Most nonprofits know they should be doing something about cybersecurity. The harder question is where to start, especially when budgets are tight, no one on staff has “security” in their title, and most of the advice out there assumes you have a dedicated IT team.
Community IT Innovators is pleased to share Start Here: Nonprofit Cybersecurity Basics, a short 8 page guide to the foundational steps that do the most to protect your organization for the least cost. It’s available online for viewing and sharing.
Start Here is written for executive directors, board members, and the staff who end up handling IT whether or not it’s in their job description. You don’t need a technical background to use it. Whether you work with a Managed Service Provider (MSP) or an in-house IT department, it gives you a clear, prioritized path and the language to have productive conversations about security.
What’s inside:
- Own it The first step is deciding who owns cybersecurity at your organization. It doesn’t need to be a technical person, but it does need to be an official part of someone’s role.
- Do this first The protections that stop the most common attacks: phish-resistant MFA, a password manager, phishing awareness training, and spam filtering.
- Close the gaps Updates and patching, antivirus, and real third-party backups.
- Put it in writing The policies that make security stick, starting with an Acceptable Use Policy (even a simple one), plus Data Retention, AI Acceptable Use, and Data Privacy. Your AI policy can be a policy not to use AI at all. This guide doesn’t require or advocate AI use.
- Close the loop How compliance keeps your security aligned with your policies over time. That includes regulations and cyber insurance requirements, but also compliance as a leadership practice.
- A quick-reference checklist you can bring to your next leadership team or board meeting.
None of this has to cost an arm and a leg. Many of these steps have reputable low-cost and free versions.
A companion to the Playbook.
Start Here builds on our Cybersecurity Readiness for Nonprofits Playbook and uses the same four-layer approach (Policy, Training, Technical, Compliance) we use in every cybersecurity webinar. When you’re ready to go deeper, the full Playbook has the complete framework and more detailed explanations of the technical pieces.
Your IT security should work for your organization, not against it. Consider sharing Start Here with your IT provider, MSP, or IT department as you build your IT security documentation.
- Do you know who at your organization is responsible for cybersecurity?
- Is MFA turned on for everyone, especially Finance, HR, and leadership?
- Do you have an Acceptable Use Policy, even a simple one?
- Would your board know what questions to ask about your cybersecurity?
Fill out the form below to download your Nonprofit Cybersecurity Basics guide.
Author:
As the Chief Technology Officer at Community IT and our resident cybersecurity expert, Matthew Eshleman is responsible for shaping Community IT’s strategy around the technology platforms used by organizations to be secure and productive. With a deep background in network infrastructure, he fundamentally understands how technology works and interoperates both in the office and in the cloud.
Matt joined Community IT as an intern in the summer of 2000 and after finishing his dual degrees in Computer Science and Computer Information Systems at Eastern Mennonite University, he rejoined Community IT as a network administrator in January of 2001. Matt has steadily progressed up at Community IT and while working full time received his MBA from the Carey School of Business at Johns Hopkins University.
Matt is a frequent speaker at NTEN events and has presented at the Inside NGO conference, Non-Profit Risk Management Summit and Credit Builders Alliance Symposium. He is also the session designer and trainer for TechSoup’s Digital Security course. He is available as a speaker and collaborator in the area of cybersecurity for nonprofits.
You may want to check out this webinar with Matt walking through the full Cybersecurity Playbook and Basics guides.
If you’d like to see where your organization stands, our free cybersecurity risk assessment is a good next step.