Nonprofit cybersecurity on a limited budget: where to start

A nonprofit with a limited budget should start with the controls that cost the least and stop the most: phishing-resistant multi-factor authentication, updated software, named accounts with access removed when people leave, and a tested backup. CISA’s guidance for civil society organizations lays out nearly the same list. Most of it can be done with licensing the organization already has or can get through nonprofit programs, and the remaining spend is better directed at configuration and ongoing management than at new products.

Why nonprofits are a target

Nonprofits hold valuable information: donor names, addresses, and giving history; payment details; client records that may include health, immigration, or financial data; and in some cases sensitive information about staff and partners. They also tend to run lean on IT. In May 2024, CISA, the FBI, DHS, and international partners including the UK NCSC and the Canadian Centre for Cyber Security published Mitigating Cyber Threats with Limited Resources: Guidance for Civil Society. It is written for nonprofit, advocacy, cultural, faith-based, and academic organizations, and it notes that these organizations “often have low defense capacity” and frequently lack internal IT support and essential cyber hygiene.

That combination (valuable data, limited staff) is exactly what attackers look for. The good news is that the guidance is practical and prioritized, which makes it a sound backbone for a plan.

What CISA recommends for organizations like yours

The civil society guide lists organizational actions that map well to a small nonprofit:

• Keep software updated on every device and application.
• Implement phishing-resistant multi-factor authentication.
• Audit accounts and disable unused ones.
• Disable accounts and access for departing staff.
• Apply least privilege, and avoid using administrator accounts for daily tasks.
• Do due diligence when selecting vendors, including cloud and managed service providers.
• Review contracts with service providers for security controls, monitoring and logging, and incident notification.
• Provide basic cybersecurity training on phishing, email and web security, and passwords.
• Develop and exercise incident response and recovery plans.

None of these requires a large security budget. Most require someone to own them and check them on a schedule.

Volunteers, interns, and shared accounts

Nonprofits have a staffing pattern that most businesses do not: volunteers, interns, board members, and seasonal event staff who need some access for a limited time. The usual workaround is a shared account, such as a single “volunteer@” login or a shared password for the donor database. Shared accounts make it impossible to know who did what, and the password rarely changes when someone leaves.

A better approach:

• Give each person who touches donor or client data a named account, even if it is short-lived.
• Set an end date on temporary accounts when they are created.
• Keep volunteers out of systems they do not need. Event check-in rarely requires access to the full donor history.
• Review the account list every quarter and remove anyone who is no longer active.

The civil society guide ties this practice to CISA’s Cross-Sector Cybersecurity Performance Goals (goal 2.D), a voluntary set of baseline practices intended to help small and medium organizations get started.

Use nonprofit licensing programs

Both major productivity platforms offer nonprofit programs. Microsoft’s nonprofit program and Google for Nonprofits provide discounted or donated licensing, and eligibility rules apply. For many organizations, this is the most cost-effective way to get centralized identity, email security features, and device management on the same platform.

The licensing is only half of it. The security features in these platforms need to be turned on and configured: MFA enforcement, blocking older sign-in methods that bypass MFA, limits on external sharing, and alerting on suspicious sign-ins. A common pattern is capable licensing running on default settings. Our Microsoft 365 work focuses on closing that gap.

A prioritized plan on a budget

If you can only do a few things this year, do them in this order:

1. Turn on MFA for every account, starting with email, the donor database, and finance systems. CISA’s phishing-resistant MFA fact sheet says “any form of MFA is better than no MFA” and calls phishing-resistant MFA “the gold standard.” Start with what you can deploy now, then move administrators and finance staff to phishing-resistant methods.
2. Clean up accounts. Remove former staff, volunteers, and board members. Replace shared logins with named ones.
3. Update everything. Enable automatic updates on computers and phones, and replace devices that no longer receive security updates.
4. Back up the data that matters, including your cloud email and files, and test a restore at least once.
5. Train people briefly and often. Short, regular training on phishing and payment-change requests does more than one long annual session. Our security awareness program is built around that model.
6. Write a one-page incident plan. Who to call, how to reach your bank, how to notify your board. Then walk through it once with the team.
7. Check your vendors. Ask your donor platform, payment processor, and IT provider how they protect your data and how they will notify you of an incident.

How Intelligent Group can help

Intelligent Group works with nonprofits across our industries practice, applying the CISA civil society recommendations in a form a small team can sustain. That typically means configuring the licensing you already have, cleaning up accounts, setting up tested backups, and providing managed IT with 24/7 US-based senior engineers so staff are not left to handle security alone. We start with a review of what is in place and a prioritized list of what to fix first. Contact us to talk through your environment.

Frequently asked questions

Do small nonprofits really need to worry about cyberattacks?

Yes. CISA’s civil society guidance was written specifically because these organizations often have low defense capacity while holding sensitive information. Attackers frequently target organizations with limited IT support because basic controls are more likely to be missing.

What is the single most important control for a nonprofit?

Multi-factor authentication on every account, especially email. Email access opens the door to donor data, finance conversations, and password resets for other systems. Phishing-resistant MFA is the strongest option, but any MFA is far better than none.

Can we get Microsoft 365 or Google Workspace at a discount?

Both Microsoft and Google run nonprofit programs that offer discounted or donated licensing. Eligibility rules apply, so check the program pages for current requirements. Once licensed, make sure the security features are actually configured.

How should we handle volunteer access to donor data?

Give volunteers named accounts with only the access their role requires, and set an end date when the account is created. Avoid shared logins. Review active accounts each quarter and remove anyone who has moved on.