Cybersecurity for Nonprofits: Protecting Donor Data on a Tight Budget

Nonprofits hold exactly the kind of information attackers want: donor names, addresses, and payment details, and often sensitive information about the people they serve — health conditions, family situations, children’s records. At the same time, most run on tight budgets, depend on volunteers who come and go, and spend every dollar they can on the mission. The good news is that the most important protections cost little, and many technology companies offer nonprofit discounts and donations.

The risks nonprofits face

  • Payment fraud. Fake vendor invoices, diverted grant payments, and “the executive director needs gift cards” requests hit nonprofits as often as businesses, and a single loss can wipe out a fundraiser’s proceeds. See how business email compromise works.
  • Donor data breaches. The 2020 ransomware attack on Blackbaud, a donor software vendor, exposed data from many thousands of nonprofits, schools, and hospitals that were never breached themselves. Your vendors’ security is your security.
  • Volunteer and shared accounts. A shared login for the database or social media, known by every volunteer who ever helped, cannot be revoked when someone leaves.
  • Personal devices. Staff and volunteers working from personal laptops and phones that nobody manages.
  • Reputation. Donors give because they trust you. A breach notice is a hard letter to send to the people who fund the mission.

Priorities that cost little

  1. Turn on MFA for email, the donor database, banking, and social media accounts. It is free and stops most account takeovers.
  2. Give every person their own account. Staff and volunteers each get a named login with access limited to what their role needs, and volunteer accounts expire automatically at the end of an event or season.
  3. Verify every payment change by phone using a number you already have, and require two people to approve any new payee or large transfer.
  4. Back up what matters. The donor database, financial records, and shared files, with one copy that ransomware cannot reach.
  5. Encrypt laptops and use a password manager for shared credentials that cannot be avoided, such as social media accounts.
  6. Train everyone, including volunteers. A short session on phishing, gift card scams, and how to report something suspicious.

Volunteers and personal devices

Volunteers are the heart of most nonprofits, and they usually work on their own laptops and phones. You cannot manage those devices like company computers, but you can protect the organization’s data on them. Give volunteers web-only access to what they need where possible, so files are not downloaded to personal machines. On phones, app protection policies can keep organization data inside Outlook and Teams, require a PIN, and wipe only the organization’s data if the volunteer leaves. And make removing access part of the end of every volunteer’s term, the same way you would for staff — see our offboarding checklist.

Stretch the budget

Microsoft, Google, and other vendors offer discounted or donated software to eligible nonprofits, and organizations like TechSoup provide discounted hardware and software. Program terms change, so check current eligibility and pricing before you plan around them, but they often make business-grade email, security features, and collaboration tools affordable. Choose tools that come with the security features built in, rather than free consumer versions that do not offer admin controls.

Vendors and payment processors

Donor management systems, online giving platforms, event software, and payment processors all handle your supporters’ data. Ask how they protect it, whether they support MFA and single sign-on, and how they would notify you of a breach. Let the payment processor handle card data so card numbers never touch your own systems. Our guide to vendor risk has a short list of questions to ask.

The board’s role

Cyber risk belongs on the board agenda once a year: what data you hold, what protections are in place, whether you carry cyber insurance, and who you would call if something happened. A one-page incident response plan and a relationship with an IT provider before you need one are inexpensive forms of insurance in their own right.

Security that fits a nonprofit budget

Equal Tech Solutions supports nonprofit organizations across Cleveland, Chattanooga, and the Southeast with managed IT and cybersecurity services sized for the mission, making full use of nonprofit programs where they apply. Contact us to talk about protecting your donors and the people you serve.