If you are stuck knowing that you need to create or update IT policies at your nonprofit but not knowing where to start, you are not alone. Crafting robust IT governance documents can feel daunting, and that difficulty getting started may be a barrier.
Crafting robust IT governance documents can feel daunting, and that difficulty getting started may be a barrier to creating or updating these policies at your nonprofit. That can leave your organization vulnerable to honest mistakes, disgruntled staff, or a lack of security. Having no policy at all may leave your staff not knowing what to do in the event of a cybersecurity incident or a stolen laptop.
Fortunately, several free resources can empower nonprofits to establish strong IT policies. This article explores readily available templates and guides to streamline policy creation.
First, what IT policies are essential to nonprofits?
The following links are not templates per se, but free frameworks to follow to develop policies for Artificial Intelligence (AI). As AI tools and ethical issues develop rapidly, these frameworks can help your leadership and staff understand the issues as you use readily available AI tools to work more efficiently and pursue novel approaches to your nonprofit mission.
Websites like SANS: https://www.sans.org/information-security-policy/ provide general policy templates, which can be adapted for an IT context. Remember to tailor generic templates to your specific technologies and workflows. Community IT often recommends the SANS policy template library as a first stop in creating your IT policies, particularly the foundational Acceptable Use Policy.
Perhaps the most important policy you need is an Acceptable Use Policy. This policy defines acceptable use of equipment and computing services, and the appropriate employee security measures to protect the organization’s corporate resources and proprietary information. This policy is usually part of the Employee Handbook – but don’t let it be something that new staff read on their first day and then forget about. The Acceptable Use Policy is important to keep updated and utilized by staff as technology and workplaces change.
If you haven’t updated your Acceptable Use Policy since the advent of remote work and Artificial Intelligence tools (AI) then it’s time to update it now.
The SANS website Security Policy Template library has dozens of IT-specific policy templates for many issues your nonprofit will encounter. These policy templates can easily be updated for your situation. SANS provides valuable resources for building IT policy.
Additional free security policy templates can be found at Delinea (formerly Thycotic), and can be adapted to your nonprofit needs. This template focuses on securing privileged accounts: https://delinea.com/resources/free-privileged-account-management-pam-policy-template
And this one can help you develop an incident response plan: https://delinea.com/resources/free-incident-response-plan-template. For more information on developing a nonprofit incident response plan and why you need one, Community IT also has this guide: https://communityit.com/how-to-create-a-nonprofit-incident-response-plan/.
Cyber Insurance Controls: Lockton Group created a guide for cyber insurance that is very valuable for nonprofits. This guide has definitions and explanations of what a Cyberliability policy can require. It is not a policy template per se but so valuable when creating IT and cyber policies that help your organization comply with insurance requirements. https://global.lockton.com/us/en/news-insights/a-guide-to-basic-controls-demonstrating-cyber-preparedness
While templates serve as a valuable starting point, remember these key points:
Consider your organization’s internal culture and management style. If your nonprofit is fairly hierarchical and responds well to having rules to follow, it may be most effective for a leadership team to develop the policy and release it to staff. If your culture is more entrepreneurial and participatory, you may want to create a committee from the various stakeholders (HR, management, leadership, IT, staff) to adapt a template for your own use.
By leveraging free resources and best practices, nonprofits can develop effective IT policy documents that safeguard their data, ensure responsible technology use, and empower staff to fulfill their missions effectively.
A lack of policies makes well-managed IT difficult to enact and can leave your nonprofit vulnerable to multiple threats. But it’s not enough simply to create or update the policies – if your staff don’t know what policy they need to follow, no one benefits and risks remain. When rolling out new or updated IT policies make sure to implement a thoughtful training program to get existing and new staff up to speed on what you expect and how they will use IT at your nonprofit. These resources for building IT policy at nonprofits will help you get started.
Remember, strong IT governance fosters trust with donors and stakeholders, allowing nonprofits to know how to quickly respond to IT issues and be able to focus on their core mission – creating positive change in the world.
Community IT has been serving nonprofits exclusively for twenty years. We offer Managed IT support services for nonprofits that want to outsource all or part of their IT support and hosted services. For a fixed monthly fee, we provide unlimited remote and on-site help desk support, proactive network management, and ongoing IT planning from a dedicated team of experts in nonprofit-focused IT. And our clients benefit from our IT Business Managers team who will work with you to plan your IT investments and technology roadmap, if you don’t have an in-house IT Director.
We constantly research and evaluate new technology to ensure that you get cutting-edge solutions that are tailored to your organization, using standard industry tech tools that don’t lock you into a single vendor or consultant. And we don’t treat any aspect of nonprofit IT as if it is too complicated for you to understand.
We think your IT vendor should be able to explain everything without jargon or lingo. If you can’t understand your IT management strategy to your own satisfaction, keep asking your questions until you find an outsourced IT provider who will partner with you for well-managed IT.
If you need outsourced IT assistance and could use help creating or revising your IT Governance policies as part of that partnership, let’s talk. We can keep you on track and help you prioritize policy updating with your stakeholders with these resources for building IT policy.
Join Heather Ritchie of Build Consulting for a webinar on using this powerful change management tool. September 18th at 3pm Eastern, Noon Pacific
Fill out the form below to request a quote. We’ll be in touch shortly to discuss your needs and take the first step toward better nonprofit IT.