Guide · 6 min read

What funders mean when they ask about data security

A data security question on a grant application or due-diligence form isn’t a trick, and you don’t need a security team to answer it well. Here’s what funders are really checking, what a strong answer looks like, and what to do if you’re not there yet.

Why funders are asking now

Funders are accountable for where their money goes and what happens to the people your programs serve. A breach can stall a program, expose clients or donors, and land in the news with the funder’s name attached. So more foundations, government agencies, and corporate partners now include security questions in applications, renewals, and grant agreements, especially when you handle sensitive data about clients, donors, health, or children.

They aren’t expecting a bank-grade security program. They want to know that someone is paying attention, that the basics are in place, and that you’d know what to do if something went wrong.

The questions you’ll see, and what’s behind them

“Describe your data security policies.”

What they’re checking: that security decisions are written down rather than living in one person’s head.

A good answer: name the policies you have (acceptable use, access control, incident response, data retention), when they were last reviewed, and who owns them. Short, plain-language policies count. A 40-page template nobody follows doesn’t.

“Do you use multi-factor authentication?”

What they’re checking: the single control that blocks most account takeovers.

A good answer: say where MFA is enforced (email, file storage, finance, donor database) and whether any accounts are exempt. “Yes, required for all staff on Microsoft 365 and our donor CRM” is far stronger than “yes.”

“Who has access to sensitive data?”

What they’re checking: that access is limited to people who need it, and removed when they leave.

A good answer: describe how access is granted, how often it’s reviewed, and how you remove it when staff, volunteers, or contractors leave.

“Do you back up your data, and have you tested restoring it?”

What they’re checking: whether ransomware or a mistake would end your operations or just cost you a bad week.

A good answer: what’s backed up, how often, where the copies live, and the date of your last successful test restore. The test is the part most organizations skip.

“Do you have an incident response plan?”

What they’re checking: that you’d act quickly and notify the right people, including them.

A good answer: a short written plan covering who decides, who to call (your IT provider, cyber insurer, legal counsel), and how you’d notify affected people. One page is enough to start.

“How do you manage vendors that handle your data?”

What they’re checking: that your security doesn’t stop at your own walls. Much of your data likely lives in cloud tools.

A good answer: list the key systems holding sensitive data, and explain how you choose vendors and what you check before signing up.

“Do staff receive security training?”

What they’re checking: that the people most likely to be targeted by phishing know what to look for.

A good answer: how often training happens, what it covers, and whether it includes volunteers and board members who use your systems.

What a strong answer looks like

• Specific. Name the systems, the dates, and the owners. Specifics read as real; adjectives read as hopeful.
• Current. “Reviewed in March 2026” beats “we have a policy.”
• Honest. If something isn’t in place yet, say so and give the date you expect it to be.
• Consistent. Funders compare answers across forms and years. Keep a single source of truth, and reuse it.

Never overstate your answers

It’s tempting to check “yes” and fix it later. Don’t. Grant agreements often treat your answers as representations, and a false one can put funding at risk if something goes wrong. The same is true on cyber insurance applications, where an inaccurate answer can jeopardize a future claim. A clear “not yet, here’s our plan” earns more trust than an answer that falls apart under a follow-up question.

Not there yet? Five steps for the next 30 days

1. Turn on MFA everywhere, starting with email, file storage, and your donor or client database. Most platforms include it for free.
2. Test a restore. Pick a file and a folder, restore them from backup, and write down the date it worked.
3. Write a one-page incident response plan: who decides, who to call, and how you’ll notify people.
4. Review who has access to your most sensitive systems, and remove anyone who no longer needs it.
5. Write a one-page security overview that summarizes the above. It will answer most funder questions, and you can reuse it on every application.

Those five steps won’t make you bulletproof, but they cover what most funders are looking for, and they give you honest, specific answers to share.

Need a hand?

If a security questionnaire is on your desk, I can help you answer it accurately and build a reusable answer library so the next one takes minutes. If you’re not sure where you stand, a risk assessment gives you a prioritized plan you can share with funders. See Due-Diligence Support and Risk Assessment, or book a free 30-minute intro call.

This guide is general information, not legal advice. Your grant agreements and any laws that apply to your data, such as HIPAA, set the actual requirements.