If you lead a mission-driven nonprofit, you already know this truth: trust is part of the service. Clients share details they may not even tell family. Donors trust you with payment data and private intent. Staff store case notes, benefits documents, safety plans, and court records while juggling too much work.
A cyber incident doesn’t just “hit IT.” It can expose a survivor’s location. It can freeze payroll. It can knock your intake channels offline for days and push the people you serve back into crisis.
This Nonprofit Cybersecurity Plan for Mission-Driven Nonprofits. A Practical 90-Day Launch Plan is built for small teams, shared roles, and tight budgets. It’s not about perfection. It’s about calm execution you can explain to staff, a board, and a funder.
Key takeaways from this 90-day cybersecurity launch plan
- By day 90, you’ll have one named security owner with clear decision rights, so work doesn’t stall in committee.
- You’ll reduce account takeovers by turning on multi-factor authentication (MFA) where it matters most, starting with email and finance.
- You’ll replace shared logins with accountable access, which makes offboarding faster and investigations possible.
- You’ll set “minimum safe” device standards (updates, encryption, remote wipe), including a clear stance on BYOD.
- You’ll run one staff training that fits real workflows and creates a no-blame reporting habit.
- You’ll have a short incident plan and one tabletop practice, so the first real incident isn’t your first rehearsal.
- You’ll test backups and produce a one-page snapshot that’s board-ready and funder-friendly.
Before day 1, pick what you will protect and who owns the work
Cybersecurity collapses when it becomes a side project. The fix isn’t a bigger checklist. It’s clarity: what you’re protecting, what “good enough” means right now, and who is accountable for moving it forward.
Think of this like a smoke alarm. You don’t need a custom fire station. You need something that works, gets tested, and has a clear response when it goes off.
One “stop doing this” that creates capacity fast: stop treating security decisions as everyone’s job. Shared ownership feels fair, but it usually means nothing gets decided. Name an owner, then support them.
A fast starting point for nonprofit-specific scoping is to map where client data actually travels: intake forms, email, shared drives, case management, partner referrals, and staff devices. If you want a structured way to do that, use a tool for mapping client data risks so you can prioritize based on harm, not noise.
Name a security owner and set decision rights
Pick one accountable owner. Not a committee. This can be an ops leader, a finance leader, a program leader with strong follow-through, or an IT manager if you have one. The title matters less than the ability to drive action.
Give that person decision rights for:
- Enforcing MFA and password manager use
- Approving access to sensitive systems
- Setting minimum device requirements
- Triggering incident response steps
Keep leadership involved without turning it into a weekly debate. A simple cadence works:
- 15 minutes weekly (owner, ED or COO, and IT vendor or internal IT)
- Track: top 5 risks, current blockers, next 7-day actions, and any incidents or near misses
Do a fast risk picture in one meeting: systems, data, threats, impact
In one 60-minute meeting, build a simple list:
Top systems: email, file storage, case management, finance and payroll, HR, phones, website forms.
Top data: client IDs and documents, case notes, donor payment data, staff HR files, partner referral details.
Top threats: phishing, ransomware, vendor compromise, deepfake payment fraud, shadow AI use (staff pasting sensitive text into tools they shouldn’t).
Rate impact as High, Medium, or Low. Then pick the top 5 risks to drive the next 90 days. If you need a reference model for what “controls” look like at a high level, skim the NIST Cybersecurity Framework 2.0. You don’t need to implement everything. You need to choose.
Days 1 to 30, lock down accounts and devices with the highest impact basics
Most real-world incidents start the same way: a stolen password, a fake login page, or a convincing email sent to a tired human.
So start with identity and access. This is where you get fast risk reduction without a giant project plan.
Turn on MFA, remove shared logins, and fix risky admin access
Prioritize MFA in this order:
- Email (because it resets everything else)
- Finance and banking portals
- Case management and client-facing platforms
- Password manager
- Cloud file storage
If you only do one thing this month, do email MFA. It blocks a huge slice of account takeovers.
Next, remove shared logins. Shared accounts break accountability and slow you down during offboarding. They also make it hard to prove what happened when something goes wrong.
Set a simple rule for admin rights:
- Admin access is for a few named people
- It’s time-limited when possible
- It’s documented in a basic access list (even a spreadsheet beats nothing)
Deepfake payment fraud is now a real risk for finance teams. A caller can sound like your ED, a board treasurer, or a partner. MFA helps, but you also need a call-back rule: payment changes and new wire instructions get confirmed using a known number from a saved contact, not the number in the email.
If vendors support your systems, tighten their access early. Use a checklist for tightening vendor access and offboarding so you don’t discover, six months later, that a former contractor can still log in.
Set minimum device standards: updates, encryption, remote wipe, endpoint protection
Leaders don’t need to know every device detail. You do need a short “minimum safe” checklist you can ask for and verify:
Minimum device standards
- Auto-updates turned on (OS and browsers)
- Full-disk encryption on laptops
- Screen lock after short idle time
- Mobile devices protected with PIN or biometrics
- Ability to remote wipe lost or stolen devices
- Antivirus or endpoint protection installed and reporting
BYOD is fine only if it meets the same minimums. If you can’t enforce those basics, don’t let personal devices touch client data. That’s not harsh. It’s a safety boundary.
For practical ransomware guidance aimed at real organizations, CISA’s Stop Ransomware resources are worth bookmarking.
Days 31 to 60, build repeatable habits: training, incident response, and vendor checks
By now you’ve done the highest-impact basics. The next risk is backsliding. People revert under pressure, especially when intake is spiking or a grant report is due.
So days 31 to 60 are about habits. Simple routines that keep working when no one has extra time.
Run one short staff training that people will actually use
Do one 60-minute session. Keep it concrete and tied to your work.
A practical agenda:
- How phishing works now (including “reply chain” and vendor spoofing)
- Deepfake voice tricks and payment change scams
- Safe handling of client documents (email, shared drives, printing)
- How to report fast (and what to include)
- A clear no-blame promise for reporting mistakes quickly
Add 10-minute role-based add-ons:
- Finance: payment changes, gift cards, bank details, call-back rules
- Intake and legal staff: safe data sharing, partner referrals, identity proofing basics
- Leadership: account recovery steps, comms decisions, and what to delegate
If you need training that also creates clean evidence for audits, funders, or cyber insurance questionnaires, consider simple staff training with proof for funders or audits.
For additional public guidance on spotting and reporting internet crime patterns, the FBI’s IC3 resource hub is a solid reference.
Write a small incident response plan and practice a tabletop
Keep the plan to 2 to 3 pages. Long plans don’t get used.
Include:
- Who declares an incident (and who is backup)
- Who calls the IT vendor, bank, and cyber insurer (if applicable)
- First steps for email takeover (reset sessions, MFA check, rules review)
- First steps for ransomware (isolate devices, preserve evidence, restore plan)
- What must keep running to serve clients (phones, intake, case access)
Then run a 45-minute tabletop. Pick one scenario: “ED email account taken over” or “ransom note on shared drive.”
Success looks like this: you can contain in hours, not days, and everyone knows who decides what.
If you want a plain-language breach response checklist, the FTC’s data breach response guide is helpful for framing actions and communications.
Days 61 to 90, prove you can recover, then make it board and funder ready
Security that can’t recover is just anxiety with extra steps. The goal is to keep serving people, even when something goes wrong.
Days 61 to 90 are about proof. Not promises.
Test backups and recovery for your most important data
Backups sound simple until you try to restore under pressure.
Use the 3-2-1 idea in plain language:
- 3 copies of important data
- 2 different storage types or locations
- 1 copy kept separate from daily access
Test three things:
- Restore one file
- Restore one shared folder
- Confirm who can do it, and how long it takes
If you use cloud tools, consider cloud-to-cloud backup where it fits. It can help with ransomware, accidental deletion, and account compromise. The key is not the brand. It’s the ability to restore quickly without begging a vendor for days.
Vendor incidents also matter here. If a case management vendor gets hit, your program still needs a response plan. A structured tool for creating a vendor incident response plan helps you set expectations in advance, including notification timelines and access controls.
Create a one-page security scorecard and a 12-month next steps list
Your board doesn’t need a 40-page report. They need a snapshot they can understand and defend.
Include 6 to 10 metrics:
- MFA coverage (% of staff accounts protected)
- Device encryption coverage
- Patch status (are auto-updates on)
- Training completion rate
- Last backup test date and restore time
- Vendor list reviewed (yes/no, date)
- Offboarding time (goal and current average)
- Open High risks (count and plain-language summary)
Then list next-quarter steps (3 to 5 items):
- Centralize logging for key systems
- Basic device management for laptops and phones
- Stronger vendor clauses for breach notice and MFA
- Quarterly tabletop practice
FAQs about launching a cybersecurity program for mission-driven nonprofits
What if we do not have an IT team or a security person?
Assign an owner part-time. Give them decision rights and a 15-minute weekly cadence with leadership and your IT vendor. If you use an MSP, make the plan part of their scope, with clear deliverables. Start with a small control set, then expand once the basics stick.
How much does a basic nonprofit cybersecurity program cost?
Often less than leaders fear, especially if you already pay for Microsoft 365 or Google Workspace features that include MFA and admin controls. Costs usually show up in backup tools, device management, security training, and outside help for setup or incident response. The biggest cost is almost always staff time, which is why focus matters.
What are the first security controls we should implement if we can only do three things?
Start with MFA everywhere, a password manager, and tested backups. Those three reduce common attacks fast, and they also make recovery less chaotic when something slips through.
How do we handle vendors that touch client data?
Inventory them, even if the list is messy at first. Ask a short set of questions: do they require MFA, how do they notify you of a breach, who has access on your side, and how do you shut access off when staff leave. Vendor compromise is a common path in, so treat vendor access like an extension of your own front door.
Will this slow down service delivery?
If it’s done well, it should remove friction over time. The early steps can feel annoying, then they become routine. The bigger slowdowns come from incidents, not from MFA.
Conclusion
A 90-day launch isn’t about chasing perfect security. It’s about reducing real harm, protecting the people behind the data, and making sure your services can keep moving when pressure hits.
When ownership is clear, MFA is on, devices meet minimums, and recovery is tested, you’ve done something rare: you’ve turned security from vague worry into operational control.
If you want a calm second set of eyes on your first 90 days, consider booking a clarity call and walking through your top risks, constraints, and next actions. Which single chokepoint, if fixed this quarter, would unlock the most capacity and trust for your staff and community?