Nonprofit Cybersecurity Checklist for Executive Directors
A nonprofit cybersecurity checklist helps executive directors determine whether their organization has essential security protections in place. You do not need to manage the technical work yourself, but you should understand how your nonprofit protects its information, controls access to systems and prepares for potential disruptions.
Nonprofits rely on fundraising platforms, financial records, email, cloud applications, and shared documents to carry out their work. A compromised account or unavailable system can interrupt programs, delay fundraising activities, and create unexpected expenses.
Use this checklist with your internal technology team to identify what is working and what needs attention. If your organization does not have dedicated IT staff, consider working with an IT provider experienced in supporting nonprofits to evaluate your existing security measures and identify areas for improvement.
The Nonprofit Cybersecurity Checklist
For each item, record one of three answers:
- Confirmed: The protection is in place and can be verified.
- Donation history: Contribution amounts, donation dates, recurring gifts, and fundraising campaign participation.
- Not in Place: The organization has not implemented the protection.
A verbal assurance may be a useful starting point, but your IT provider should be able to explain how important controls are managed and verified.
1. Is Multi-Factor Authentication Required?
☐ Multi-factor authentication protects organizational accounts.
Multi-factor authentication (MFA) requires an additional form of verification when someone signs in. It helps protect accounts when passwords are stolen or exposed.
MFA is particularly important for:
- Microsoft 365 and Google Workspace
- Donor management and fundraising platforms
- Financial and accounting systems
- Administrator accounts
- Remote access to organizational systems
What to verify: Is MFA enforced for employees, leadership, volunteers, and administrators wherever supported?
Priority should be given to accounts that provide access to sensitive information or critical systems. Stronger authentication methods, such as phishing-resistant MFA, should be considered where available.
2. Are Staff and Volunteer Accounts Managed Properly?
☐ User accounts and permissions are reviewed regularly.
Nonprofits often depend on part-time employees, temporary staff, contractors, and volunteers. Access can accumulate as people change responsibilities or leave the organization.
Former employees should not retain access to email, donor records, shared documents, or other organizational systems.
What to verify: Is there a documented process for creating, updating, and disabling accounts when someone joins, changes roles, or leaves?
Access should reflect current responsibilities, not permissions granted years earlier.
3. Are Computers and Applications Updated?
☐ Organizational devices and software receive security updates.
Outdated operating systems, browsers, and applications can expose organizations to known security vulnerabilities.
This includes office computers, laptops used remotely, and other devices that access nonprofit information.
What to verify: Who manages updates, and how are devices with missing security patches identified?
Your IT provider should be able to explain how updates are monitored and how problems are resolved.
4. Is Sensitive Data Protected?
☐ Confidential information is accessible only to authorized users.
Nonprofits may maintain donor records, donation histories, employee information, financial reports, and confidential program files.
Employees should have access to the information needed for their work, without unnecessary access to unrelated records.
What to verify: Are permissions reviewed for donor databases, cloud folders, accounting applications, and other systems containing sensitive information?
Also ask how confidential files are protected when downloaded, emailed, or shared externally.
5. Are Email Accounts Protected Against Phishing?
☐ Email security measures help identify malicious messages and account compromise.
Attackers may impersonate nonprofit executives, vendors, or donors to request payments, steal credentials, or gain access to organizational information.
Email protection should address suspicious links, malicious attachments, unauthorized sign-ins, and potentially fraudulent messages.
What to verify: What email protections are active, and how would your IT provider identify and respond to a compromised mailbox?
Employees should also know how to report suspicious emails without forwarding potentially harmful content to colleagues.
6. Are Backups Reliable and Tested?
☐ Critical information is backed up, and recovery procedures are tested.
Losing access to financial records, program documents, or donor information can disrupt daily operations and fundraising activities.
A backup is useful only when the organization can successfully restore the information it needs.
What to verify: Which systems are backed up, how often, and when was the last successful recovery test?
Confirm whether your backup strategy covers cloud applications such as Microsoft 365 or Google Workspace, as well as files stored on local computers and servers.
Backups should also be protected against unauthorized modification or deletion.
SECURE NETWORKS ITCYour Nonprofit Deserves Reliable IT Support
20 years of experience supporting San Diego organizations. Get unlimited IT support, proactive cybersecurity, and predictable monthly pricing from a Microsoft Certified Partner.
IT Support for San Diego Nonprofits
Local expertise. Long-term partnership.
7. Is Administrator Access Restricted?
☐ Administrator privileges are limited to authorized personnel.
Administrator accounts can modify security settings, create users, change permissions, and control important systems.
Unnecessary administrator access increases the potential damage if an account is compromised.
What to verify: Who has administrator access to your cloud platforms, network equipment, and business applications?
Ask whether administrative accounts use strong authentication and whether privileges are reviewed regularly.
8. Is Third-Party Access Controlled?
☐ Vendors and outside service providers have appropriate, limited access.
Nonprofits frequently work with accountants, fundraising consultants, software vendors, and other external partners.
Some need access to specific documents or applications, but that access should be limited to the work they perform.
What to verify: Does your organization maintain a record of vendors with system access, and is access removed when an engagement ends?
External access should be approved and periodically reviewed.
9. Do Employees Know How to Report Security Problems?
☐ Staff and volunteers know whom to contact about suspicious activity.
An unexpected login notification, suspicious payment request, missing laptop, or incorrectly shared document may require immediate attention.
Employees should not be expected to investigate incidents themselves.
What to verify: Can employees explain whom they should contact and what information they should provide when reporting a potential security issue?
Clear reporting instructions help the organization respond sooner and reduce confusion.
10. Does the Organization Have an Incident Response Plan?
☐ A written plan identifies responsibilities during a security incident.
If a nonprofit experiences a cyberattack or account compromise, leadership may need to coordinate technical support, protect information, maintain essential operations, and determine whether notifications are required.
These responsibilities should be established before an incident occurs.
What to verify: Does your nonprofit have a documented incident response plan with current contact information and clear responsibilities?
The plan should identify who makes decisions, who contacts the IT provider, and how the organization evaluates potential legal or contractual obligations.
Nonprofit Cybersecurity Best Practices to Prioritize First
After completing the checklist, review every item marked Needs Review or Not in Place.
Some gaps deserve attention sooner because they can affect multiple systems or prevent the organization from recovering after an incident.
| Priority | Action | Business impact |
|---|---|---|
| High | Require MFA on critical accounts | Reduces unauthorized account access |
| High | Remove outdated accounts and unnecessary administrator permissions | Limits exposure of organizational information |
| High | Verify backups and test recovery | Helps restore operations after data loss or disruption |
| High | Address missing security updates and device protection | Reduces exposure to known threats |
| High | Establish incident reporting and response procedures | Supports faster, more coordinated action |
These are general starting priorities. An organization with a known vulnerability, recent incident, or specific compliance obligation may need a different order.
Assign an owner and a target date to each improvement. Executive directors should receive progress updates rather than assume that identified problems have been resolved.
Six Questions to Ask During a Nonprofit Cybersecurity Assessment
The checklist identifies important questions, but a professional cybersecurity assessment examines the organization's actual systems, security controls, and risks in greater detail.
When meeting with your IT provider, ask:
- Which systems would cause the greatest disruption if we lost access to them? Identify essential services such as email, donor management, accounting, and program operations.
- How do you verify that our accounts and devices are protected? Ask about MFA, security updates, endpoint protection, and access reviews.
- When did we last test restoring our critical information? Request an explanation of what was tested and whether the recovery was successful.
- How would we detect and respond to a compromised account? Understand who receives alerts and what happens next.
- What cybersecurity risks have you identified that we have not yet addressed?Ask for a prioritized explanation in business terms.
- Which improvements should we include in our next IT budget? Separate immediate security needs from longer-term investments.
Does Your Nonprofit Need a Cybersecurity Policy?
A nonprofit cybersecurity policy establishes expectations for how staff, volunteers, and contractors use organizational technology.
It should address essential practices such as account security, approved devices, handling confidential information, and reporting suspicious activity.
For smaller organizations, the policy can be concise. What matters is that employees understand their responsibilities and that the procedures reflect how the nonprofit actually operates.
A written policy should also identify who oversees cybersecurity decisions and how often practices are reviewed.
Some nonprofits have additional obligations under privacy laws, grant agreements, government contracts, or other requirements. These should be evaluated individually rather than assuming that every nonprofit follows the same security standards.
For organizations seeking a structured starting point, the NIST Cybersecurity Framework 2.0 Small Business Quick-Start Guide provides guidance that is also applicable to smaller nonprofit organizations.
How Secure Networks ITC Helps San Diego Nonprofits Improve IT Security
Secure Networks ITC has 20 years of experience supporting organizations throughout San Diego County. As a Microsoft Certified Partner, we provide proactive IT management, cybersecurity services, and cloud support.
Our cybersecurity services in San Diego address important areas covered in this checklist, including email protection, endpoint security, vulnerability management, access controls, and backup and recovery.
Through our managed IT services for nonprofits, organizations also receive ongoing technology management and unlimited IT support under predictable flat per-seat monthly pricing.
We help nonprofit leaders understand their IT environment, identify areas requiring attention, and prioritize practical improvements that support daily operations.
More Resources for Nonprofits
Review additional guidance on protecting donor records, controlling access to organizational systems, and maintaining essential services during IT disruptions.
