Security incident? Get help now →

Checklist · Free

The nonprofit security essentials checklist

Twelve steps that stop most common attacks on small organizations. Most cost nothing but a few hours. Work through them in order: the first five do the most good.

Print this page or save it as a PDF (File → Print → Save as PDF), and check items off as you go.

Accounts and access

  1. Turn on multi-factor authentication (MFA) everywhere. Start with email, then file storage, finance and payroll, and your donor or client database. MFA blocks the large majority of account takeovers, and most platforms include it at no cost.
  2. Use a password manager. Give every staff member one, with a shared vault for team accounts. Unique passwords mean one breached site doesn’t unlock everything else.
  3. Remove access when people leave. Keep a short offboarding list: email, file storage, databases, shared passwords, and building access. Do it on the person’s last day, not weeks later.
  4. Separate admin accounts. Whoever manages Microsoft 365 or Google Workspace should use a separate admin account, not their everyday login.

Data and recovery

  1. Back up, then test a restore. Confirm what’s backed up and how often. Then actually restore a file and a folder, and write down the date it worked. An untested backup is a hope, not a plan.
  2. Know where your sensitive data lives. List the systems that hold donor, client, staff, health, or payment information, and who can reach each one.
  3. Share files with named people, not open links. Turn off “anyone with the link” sharing for sensitive folders, and review old shared links once a year.

Devices and email

  1. Keep devices updated and encrypted. Turn on automatic updates and full-disk encryption (FileVault on Mac, BitLocker on Windows) for every laptop that touches organizational data, including personal devices used for work.
  2. Protect your email domain. Ask your IT provider to set up SPF, DKIM, and DMARC so criminals can’t easily send email pretending to be you.

People and plans

  1. Train staff to spot phishing. A short session each year, plus a clear rule: verify any request for money, gift cards, or password changes by phone or in person.
  2. Write a one-page incident response plan. Who decides, who to call (IT provider, cyber insurer, legal counsel), and how you’ll notify people. Use the one-page template.
  3. Put it in writing. A short acceptable use policy and a one-page security overview you can share with funders and insurers.

What to do next

If you can check all twelve, you’re ahead of most small organizations, and you’ll have honest, specific answers for funder questionnaires and cyber insurance applications. If several are open and you’re not sure where to start, a risk assessment ranks them by impact and cost, or book a free intro call.

This checklist is a practical starting point, not a complete security program or legal advice.