

Name the person staff should contact if they click a suspicious link, lose a device, or notice unusual account activity. Include steps to secure affected accounts, preserve relevant details, contact vendors and the organization’s bank when appropriate, and get qualified legal or security advice.

Notification duties vary by jurisdiction and incident. Do not assume one reporting rule applies everywhere; promptly consult qualified counsel and relevant authorities based on the facts.

7. Make the routine sustainable

Assign a person to review access, updates, backups, and staff awareness on a regular cadence. Keep a short log of completed checks and open issues. Start with the accounts and records that could cause the greatest harm if exposed.

A 30-minute first step

This week, turn on multifactor authentication for the organization’s primary email and donation platform, list who has administrator access, and identify the person staff should contact about a suspected incident. Then use the FTC checklist to prioritize the next improvements.

Build stronger nonprofit operations

Granting Hope shares practical resources to help nonprofit founders and leaders organize their work. Explore the Granting Hope resources and choose one operational improvement your organization can put into practice this week.

This article is general educational information, not legal or cybersecurity advice. Requirements depend on the information handled and applicable law.