Microsoft 365 hardening for a 50‑person nonprofit against the CISA SCuBA baselines
A nonprofit of about 50 staff and volunteers on Microsoft 365 with no security staff, a leader in its mission area.
- Scale
- 1 Microsoft 365 tenant, ~50 users, donor and program data, shared mailboxes and volunteer guest accounts
- Engagement
- 6 weeks from assessment to a documented baseline, then ongoing review
The challenge
The nonprofit holds donor records and program data, and a funder had asked how its Microsoft 365 tenant was secured. Settings had accumulated over years: shared passwords on mailboxes, volunteers with full accounts, and no one who knew which defaults were still unsafe.
A nonprofit of about 50 staff and volunteers holds donor records and program data in Microsoft 365. A funder asked how the tenant was secured, and nobody could answer with more than a hope. The client is not named on this page. This is an illustrative engagement that describes the kind of work our team does; details are composite.
Years of growth had left the usual mix: shared passwords on mailboxes, volunteers with full accounts, administrators who also read email, and defaults nobody had reviewed. With no security staff, the question was where to start and what good looked like.
We used the CISA Secure Cloud Business Applications (SCuBA) baselines as the yardstick. They are free, published by the US government and cover Entra ID, Exchange Online, Defender, SharePoint, OneDrive and Teams. Our team assessed the tenant against them and rated each gap by risk, so the board saw a short list of what mattered most, not a long audit.
Fixes went in order of risk. Multi-factor authentication came first for everyone, with phishing-resistant methods for administrators, plus Conditional Access and blocked legacy authentication. Admin roles were cut to what each person needs. SPF, DKIM and DMARC were set up, external forwarding was limited, sharing rules were tightened and guest volunteer accounts now expire. Audit logging was turned on and checked.
The result is a short written baseline the board can read, with each exception recorded and explained, and a quarterly check for drift. The nonprofit can answer funder and insurer questions with a document. This is hardening work against a public baseline; it is not a certification or a guarantee.
What our team delivered
- An assessment of the tenant against the CISA Secure Cloud Business Applications (SCuBA) baselines for Entra ID, Exchange Online, Defender, SharePoint, OneDrive and Teams, with each gap rated by risk
- Multi-factor authentication for everyone, phishing-resistant for administrators, Conditional Access, and legacy authentication blocked
- Admin roles cut to what each person needs, with separate admin accounts and no daily-use global administrators
- Email protection: SPF, DKIM and DMARC, anti-phishing policies and limits on external forwarding
- Sharing limits in SharePoint, OneDrive and Teams, guest access rules for volunteers and expiry for old guest accounts
- Audit logging on, a short written baseline the board can read, and a quarterly drift check against it
Result
The tenant now matches the baselines the team set out to meet, the exceptions are written down with reasons, and the nonprofit can answer funder and insurer questions with a document. The work is a hardening effort and not a certification or a guarantee. This is an illustrative engagement that describes the kind of work our team does; details are composite.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Show 3 more
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
Email security with AI detection and DLP
Inbound and outbound protection: phishing, malware and impersonation caught by AI detection, with data loss prevention for what leaves.
Live within 7 business days
$7 per mailbox, per month
Compromised-mailbox monitoring and alerts
We watch each mailbox for signs of takeover, such as odd logins, forwarding rules and mass sending, and alert you fast.
Live within 5 business days
$4 per mailbox, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Critical patches in days, not months
Distribution of days from vendor patch release to deployment for critical-severity CVEs, before and after a managed patching service. The dashed line marks two weeks: under CISA BOD 22-01, US federal agencies must remediate Known Exploited Vulnerabilities within two weeks for CVEs assigned in 2021 or later (six months for older ones). Private organisations are not bound by it, but it is a sensible benchmark. Illustrative figures.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.