Cybersecurity for Nonprofits

Printer-friendly version

If your nonprofit engages in any of the three activities below, it’s time to get serious about taking steps to address cybersecurity risks.  Does your nonprofit:

  1. Conduct e-commerce on its website, such as processing donations or event registrations?

If so, there are real risks to your nonprofit's own data security as well as to its donors, and individuals it serves. Learn more about protecting the future of your nonprofit's data.

US nonprofits that raise money in the European Union, or provide services to citizens of the EU, AND collect data about those citizens, must follow the EU's General Data Protection Regulations.

What are the risks?  What should we do? 

Data breaches that are both likely to happen and can result in serious harm fall in the “high priority” category. Many nonprofits collect and store sensitive personal information that is protected by law as confidential. When there is a breach of the confidentiality of those data, that poses a risk for the individuals whose data was disclosed, AND for the nonprofit that will now potentially be subject to liability for the breach. It makes sense for EVERY nonprofit to - at a minimum - assess the risks of a data security breach, and protect its data from unauthorized disclosure.

First Step | Risk assessment

The Nonprofit Technology Network (NTEN) suggests that the first step in assessing your nonprofit’s data risks is to take inventory of all the data your nonprofit collects and identify where it is stored. NTEN offers a template assessment tool; and here is a simple one-page inventory tool from Digital Impact.IO for the same task. These inventory tools ask: What data do we collect about people? What do we do with it? Where do we store it? Who is responsible for it? Think about the cost/benefit of maintaining all that data. You may find that there is data your nonprofit is currently asking for and keeping that it doesn’t really need. If so, reducing or limiting the data that your nonprofit collects, and streamlining the storage process (as well as diligently destroying data in accordance with the nonprofit’s document retention policy) could be easy first steps towards mitigating risk.

Second Step | Are the data your nonprofit maintains "protected" or "confidential"?


Even if you are collecting data that doesn’t rise to the level of “personally identifiable information,” such as a community theatre collecting information on attendees’ preferences for plays or musicals, a breach of that data can be harmful to the organization’s reputation and ability to bring in contributions. All data reflecting personal preferences are important to keep secure.

Third Step | Drill down on the actual risks


Take a look at the likelihood of some cybersecurity risks: What is the risk of a third party compromising your nonprofit’s data security? Many nonprofits use outside assistance, such as an outsourced bookkeeper, IT consultant, payroll service, or even a cloud storage service. If any of these third-party vendors do not employ adequate data security protection, the nonprofit’s data security will be at risk. Other types of third-party access might include a donation processing service or any outside professionals with authority to access the administrative side of your nonprofit’s website or shared electronic files. Consequently, when hiring third-parties for any projects that involve data access by the vendor, make sure that you are satisfied with the firm’s data security protocol. Here is a set of questions developed by Digital Impact.IO as a starting point for questions to ask the vendor about their approach to data security.

How likely is it that hackers will take over your nonprofit’s website?

Hackers can access your nonprofit’s site through a security breach, and transform it into something you would not recognize, like an online pharmacy. How likely is this to happen? That depends on the strength of the security of individual nonprofits’ websites and how consistently users follow strong password protocols. How serious are the risks? Typically, the main website remains intact, but the hackers create additional content that can’t be good for your nonprofit’s reputation – or Google analytics. So, on balance, a site takeover does not create the same type of liability risks that other security breaches do, but cleaning up the mess can be time consuming and costly. Managing these risks is much like brushing your teeth. We all need to get in the habit of keeping software updated and being vigilant about usernames and passwords (example: Using “admin” as a user name creates vulnerabilities, say the experts.) Regular maintenance can go a long way towards reducing this and other data security risks.

What about cyber liability insurance? Is it needed?



Yes, the idea of someone hacking your nonprofit’s website or data storage is unnerving, but in today’s world such incidents have become practically commonplace. Failing to assess and address cybersecurity risks is like failing to brush your teeth: Would you rather change a password or go to the dentist?    

Remember that your state association of nonprofits may offer special workshops or educational programs on this topic and may have relationships with experts who can assist your nonprofit with cybersecurity maintenance and best practices.


Find Your State Association of Nonprofits

Find Your State Association of Nonprofits

Connect with local resources and expertise


Connect With Us

1. Sign up for updates


2. Follow us on social media