What is the baseline of cybersecurity that a nonprofit must cover?

Listen to Podcast

Like podcasts? Find our full archive here or anywhere you listen to podcasts: search Community IT Innovators Nonprofit Technology Topics on Apple, Spotify, Google, Stitcher, Pandora, and more. Or ask your smart speaker.

What Are 10 Cybersecurity Essentials for Nonprofits? with Johan Hammerstrom

Carolyn Woodard explores the cybersecurity essentials every nonprofit needs with Johan Hammerstrom, CEO of Community IT. Cybersecurity can feel technical and intimidating, especially for operations staff without an IT background. In this companion to our episode on the 10 operations IT essentials, Johan breaks security down into plain operational terms that apply whether your organization has 10 staff or 150.

The 10 cybersecurity essentials fall into three groups of three (devices, accounts and data) plus policy.

Securing Devices:

Securing Accounts:

Securing Data

Policy and Governance

Along the way Johan shares two cautionary stories. In one, security alerts caught an attack as it happened but went to a mailbox no one checked. In the other, nonprofits permanently lost email and files when Microsoft ended its Business Premium license donation and the unpaid accounts were deleted.

You don’t need technical expertise to take this list to whoever owns IT at your organization and ask where you stand. This podcast helps you understand what you need to know to protect your organization.

Resources Mentioned:

Presenters

Johan Hammerstrom, CEO of Community IT Innovators

Johan Hammerstrom’s focus and expertise are in nonprofit IT leadership, governance practices, and nonprofit IT strategy. In addition to deep experience supporting hundreds of nonprofit clients for over 20 years, Johan has a technical background as a computer engineer and a strong servant-leadership style as the head of an employee-owned small service business. After advising and strategizing with nonprofit clients over the years, he has gained a wealth of insight into the budget and decision-making culture at nonprofits – a culture that enables creative IT management but can place constraints on strategies and implementation.

As CEO, Johan provides high-level direction and leadership in client partnerships. He also guides Community IT’s relationship to its Board and ESOP employee-owners. Johan is also instrumental in building a Community IT value of giving back to the sector by sharing resources and knowledge through free website materials, monthly webinars, and external speaking engagements. He has assisted hundreds of nonprofits over his decades of experience at Community IT and has been instrumental in assuring that all clients have access to strategic planning – a service that is uncommon at outsourced IT providers but that Community IT feels is an essence of what we can provide to nonprofit clients to help them be successful at their missions.



Carolyn Woodard

Carolyn Woodard is currently head of Marketing and Outreach at Community IT Innovators. She has served many roles at Community IT, from client to project manager to marketing. With over twenty years of experience in the nonprofit world, including as a nonprofit technology project manager and Director of IT at both large and small organizations, Carolyn knows the frustrations and delights of working with technology professionals, accidental techies, executives, and staff to deliver your organization’s mission and keep your IT infrastructure operating. She has a master’s degree in Nonprofit Management from Johns Hopkins University and received her undergraduate degree in English Literature from Williams College.

She was happy to have this podcast conversation with Johan about the 10 cybersecurity essentials for nonprofits.



Ready to get strategic about your IT?

Community IT has been serving nonprofits exclusively for twenty-five years. In fact, we celebrate 25 years of Community IT this month and all year. We offer Managed IT support services for nonprofits that want to outsource all or part of their IT support and hosted services. For a fixed monthly fee, we provide unlimited remote and on-site help desk support, proactive network management, and ongoing IT planning from a dedicated team of experts in nonprofit-focused IT. And our clients benefit from our IT Business Managers team who will work with you to plan your IT investments and technology roadmap if you don’t have an in-house IT Director.

Being 100% employee-owned is important to us and our clients. It is an important aspect of our culture as a business serving nonprofits exclusively for 25 years. Your Nonprofit IT Budgeting strategy is important to Community IT. Unlike most MSPs, Community IT considers budgeting and strategic management a major part of our services to our clients.

We constantly research and evaluate new technology to ensure that you get cutting-edge solutions that are tailored to your organization, using standard industry tech tools that don’t lock you into a single vendor or consultant. And we don’t treat any aspect of nonprofit IT as if it is too complicated for you to understand.

We think your IT vendor should be able to explain everything without jargon or lingo. If you can’t understand your IT management strategy to your own satisfaction, keep asking your questions until you find an outsourced IT provider who will partner with you for well-managed IT.

More on our Managed Services here. More resources on Cybersecurity here.

If you’re ready to gain peace of mind about your IT support, let’s talk.

Transcript: 10 Cybersecurity Essentials for Nonprofits with Johan Hammerstrom

Carolyn Woodard: Welcome everyone to the Community IT Innovators Technology Topics podcast. I’m Carolyn Woodard, your host, and today I’m happy to welcome our CEO, Johan Hammerstrom, back to the podcast to tell us a little bit more about some nonprofit security essentials. So if you’re just getting started with security, if you’re at a nonprofit and you’re not sure what security you have, cybersecurity, where should you start? What are the things that are absolute must-haves?

And this is a companion to the podcast that we did a little while ago about operational standards and essentials. So, Johan, would you like to introduce yourself and tell us why these 10 security issues are really important?

Johan Hammerstrom: Yeah, thank you. Glad to be back. Thanks for having me back on the podcast. My name is Johan Hammerstrom. I’m the CEO at Community IT, and this is a follow-up to the 10 operations essentials. And today we’re going to be talking about the 10 security essentials.

One of the things we want to do today is demystify security. I think people get very anxious about cybersecurity, and with good reason to some extent. There are a lot of threats out there. The threat landscape is constantly evolving, and it’s important to protect your organization. Sometimes cybersecurity can get very technical, and that can be intimidating to operations staff at nonprofit organizations that don’t have a strong technical background.

So we really want to break it down into basic operational terms that anyone can understand and apply to their organization. Whether you’re working for a 10-person organization or a 50-person organization or a 150-person organization, these 10 essentials apply across the board at all scales.

And so when you think about information technology, just breaking it down, it is all about the information. That’s the thing that’s key. Your proprietary information, confidential information, information that has to be compliant with certain standards, information that’s related to the assets your organization has, whether it’s direct information assets, or the information that gives you access to your finances. All of that is information.

And when you think about securing that information, you can think about three categories. First is the devices that you use to access the information. The second are the accounts that give you the credentials to access that information. And the third is the information itself, or the data. So when you think about securing your organization with respect to IT, you want to secure the devices, you want to secure the accounts, and you want to secure the data.

Carolyn Woodard: All right. That sounds like a great place to start. And as you said, anyone in operations should be able to understand these ideas, whether or not you have a cybersecurity background. And in fact, you don’t have to have that technical of a background to know that you need to do this securing. So, should we start out with the devices? What do you need to do to secure those devices?

Securing Devices: Organization-Owned, Protected, and Patched

Johan Hammerstrom: Yeah, so there’s three things. We’re going to keep it simple. Each of these three categories has three things that you should be doing to meet the security needs of that category.

And obviously, if you’re subject to more advanced compliance requirements, if you’re doing federal contract work, you might be subject to NIST. If you have healthcare information, you might be subject to HIPAA. So this in no way replaces the need for more advanced security protections. But any security framework that you look at is going to have these 10 essentials as its foundation. And if you do these 10 things, you’ve gone a long way towards making your organization more secure.

So, in terms of securing devices, the three things that we recommend are, number one, making sure that your staff are using computers that are owned and provided by the organization. So we really discourage BYOD, bring your own device. And we discourage organizations telling their staff to rely on their own personal devices to access the information that they need to access as part of doing their job. So that’s number one.

Number two, on that organization-owned device, you want to make sure that you have robust antivirus and endpoint detection and response software. Endpoint detection and response is often known by the acronym EDR. And so EDR is just a more advanced version of antivirus that not only detects malicious files, but also detects malicious activity. So you want to make sure that that’s installed and centrally managed.

It does no good to have an antivirus software that no one is looking at and managing to make sure that it’s running effectively and to check any of the alerts that it’s generating.

And then number three, you want to have a proactive management system on your device that’s making sure that it has all the latest security patches and is basically up to date with its software.

Carolyn Woodard: I like your comment about making sure that someone is reading those alerts that the antivirus is sending you. Because I imagine that does happen. You set it up, and then nobody checks that email, and it said, “You’ve got a problem,” but no one checked.

Johan Hammerstrom: Yeah, all of these solutions have to be managed, and really the key to successful IT is that it’s well managed. And the key to successful cybersecurity is, by the same token, that it’s well managed as well.

Carolyn Woodard: Can I break in here and just ask a quick question? So if you’re listening to this podcast and you are not the IT person, but you are in operations, you might be a COO, CFO, executive director, or someone at that level at either a small nonprofit or a larger nonprofit, this isn’t something that you would do yourself.

Well, you would in fact make sure that you’re providing all your staff with organization-owned computers rather than donated or recycled or their own device.

But for some of these other things that are more technical, is this something that you ask your IT people? You just make sure that it’s happening.

Johan Hammerstrom: Yeah, you could take this list to whoever owns IT for your organization and ask them to just check the boxes. Are we doing these 10 things, or what’s the status of these 10 things? Not only to give yourself some peace of mind that you’re at least covering the essentials when it comes to cybersecurity, but also potentially, this creates a good starting point for a conversation.

Because we believe it’s always valuable for IT to be in dialogue with the rest of the organization. And that’s definitely happening a lot more now than it used to. But there still can be a tendency for IT to be siloed off from the rest of the organization, and particularly when it comes to security, that can create issues.

In fact, if you go to whoever owns IT for your organization and say, “Hey, I want to make sure we’re doing these 10 things,” they’ll probably say, “Oh, thank goodness someone’s finally asking, because we’ve been wanting to do these 10 things forever.” So hopefully it’s welcomed with open arms. And if it isn’t, then maybe that’s a sign in and of itself that you should investigate why your IT team is not more happy that you’re asking them about security.

Securing Accounts: Training, Multi-Factor Authentication, and Monitoring

Carolyn Woodard: Yeah. And so our next category, I believe, was secure accounts.

Johan Hammerstrom: Yes. So you’ve secured your devices; they’re owned by the organization, they’re being well managed, patches are up to date. The next thing you want to do is secure the accounts. And by accounts, we mean the credentials that give people access to information.

So account compromise is the most common form of security incident today. You go back 10 years, and the most common form of security incident was ransomware, where a virus would encrypt all of the files in the organization and then they were held for ransom. It still happens, but it’s not as common.

The much more common security incident now is an account getting compromised, meaning that some malicious actor gains the credentials or some other way of access into a valid account and then uses that account to either spread their tentacles into other accounts and other organizations, or to steal information, or more often than not, to steal funds either directly or through different kinds of fraud.

So the most common way that malicious actors gain access to accounts, gain their credentials, is through phishing. And so phishing is a form of email attack in which a malicious actor crafts an email that looks legitimate, typically has a link in it that someone would click on, and takes them to a malicious site that pretends to be Google or Microsoft, and then someone enters their username and password, and now the bad actors have it.

So the best way to mitigate this risk is to train staff to be aware of and identify these malicious attacks as they’re happening. So a lot of the security essentials that we’re talking about are technology tools, and security awareness training can be delivered by a tool like KnowBe4. But at the end of the day, your best protection as an organization against security incidents are your people. And the better trained your staff are, the more likely they are to identify and report and resist malicious attacks.

And so having a formal security awareness training program is proven to be the most effective way to keep your staff trained and aware. And we typically don’t recommend organizations develop their own security awareness program, or once a year at an all-staff meeting, have someone kind of talk through what phishing looks like. The real advantage of these solutions, like KnowBe4, is that they train you in the moment, in the environment where you’re most likely to be attacked. And that form of training is always proven to be the most effective.

Carolyn Woodard: Yeah, I know that that has made a huge difference. And we’ve done a couple different webinars about it as well, that your staff are so important. And if you give them a training that kind of turns them off or is boring, it’s not going to be helpful to them to help as a team protect your organization that you care about.

Johan Hammerstrom: So it’s important to have a security awareness training program in place.

The second thing you can do to secure your accounts is to set up multi-factor authentication. I won’t go into great detail on what that means. I think most people are now pretty familiar with multi-factor. You see it everywhere. Your bank obviously has it set up. Airlines are now requiring it on their accounts. So pretty much everywhere you look these days, people are requiring multi-factor authentication. And so that’s something that is essential. It’s critical. You have to do it. There’s no excuse not to. And until you have multi-factor authentication set up, you are always going to be at risk. So that’s number two, multi-factor authentication.

And the third thing you can do to secure your accounts is to set up an account monitoring solution. Most of you listening are either in Google Workspace or Microsoft 365, and both of those platforms have built-in account monitoring tools. So, for example, Microsoft has their… oh, what’s it called? Secure Score and Cloud Defender. They’re constantly changing the names of their products over at Microsoft. But it was called Cloud Defender at one point.

And basically what it does is it checks things like the location of someone logging in. So it’ll flag things like someone logging in from Washington, DC, and then 30 minutes later logging in from Amsterdam, and it’ll say, “Well, this seems unusual; the person can’t be in both places at once.” So that sort of anomalous behavior it’ll detect. So it’s very similar to EDR. In fact, some third-party solutions call it cloud EDR. And it’s basically reviewing account activity for anomalous behavior.

Carolyn Woodard: And that sounds like another thing that is something you would ask your IT people about.

Johan Hammerstrom: For sure. Yeah. So, same as with securing the devices, it has to be monitored somehow. Oftentimes we’ll be called in to investigate a breach or an incident, and we’ll go and look at the Microsoft logging. And lo and behold, we can see all the traces of the malicious actor getting into the system. And Microsoft was detecting it as it was happening, and the alerts were getting sent to a mailbox that no one checked. And so making sure that the system is set up to do the alerting to someone who’s going to know what to do with those alerts, making sure it’s being monitored, is critical.

Carolyn Woodard: Oh, I want to make sure people know that was not our client that was not getting the alerts. It was someone that we were called in to help with.

Johan Hammerstrom: That’s correct. Yeah. And I guess to really answer your question, hopefully you’re having a conversation now with your IT owner and you can ask them, well, who’s monitoring this? When there’s anomalous behavior either on a device or in our identity platforms in the cloud, who’s getting notified? And then you can even, and we’ll get to this in the 10th security essential, put a standard operating procedure in place. If I want to be on those alerts… sometimes it can be really noisy, so that’s not always the best thing to do, to have operations staff receiving those alerts as well.

But you could talk through, well, what are the thresholds? At what point do the operations staff need to be notified?

Carolyn Woodard: Sure. And the response. So if you had a phone tree of when it gets to that threshold, this is the person that you call that needs to be made aware. So you mentioned before data. So we’ve covered the devices, we covered the accounts, but also your actual information, the files, the data, the statistics.

Securing Data: Backups, Permissions, and Access Monitoring

Johan Hammerstrom: You want to secure it, exactly. You want to secure the data itself. So the three things you can do to secure the data.

Number one, have a good backup and recovery system in place. Most cloud-based SaaS solutions have some sort of backup setup. For critical data, for critical information, it’s good to know how that backup works and what the retention time is and how easy it is to recover the information.

I think people too often make the assumption that, look, all my data is in Google, all my data is in Microsoft, they’re making the backups, everything is fine. That may be true, but there’s no guarantee that what your organization requires in terms of retention is going to match what Microsoft is providing if you don’t ask. And you may ask and find out, actually, this doesn’t meet our needs. And that’s the point at which a third-party backup system can be very helpful.

So there was actually a really unfortunate incident recently with Microsoft. I don’t mean to make this sound like I’m bad mouthing Microsoft, because they have done a lot for the nonprofit sector over the years. But in the last four or five years they have made a lot of changes to their nonprofit donation program. So they’ve switched up which licenses are covered and which ones aren’t.

And one of the things that they did was remove… they’d previously offered 10 free donations of Microsoft Business Premium for nonprofit organizations. And they announced sometime last year that they were going to get rid of that donation program and replace it with something else. So there was a different license that was now going to be covered for nonprofit organizations, but Business Premium would no longer be covered.

And you get a lot of alerts, and maybe you get an alert that’s communicating this to you, and it’s just not clear what it means. You don’t have an IT person to take a look at it for you and understand how it’s set up. And so there were a number of organizations that were using these free licenses. They had staff with critical job functions whose email and files were associated with these licenses.

And then when the licenses expired and Microsoft no longer provided them, they got a notice that they had to start paying for the licenses. No one ever set up the payment plan because they’re a small nonprofit; everything’s been free from Microsoft up till that point. And then the license expires and the account gets deleted, and it’s unrecoverable at that point. So there are organizations that lost data because of this set of circumstances related to Microsoft’s donation program.

And that’s an example: if you’re counting on the entity that is storing your data to also back it up, you kind of have all your eggs in one basket. And if something happens, you run the risk of losing data and you have no third party that you can go to to recover the data from.

So our best practice and recommendation is to always back your data up to a third-party solution if it’s business critical. If your organization would be significantly negatively impacted by the loss of data, don’t assume that Microsoft’s going to have it or Google is going to have it under all circumstances. You could get hacked and the accounts could get deleted, and the backups could get deleted as part of that process, and there’s nothing Microsoft or Google can do about it.

So sorry, this is a little bit long-winded, but I think it’s really important for organizations to consider the ability to restore backup from a third party, which is something that was kind of a best practice in the pre-cloud era. And I think a lot of people are coming back around to that being important.

Carolyn Woodard: Yeah, no, I think just giving that anecdote, it’s not a theoretical “we could lose our data.” It actually happened to several nonprofits that just didn’t keep up with: I need the data from this license. If the license expires, I need to have migrated it to somewhere else in the meantime. So yeah, it’s just good to keep in mind. I’m sure it happens in Google Drive all the time too. You have someone who leaves the company and that was their personal Google Drive, and so you don’t have their information that’s owned by your organization anymore.

Johan Hammerstrom: Yeah. The second thing you can do to secure your data is to make sure that permissions are set correctly. We’ve run into a wide variety of situations where people who shouldn’t have access to certain folders, document libraries, or sites have access to those because not enough care or attention was given to the setting up of permissions. That’s a topic for a whole other podcast, potentially, and it can get very technical, but you want to make sure that the permissions are set up appropriately.

And I think if you’re a small nonprofit, you kind of started off on your own, you had someone who had a somewhat technical background set up your Google Workspace for you, and now you’re bringing in a third party or you’re hiring someone in-house to own and handle IT full time, I would recommend that they do an audit of your permissions pretty early on, just so you can see who has access to what, how is this all set up? Is this set up the way we want it to be?

Carolyn Woodard: And especially now in the age of AI, where AI can just find anything that you have access to, it’s also crucial that you know what you have access to.

Johan Hammerstrom: Yeah, that’s a really great point, Carolyn. It was always frowned upon in security circles, this idea of security through obscurity: well, no one’s going to go and look in every document library and every site in SharePoint just to find the one thing that they shouldn’t have access to, but that they can access. And yeah, no one individual is going to do that. But now the AI agents are more than capable of doing it, even inadvertently, even if it’s not with malicious intent.

The third thing that you can do to secure your data, and this sort of mirrors the third thing in the first two sets of essentials, is to regularly monitor access to data. So there are reports that can be generated in Google Drive, Microsoft SharePoint and OneDrive, Box, Egnyte, Dropbox. I don’t know about Dropbox, but I’m assuming they can do this too. But they can all generate reports showing you who’s accessing what location.

So that’s something that’s worth doing on a regular basis. How frequently kind of depends on the sensitivity of the information and your overall security posture as an organization. But I would say at least quarterly or even semi-annually, just pull the report, see who’s accessing what.

I think one of the things that gets overlooked, particularly in SharePoint and in Google Drive, is sharing folders and files with people outside the organization. So you’re working with a consultant or a firm on a marketing campaign, communications campaign, and you’ve set up a folder and given them access to it so you can all collaborate on the material in the lead-up to the launch. And then you cancel the contract, you’re not working with them anymore, two years goes by, they still have access potentially to all that information.

So the other thing that’s worth monitoring regularly, and this kind of gets back to the permissions management, but I think that’s a key thing to check, is what external parties have access to the information.

Carolyn Woodard: Yeah, I think that’s something that we find a lot. With organizations, onboarding is easy to do because the person needs to have an email account, they need to have a laptop; there’s kind of a set of steps before they can work that they have to go through. But often organizations are not as good at offboarding. So canceling, deleting that account, making sure that people have access to the files that are necessary for the organization, but that the person who has left doesn’t have access to them anymore. So it’s something to put in place if you don’t have it in place already.

Johan Hammerstrom: Yeah, for sure. For sure.

IT Policies: Operationalizing the Security Essentials

Carolyn Woodard: And that leads right into governance, right? Onboarding and offboarding would be part of your policies and compliance. So do you want to talk about number 10 on our list of essentials for cybersecurity, your IT policies?

Johan Hammerstrom: Yeah, you should have IT policies. They should match your overall organizational policies.

Different organizations have different cultures when it comes to policy. Some organizations are very buttoned down; they have lots of policies, they’re very well written. IT issues should have their own policies written in the same format. Other organizations, especially startups, are just getting started. They may have a couple pages of policy, an employee handbook. IT should have some policy related to that as well.

So I think for policy to be effective, it has to be consistent with how the organization handles policy in general.

Policy templates that you can download online or get AI tools to write for you can be helpful starting points, but I think too often organizations get a policy template, make a few tweaks to it, and say, “Hey, we’ve got an IT policy.” And it’s like, well, is that document really informing how people work and what people do? Because that’s really the goal of policy: to guide how people are working with all of these IT systems.

So that’s kind of a whole other topic, but it is important to have policy, and everything that we’ve talked about today in the other nine essentials could have a policy associated with it.

So, the first thing we talked about, the organization should be providing computers, and that’s what people should be using to access the organization’s information. That could be a policy. Don’t use your personal device. It’s against the organization’s policy for you to use your personal device to access information. Security awareness training: we provide training, and staff are required to complete every training that’s offered. That’s a policy.

So where that lives is going to vary from organization to organization, but backing up all of these essentials with corresponding policies is a critical part of operationalizing the security essentials.

Carolyn Woodard: Yeah. And I think we add onto that compliance, right? If you don’t have a policy, you can’t hold your staff accountable and yourselves accountable for: this is how we want the IT to be used and operated and accessed. And then, like we’ve said several times, if you’re not checking, if you don’t have compliance, if you don’t have someone who owns compliance… it’s great you have a policy and you have people using these IT tools, but if no one’s ever checking, then you’re still at risk. As you said, you had a couple different examples of ways that you can be at risk if people do not check.

Johan Hammerstrom: Yeah, yeah. So hopefully this isn’t too overwhelming. It’s three groups of three and policies, and hopefully that’s easy to remember. And again, there are other frameworks, more complicated ones, ones that might be more appropriate for your organization, but we felt like this one was a good starting point.

Carolyn Woodard: And I will say that I think for almost all of these points, we have more in-depth materials and free information on our website. We have several different webinars and podcasts on creating those IT policies, where you start, how you find the templates, how you can adapt them, why they’re so important, who can own it at your organization. So we have a lot more.

If you drill down on any one of these, we have more help for them. But if you’re just starting out, we wanted to give you this overview of what we consider to be the 10 essentials that you really need in place in order to have a secure and safe IT environment for your staff at your nonprofit.

Well, Johan, thank you so much for sharing your time with us today and going over these with us. I really appreciate your time and your expertise. Thank you.

Johan Hammerstrom: Thank you, Carolyn. My pleasure.

As advocates for using technology to work smarter, we’re practicing what we recommend. This transcript was drafted with the assistance of AI, and is not a verbatim transcript. The content was edited for clarity, and was reviewed, edited, and finalized by a human editor to ensure accuracy and relevance.

Photo by Paul Esch-Laurent on Unsplash