In short
- Nonprofits hold donor names, giving histories and bank details, and attackers know it.
- The defenses that matter most cost hours, not dollars: enforced MFA, a payment verification rule, a tested backup and a departure checklist.
- Take it to the board as protecting the organization, not as buying technology.
- Start with the free three-minute self-assessment.
A common belief in the nonprofit world says criminals go after businesses, because businesses have the money. The people attacking you see it differently. A nonprofit holds donor names, giving histories, and bank details, and often data about vulnerable people it serves. It moves money on a schedule attackers can read in your own newsletter. It defends all of this with a part-time volunteer and whatever software came free.
None of that is a criticism. It is a resource reality, and this article takes it seriously. Here is what cybersecurity for nonprofits actually requires, in priority order, at prices a board can approve.
Why the Stakes Are Different for Nonprofits
A business that leaks customer data has an expensive, embarrassing problem. A nonprofit that leaks donor data has a mission problem. Donors give because they trust you, and gifts stop when trust does. Three failure patterns account for most of what we see:
- Payment redirection. An attacker reads a compromised mailbox for weeks, learns your grant and vendor payment rhythms, then sends the “our bank details have changed” email. This is the most expensive attack in the FBI’s fraud statistics, and nonprofits make ideal targets. Their financials are public and their finance teams are small.
- Turnover. Staff, volunteers, board members, and interns cycle through nonprofit systems faster than at almost any business of similar size. Accounts that outlive the people are the door attackers find first.
- A single point of failure. One volunteer or part-timer knows the systems. A local nonprofit came to us after staff turnover nearly cost them access to every critical system they ran on. Nothing was attacked. The knowledge simply walked out the door, and that alone was nearly fatal.
The attacks that actually hit nonprofits are the common, opportunistic kind, and the defenses against those are the cheap ones. You do not need what a bank needs. You need the fundamentals, done properly: enforced MFA, tested backups, a departure checklist, and trained people. Most of that list costs hours instead of dollars.
Protecting Donor Data: Six Fixes in Priority Order
- Enforce MFA on email and anything financial. Cost: hours of effort. MFA blocks the opening move of most real attacks, and the platforms nonprofits already use include it free. “Enforced” covers the executive director and the shared info@ mailbox, which are exactly the accounts attackers pick.
- Adopt the payment verification rule. Cost: zero. Any change to payment details gets verified by phone, at a number you already had, before money moves. Write it down, tell the board, drill the bookkeeper. This single habit defeats the most expensive attack aimed at organizations like yours.
- Test one backup restore. Cost: ten minutes. Restore a real file and open it. Include your donor database or CRM in the next test, because cloud providers do not back those up the way most people assume.
- Give departures a checklist and an owner. Cost: an afternoon to set up. Every staff member, volunteer, and board member who leaves gets their accounts disabled the same day, with a dated record.
- Claim the nonprofit discounts. Cost: paperwork. Microsoft, Google, and most major security vendors offer steep nonprofit pricing, and often free tiers. Many organizations never claim them. If you pay full commercial rates for productivity software, that found money funds everything else on this list.
- Train people briefly and regularly. Cost: modest. Short, recurring practice at spotting suspicious email beats an annual lecture, because security culture improves with use.
Getting the Board to Approve It
Cybersecurity at a nonprofit usually fails politely, in board meetings, where it loses the budget argument to the mission every year. The winning reframe is fiduciary. The board is not buying technology. It is protecting the organization’s ability to operate and its standing with donors, funders, and regulators. Three points carry the conversation:
- Grant applications and insurance renewals increasingly demand specific, evidenced controls. “We take security seriously” no longer passes.
- A week of downtime has a dollar cost and a program cost. Numbers on both turn an I.T. request into a risk decision a board can actually make.
- Boards act on independent findings more readily than on staff assurances. A written assessment gives your champion a document to stand on instead of an opinion to defend.
What Working With Us Looks Like at Nonprofit Scale
We work with Arizona nonprofits, including one of our longest-standing clients. The honest version: the fundamentals above are where every engagement starts, whoever does the work. When a nonprofit outgrows volunteer-powered I.T., our assessment costs $150 per user with a $1,500 floor, counting everyone who touches your systems. It produces the prioritized plan and the board briefing described above. Ongoing management budgets out per device like every client we serve, priced to what the organization actually needs. A lean, security-first plan for a small nonprofit appears as a worked example on our pricing page at $2,500 a month, because we would rather you see the number than wonder about it.
Start smaller than any of that. The three-minute self-assessment is free and private, and it will tell you which of the nine areas needs attention first. For most nonprofits, the first three fixes it surfaces cost nothing but a calm afternoon.