Nonprofits
We find out whether your email, donor records and shared files are safe from attackers, and fix what we find. Nonprofits hold donor and beneficiary data, answer to funders and boards, and run on small teams, volunteers and tight budgets. We put the basics in place first, write them down so a funder can read them and leave your staff in control.
A nonprofit holds the trust of donors, members and the people it serves, often with a handful of staff, a rotating group of volunteers and no one whose full-time job is security. Attackers still target charities, because donor records, payment pages and wire requests look the same as any other company's.
Our team does the basics well and writes them down. We secure the email and file platform you already use, control volunteer and board access, protect donor data and give your leaders a short plan they can show a funder. We work within your budget and leave your people able to run what we build.
What we see in your industry
- Donor and beneficiary records are valuable and personal. Know where they live, who can open them and how they are backed up, and if you take cards online, check how the payment page keeps card data out of your systems.
- Funders ask questions. Grant agreements often require reasonable safeguards for personal information, and federal awards carry such expectations through the Uniform Guidance. A short written baseline answers most of them.
- Many nonprofits use discounted or donated Microsoft 365 plans, or Google for Nonprofits with Google Workspace. Those programs change from time to time, so check current terms. Either way, the security settings are yours to turn on and keep on.
- Volunteers and board members come and go, often on personal devices. Give them limited accounts, remove access the day they leave and keep guest access reviewed.
- CISA publishes free guidance and services for organizations with small budgets, including its Cross-Sector Cybersecurity Performance Goals. We use them as a checklist so scarce money goes to the controls that matter most.
Sign-in comes first. Multi-factor authentication for everyone, phishing-resistant methods for administrators and finance staff, and no shared passwords on mailboxes. This single step stops most account takeovers.
Donor data comes second. We map where donor and beneficiary records live, limit who can open them, encrypt and back them up, and check that online giving pages use a payment provider that keeps card data out of your systems. Privacy and charity laws vary by state; your counsel advises on them.
Funders and grants come third. Many grant agreements ask for reasonable safeguards over personal information, and federal awards carry expectations under the Uniform Guidance, 2 CFR Part 200. We produce a short written baseline and evidence of review that answers a funder's questionnaire. Our nonprofit hardening work follows the CISA SCuBA baselines for Microsoft 365.
Platform programs come fourth. Microsoft offers discounted or donated plans to eligible nonprofits and Google offers Google for Nonprofits. Eligibility and terms change, so confirm them with the vendor. We configure the security settings in whichever platform you use, including the ones turned off by default.
Volunteers come fifth. They get limited accounts or guest access, devices are checked before they reach data and access ends the day someone leaves. We review guest accounts every quarter.
Free and low-cost help comes last. CISA publishes guidance and free services, including its Cross-Sector Cybersecurity Performance Goals, and we use them to put limited money where it reduces risk most. See our Microsoft 365 hardening guidance and our ransomware checklist.
Every nonprofit's forms, contact lists and procedures can run offline. Our Apocalypse IT Package is an on-premises continuity kit with a local reference library, document scanning, a private AI desk, chat and battery backup, offered to every customer.
Related work on our track record: a nonprofit's Microsoft 365 hardening against the CISA SCuBA baselines (illustrative).
Windows 10 End of Support and Microsoft 365 Hardening: What to Do Now, With CISA SCuBA Baselines
Microsoft ended support for Windows 10 on October 14, 2025. Paid Extended Security Updates can bridge up to three years, but they are a stopgap. This article explains the dates, the Windows 11 hardware rules, the effect on Microsoft 365 Apps, and a short hardening list based on CISA's free SCuBA baselines.
How we help
Cybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreManaged IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreSecurity Awareness Training
Train your people to stop the phish, the fake voice and the wire request before money moves.
Learn moreEmail Security, Archiving & Continuity
Filter threats out of mail, keep every message in an immutable archive you can search, and keep email working when the mail platform goes down.
Learn moreCloud Management
Cloud cost review and management, without compromising on quality or security.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageHow do we protect donor data?
Collect only what you need, keep it in one system with role-based access, and require MFA for everyone who can see it. Encrypt devices, back up the donor database and test a restore, and remove access when staff or volunteers leave. If you take cards online, use a payment processor that hosts the payment page so card numbers never touch your systems. Check state breach-notification and charitable-solicitation rules with counsel; this is not legal advice.
How do we handle volunteer and shared accounts safely?
Give each person their own login, since shared accounts hide who did what and cannot be revoked cleanly. Where a shared mailbox or social media account is unavoidable, use a password manager or delegated access, turn on MFA and limit it to named people. Give volunteers the least access their role needs, set an end date for temporary access and review the list each quarter. Prefer managed accounts over personal email for any work involving donor or client data.
Can nonprofits get discounted Microsoft 365 or Google licensing?
Often, yes. Microsoft and Google both run programs that offer free or discounted licenses to eligible nonprofits, usually after the organization is verified. Eligibility rules, included products and discounts change, so check the current terms with each vendor or through a nonprofit technology reseller before you plan a budget around them. We can help with the verification, tenant setup and security configuration once you are approved.
What should a small nonprofit do first?
Do three things in order. Turn on MFA for email and the donor or case-management system. Back up your key data to a place that ransomware cannot reach and test a restore. Then list who has admin access and remove anyone who should not. After that, add staff phishing training, automatic updates and a one-page plan for who to call if something goes wrong.
Does a small nonprofit really need a security program?
Yes, although it can be small. Nonprofits hold donor, beneficiary and sometimes health or financial information, and attackers target them with payment-change fraud and credential phishing. A short written plan, a handful of baseline controls and a named person responsible is proportionate. Funders, insurers and grant agreements increasingly ask about these controls, so having them documented also helps with applications.