Nonprofits need a security plan that fits their budget, their staff, and their mission. The threats they’re planning against have changed, and the plan should too. Our cybersecurity framework helps any nonprofit get started.
Community IT Innovators is pleased to share the 2026 edition of Cybersecurity Readiness for Nonprofits: Community IT Innovators Playbook. It’s free to view and share online or download and print.
AI has changed cybersecurity for nonprofits in three ways:
- Attackers use it to write more convincing phishing emails and to impersonate colleagues and vendors.
- Staff use AI tools that can quietly expose sensitive data.
- Used thoughtfully, AI can help small IT teams do more with less.
The 2026 edition addresses all three without treating AI as a separate category of risk. The fundamentals of cybersecurity that we use, advocate for, and educate our sector on still hold.
At the heart of the Playbook is Community IT’s eight-point cybersecurity framework: Policy, Security Awareness Training, five technology areas (Identity, Data, Devices, Perimeter, and Web), and Compliance. Each area is laid out across three maturity levels (Foundational, Optimized, and Proactive), and includes rough cost estimates, so you can see where your organization stands today and what comes next.
New in the 2026 edition
- AI guidance woven throughout the framework, including updated advice on phishing, business email compromise, and endpoint protection.
- Two new sections on AI. One gives an overview of how AI affects nonprofit cybersecurity. The other covers building an AI-literate, security-aware culture among your staff.
- An AI Acceptable Use Policy as a Foundational step. This doesn’t mean you have to adopt AI. Your policy can also say your organization won’t use it.
Our goal is to give nonprofits a playbook for organizing their response to cybersecurity risk, in language accessible to any executive director, board member, decision maker, or IT staff member.
Whether you work with a Managed Service Provider (MSP) or an in-house IT department, good security rests on the same foundation: updated systems, regular backups, staff training, clear policies, and a way to check that those policies are actually being followed. Your IT security should work for your organization, not against it. Consider using this Playbook with your IT provider or IT team as you build your IT security documentation.
- Do you know how exposed your nonprofit or association is to cybersecurity threats?
- Do you know which AI tools your staff are using, and what information they’re sharing with them?
- Do you have a written security policy that covers your cybersecurity strategy and costs?
- Do you need a framework to bring your people, processes, and technology together against everyday threats?
- Are you worried you won’t understand the terminology consultants use when they talk about your cybersecurity risk?
Just getting started? Our companion guide, Start Here: Nonprofit Cybersecurity Basics, is a short 8-page read for executive directors and board members. It covers the Foundational steps that matter most and where to begin.
Fill out the form below to download your Cybersecurity Readiness for Nonprofits Playbook.
Author:
As Chief Technology Officer at Community IT and our resident cybersecurity expert, Matthew Eshleman leads the team responsible for researching, planning, and implementing the technology our nonprofit clients rely on to be secure and productive. He has a deep background in network infrastructure and has worked with nonprofits at Community IT since 2000. That combination means he understands both how the technology works and the budget and staffing realities nonprofits work within.
Matt designed and teaches TechSoup’s Digital Security and Cloud Security courses and is a member of NGO-ISAC. He speaks frequently on nonprofit cybersecurity, including at NTEN events, the Nonprofit Risk Management Summit, and for the BBB Wise Giving Alliance. He holds dual degrees in Computer Science and Computer Information Systems from Eastern Mennonite University, and an MBA from the Carey School of Business at Johns Hopkins University.
You may want to check out this webinar with Matt walking through the Playbook and Basics Downloads.