Section 8: Ask vendors the right questions
In this section, you’ll learn to:
Asking vendors the right questions
Your nonprofit may rely on other organizations for email, cloud storage, fundraising, accounting, website hosting or technical support. These services can provide capabilities your team could not manage alone.
They also become part of your security arrangements. Choosing a provider means understanding what they protect, what your organization must do and how you will get help when needed.
You do not need to conduct a technical audit. Start with clear questions about the information, access and services involved.
Know which providers matter most
A vendor or service provider could be a software company, consultant, contractor or organization managing a service on your behalf. Include free and donated services in your review.
Use your inventory to prioritize providers that:
The level of review should reflect the possible impact. A tool used to create public event graphics needs different consideration from a platform holding confidential client records.
Understand shared responsibility
A provider may protect its infrastructure while your nonprofit remains responsible for permissions, account recovery and how information is shared.
For example, a cloud service could offer MFA and restricted sharing, but your organization may need to enable those features and decide who receives access. Ask: “What do you manage, what do we need to manage, and where is that documented?”
For technical support, clarify whether the agreement includes security updates, access reviews, backup checks and incident assistance. General “IT support” does not establish that every security task is covered.
Use a practical vendor checklist
Ask for answers in plain language and, where possible, confirmation in service documentation or the agreement.
|
Question to ask
|
Why it matters
|
What to clarify
|
|---|---|---|
|
What information will you receive or access? |
Helps you assess whether the service is appropriate for the information involved. |
Include uploaded files, connected accounts and access by support personnel. |
|
How can we protect sign-ins and control access? |
Your team needs workable account safeguards. |
MFA, individual accounts, administrator permissions and removal of access |
|
How will our information be used? |
Delivering the service may not be its only use. |
Advertising, analytics, AI model training and any relevant opt-outs or restrictions |
|
Where is information stored, and which other companies help process it? |
Other locations and providers may affect your privacy and contractual requirements. |
Available choices and how changes are communicated; Canadian storage alone does not establish security or compliance. |
|
What can be recovered after deletion, damage or an account problem? |
Recovery features vary considerably. |
Backup coverage, recovery limits, restore testing, time required and additional charges |
|
How will you notify us of an incident affecting our information or service? |
Your organization may need to take action quickly. |
Contact method, notification commitments and the information you will receive |
|
What help is available if we have an incident? |
Ordinary support may not include incident investigation or recovery. |
Support hours, emergency contacts, responsibilities and costs |
|
Can we export our information in a usable format? |
You may need to change providers or continue working elsewhere. |
What an export includes and whether it preserves information needed for your work |
|
What happens when the service ends? |
Closing an account may not immediately remove all stored information. |
Access removal, deletion, retained backups and confirmation of disposal |
|
Which safeguards cost extra? |
Essential features may depend on the plan. |
MFA administration, access controls, backups, support and nonprofit pricing |
Keep the information you provide proportionate
A vendor may ask about your systems to prepare a proposal or provide support. Share what is necessary through an appropriate channel.
For an initial discussion, you can usually describe your needs without sending actual client records, passwords or a complete list of internal security arrangements.
Before granting technical access:
- Confirm the person and the work through your established contact route.
- Agree what they may access and change.
- Use individual, limited access where supported.
- Set an end date or review point.
- Remove access when the work is complete.
Avoid giving unrestricted access simply because it is convenient.
Understand claims about security
You may encounter phrases such as “bank-level security,” “fully secure” or “privacy compliant.” Ask what those claims mean for the service you will use.
Certifications and independent assessments can provide useful evidence, but check:
- What service or part of the organization was assessed.
- Whether the evidence is current.
- What it actually covers.
- Which responsibilities remain with your nonprofit.
A certification does not guarantee that an incident cannot happen. Encryption is useful, but it does not answer every question about access, use, recovery or deletion.
The goal is to connect the provider’s assurances to your actual needs.
Work with the tools you already have
Review existing services before buying new ones. You may already have useful protections that are not enabled or included features your team has not explored.
Free and discounted nonprofit plans can be valuable. Check their limits and what happens if eligibility, pricing or terms change.
Also review services introduced informally by staff or volunteers. A useful tool can become an organizational dependency even when nobody approved its use or recorded who controls the account.
Use a practical vendor checklist
Ask for answers in plain language and, where possible, confirmation in service documentation or the agreement.
|
Finding
|
A practical response
|
|---|---|
|
A useful safeguard exists but is not enabled. |
Assign someone to enable it and confirm that it works. |
|
A feature is available only on another plan. |
Assess whether the benefit justifies the cost or whether another arrangement meets the need. |
|
Recovery is limited. |
Decide whether additional backups or another service are needed. |
|
The provider cannot explain how sensitive information is handled. |
Seek clarification and avoid uploading that information while the question remains unresolved. |
|
The service cannot meet an important requirement. |
Consider another provider or a different way to perform the work. |
Record the decision, any remaining gap and who will follow up. Leadership should approve significant unresolved risks rather than leaving an individual staff member to make that decision alone.
Plan for changes and service endings
Keep organizational ownership, billing contacts and recovery details current. Essential services should not depend solely on a departing person’s personal account.
Before ending a service:
- Export and check the information you need.
- Transfer necessary work and access.
- Remove integrations and provider access that are no longer required.
- Confirm cancellation, retention and deletion arrangements.
Review providers when your use changes. For example, when a tool previously used for public communications begins holding client information. Important changes to the provider’s terms, features or ownership may also warrant a review
A suggested policy rule
Services used for organizational work must be approved at a level appropriate to their access, information handling and operational importance. Responsibilities, account ownership, support and exit arrangements must be recorded. Providers must receive only the access and information needed for approved work. Significant gaps must be referred to the designated decision-maker.
Before adopting this rule, identify who approves services, where agreements are kept and who reviews provider arrangements.
Review one important provider
Choose a provider from your inventory that holds sensitive information or supports an essential service.
Use the full checklist when selecting a new service or reviewing an important existing one.
Your takeaway
By the end of this section, you should have:
- Identified the providers most important to your information and operations.
- Clarified shared responsibilities and support arrangements.
- Recorded gaps and decisions requiring follow-up.
- Checked that your organization can maintain access and retrieve its information.
Next, you will prepare for incidents: who to contact, how to limit harm and how to assess whether others need to be notified.
Section 9: Respond to incidents and assess notification needs
An incident-response plan helps your nonprofit respond quickly to security incidents by outlining responsibilities, key contacts and immediate actions to protect people and maintain essential operations.
English 
French 
Chinese 
Spanish 
Ukrainian 