Key takeaways

  • A nonprofit's donor database is valuable to criminals for fraud, for fake appeals and for resale, and small organizations are not skipped because they are small.
  • Most of the risk reduction comes from a short list: multi-factor authentication, separate accounts, least-privilege access, tested backups and quick offboarding of staff and volunteers.
  • Do not store card numbers. Use a hosted payment page from a PCI-compliant processor, which keeps the organization at the simplest level of PCI DSS validation.
  • Volunteers and board members are the biggest unmanaged access in most nonprofits. Give them accounts that can be turned off, never shared logins.
  • Free guidance exists: CISA publishes cybersecurity guidance for small organizations and the NIST CSF 2.0 has a quick-start guide for small businesses.
  • Write down who to call and what to do on the day donor data is exposed. State breach laws may apply to a nonprofit just as they do to a company.

Why donor data is worth stealing

A donor record is more than a name. It usually has a postal address, an email address, a phone number, giving history and the dates and sizes of gifts, and often notes about relationships and capacity to give. That is exactly what a fraudster needs to write a convincing fake appeal or a message that appears to come from the executive director asking a major donor to send a wire. Attackers also go after a nonprofit's own bank accounts, payroll and grants, because the organization is trusted and may have few controls on payments.

Small organizations share a pattern: a handful of staff, a growing number of volunteers, a donor relationship system or spreadsheets, an email platform, a payment processor and a lot of goodwill. The aim of this article is a sequence. Do the first controls before the later ones, and stop when the budget does.

The ten controls, in the order we would do them

1. Multi-factor authentication on email and the donor system

Email controls password resets for everything else, so it comes first. Turn on multi-factor authentication for every staff mailbox, for the donor database and for the payment processor's dashboard. Prefer an authenticator app or a passkey to text messages. Most email and fundraising platforms include this at no extra charge.

2. One person, one account, no shared logins

A shared login called development@ or events@ cannot be audited and cannot be revoked for one person. Give each person a named account. If a role changes hands, change who holds the account, not the password on a shared one.

3. Least-privilege access to donor records

Most donor systems have roles. A volunteer who enters event registrations does not need to export the whole giving history. Set roles so that exporting the full list is limited to one or two people, and turn on any available alert for large exports. Spreadsheets of donor data that get emailed around are a larger risk than the database they were exported from.

4. Never store card numbers

A nonprofit that accepts cards is a merchant under the Payment Card Industry Data Security Standard. The cheapest and safest approach is to send donors to a hosted payment page run by the processor, so card data never touches the organization's website or staff. That generally reduces validation to the shortest self-assessment questionnaire. Our article on PCI DSS 4.0.1 for small merchants explains the levels. Staff should also never accept card numbers by email, text or notes.

5. Back up the donor data and test a restore

Ransomware does not skip nonprofits. Keep a copy of the donor database and the finance files that the main systems cannot overwrite or delete, and restore a file from it once a quarter to prove it works. Cloud fundraising platforms are not automatically backed up in the way people assume, so ask the vendor what is retained and for how long.

6. Offboard people the same day

Volunteers, interns and board members come and go and keep access they no longer need. Keep a single list of who holds what, review it each quarter, and remove access on the day someone leaves. Our article on single sign-on offboarding explains how larger organizations automate this; a small one can do it with a checklist.

7. Update devices and turn on disk encryption

Laptops and phones that hold donor data should be encrypted and set to install updates automatically. Built-in tools on current Windows, macOS and mobile systems do this. A lost, encrypted laptop is a nuisance. A lost, unencrypted one can become a reportable breach.

8. Train for the scams a nonprofit actually sees

The usual ones are a fake message from a board chair or executive director asking for gift cards or a wire, a fake vendor change of bank details, a fake donor-matching or grant portal that harvests passwords, and an invoice sent to accounts payable. Brief, regular, real examples work better than an annual video. Require a call to a known number for any change of payment details.

9. Choose vendors with their security in mind

Your donor data also lives at your fundraising platform, email service and event ticketing company. Ask each for a security summary or an independent audit report, how they handle a breach and whether they will tell you promptly, and what happens to your data if you leave. Our article on vendor risk for small medical groups uses the same questions and applies equally here.

10. Write a one-page response plan

Who is in charge, who can disable accounts, who talks to the board, the insurer and the bank, and who tells donors. Add the contact for your state's breach-notification office. Many state laws apply to nonprofits as well as businesses, and the notice duties start from when you discover the problem. Keep a printed copy somewhere the attacker cannot reach.

Where free help exists

CISA publishes cybersecurity guidance aimed at small organizations, and the NIST Cybersecurity Framework 2.0 has a quick-start guide written for small businesses that works equally well for a nonprofit. Some of CISA's no-cost services, such as vulnerability scanning of internet-facing systems, are open to organizations in critical infrastructure sectors, and a nonprofit may or may not qualify, so check eligibility on the CISA site. Larger technology vendors also run nonprofit programs for email and device management, and it is worth asking about them before buying anything.

If a grant or a board has asked you to show your controls, or you want the first ten set up for you, start with our Cybersecurity service. The Nonprofits page lists how we work with mission-driven organizations.

Sources

This article is general information, not legal advice. Breach-notification and charity laws differ by state; confirm your duties with your counsel. Last reviewed .

Keep reading

Need help with this?

We find out whether everything you run is safe from attackers, then we fix it.

Cybersecurity