Focus Digital February 15, 2025 0 Comments

The Complete Guide to Nonprofit Cybersecurity Policy

We have compiled a clear guide for crafting a nonprofit cybersecurity policy that addresses donor privacy, financial compliance, and volunteer access management. Whether you are starting from scratch or improving upon an old policy, this practical, actionable advice will help your nonprofit develop a cybersecurity policy that covers everything from initial risk assessment to ongoing policy maintenance.

Key Components of a Nonprofit Cybersecurity Policy

A well-crafted cybersecurity policy not only protects a nonprofit’s data and systems from cyber threats, but also reinforces the organization’s commitment to safeguarding the privacy and trust of its donors, volunteers, and community. By implementing these key components, nonprofits can strengthen their resilience against attacks.

Component	Purpose	Implementation	Examples
Data Protection and Privacy	Establishes how the nonprofit collects, uses, stores, and protects personal and sensitive information from staff, donors, and volunteers.	Includes encryption practices, secure storage solutions for donor and financial data, and data access controls.	Policies should address specific types of data like donor financial information, personal beneficiary details, and employee records.
Access Control	Ensures that only authorized individuals have access to donor management systems, grant records, and donor information.	Uses measures like user authentication protocols and role-based access control to ensure only authorized staff and volunteers can access records.	Implement two-factor authentication and regular reviews of access permissions for staff members and approved volunteers.
Incident Response Plan	Provides a course of action to identify, respond to, and recover from a cybersecurity incident, such as a breach of donor records..	Should outline specific steps to contain and resolve threats, recover data, and communicate with those affected by the breach.	Detailed response steps will include immediate actions and who to notify, as well as how to communicate with outside parties such as donors and the media.
Regular Audits and Assessments	Identifies weaknesses in the nonprofit’s systems like and processes before they can be exploited.	Includes periodic security assessments and testing to evaluate policy adherence.	Conduct yearly audits with third-party IT experts, including analyzing security practices for handling donor data and ensuring beneficiary privacy..
Employee Training and Awareness	Trains all staff and volunteers to be aware of risks and understand best practices.	Hold regular training sessions to make sure everyone understands risks, threats, and policy procedures.	Provide training workshops about phishing scams that target nonprofits, VPNs for remote staff, authentication, and other important security measures.
Vendor Management	Manages the risks involved with using third-party vendors such as fundraising platforms, especially those who handle sensitive data.	Require assessments to ensure vendors follow security procedures as outlined in the cybersecurity policy.	Add cybersecurity terms to all vendor contracts that clearly outline your organization’s security standards.
Physical Security	Protects physical assets and information from unauthorized access and theft.	Control access to facilities, add surveillance where needed, and implement secure disposal practices for sensitive documents like grant research or financial records..	Install security cameras to monitor physical locations, and store the footage in a secure cloud-based system, which is especially useful for nonprofit managers who oversee multiple locations or work remotely.
Technology Management	Ensures software like fundraising programs and hardware like on-site internet equipment are up-to-date and maintained on a regular basis.	Regularly update software programs, monitor hardware systems, and securely dispose of obsolete technology.	Enable automated updates for software to eliminate security risks, bugs, and other potential issues that could interfere with donation processes or fundraising campaigns..

Risks Your Cybersecurity Policy Needs to Address

In order to build an effective nonprofit cybersecurity policy that protects your staff, donors, and beneficiaries, you must outline the risks you want to address within the policy. Below are some of the risks you will want your policy to cover to keep volunteers, consultants, and vendors on the same page.

Term	Definition
Phishing	Phishing targets nonprofits through fraudulent emails and messages that mimic legitimate communications, often using malicious links or compromised attachments to steal sensitive data such as donor information, staff credentials, and financial details.
Malware	Malware is a type of software that can be used to infiltrate nonprofit systems and disrupt operations, steal sensitive data, or gain unauthorized access. A common form of malware is a virus spread through email attachments.
Ransomware	Ransomware is malicious software that locks access to key files and systems, demanding a ransom to restore access. Nonprofits are susceptible to ransomware attacks due to their reliance on data and frequent gaps in their cybersecurity measures.
Encryption	Encryption is the process of encoding sensitive information such as donor details, financial records, and staff data to prevent unauthorized access. This step is especially important for nonprofits who work with remote staff, vendors, or volunteers.
Firewall	A firewall acts as a security system that monitors and controls incoming and outgoing information on networks. It is essentially a barrier that works on predetermined rules between a trusted internal network and untrusted external networks, such as the internet.
Two-Factor Authentication	Two-factor authentication is an enhanced security step that requires two forms of verification before accessing systems, which might include a combination of a user’s password and a code sent to a mobile device. This process significantly reduces the chance of unauthorized access to your donor data or financial systems.
Virtual Private Network	A VPN is a secure, encrypted connection over the internet. VPNs are particularly important for nonprofits that work with remote staff and volunteers that need access to sensitive systems. The VPN will ensure that all data transmitted to and from the organization remains secure and private.
Incident Response Plan	An incident response plan is a set of guidelines and procedures that a nonprofit can follow in the event of a cybersecurity incident. This plan will include steps for containing breaches, assessing impact, notifying affected parties, and recovering compromised data.
Data Breach	A data breach is an incident where confidential information like donor data, employee records, or financial reports are accessed without authorization. These breaches can have a severe impact on a nonprofit’s reputation and donor trust.
Vulnerability Assessment	A vulnerability assessment is a comprehensive review of security weaknesses in a nonprofit’s systems and networks. This process helps identify vulnerabilities such as outdated software or weak network security and then recommends fixes that will address these problems.

Step-by-Step Guide to Developing Your Nonprofit Cybersecurity Policy

You can draft and implement your own cybersecurity policy or you can consult with a specialized cybersecurity expert who can craft the policy for your organization. Either way, the general approach to creating a nonprofit cybersecurity policy looks the same:

Establish a cybersecurity team. This can be an internal team or an external managed IT service provider depending on the needs and size of your nonprofit.

Conduct a risk assessment. Identify critical assets and potential vulnerabilities so you can create a clear cybersecurity plan.

Define security objectives and scope. Based on what you learned during the risk assessment, outline a cybersecurity policy that establishes protocols and systems to safeguard your operations.

Draft the policy paperwork. Create a draft of your official policy, focusing on key areas that you defined in Step 3.

Detail roles and responsibilities. Assign roles to specific individuals who will implement, monitor, and enforce the cybersecurity policy.

Establish response protocols. In the event of a cybersecurity incident, lay out clear procedures for how to detect, respond to, and recover from a breach.

Plan for implementation and training. Ensure all staff and volunteers are aware of the policy and understand their role in maintaining a secure system.

Review and update the policy regularly. Schedule annual reviews to evaluate changing threats or organizational needs. Additionally, review the policy after any significant organizational change.

How Tardigrade Technology Can Help

If at any point you find that you need help with your nonprofit cybersecurity policy, Tardigrade Technology is here to assist in creating, implementing, or auditing your plan. We offer cost-effective cybersecurity solutions that include training and monitoring, so you can focus on making a difference in your community.

When you partner with us, we commit to helping your organization thrive through any challenge—just like the resilient tardigrade. We understand the unique cybersecurity challenges that nonprofits face and are dedicated to supporting your mission while safeguarding your organization.

Learn more about our cybersecurity solutions and how we can help your organization succeed.