Introducing Cyber Duty: Free Cybersecurity Oversight Guide for Nonprofit Board Members

November 12, 2026November 12, 2026

When was the last time cybersecurity came up at your nonprofit’s board meeting?

Serving on a nonprofit board without pay does not, by itself, remove your legal responsibilities as a director. Under Ontario’s Not-for-Profit Corporations Act and the federal Canada Not-for-profit Corporations Act, directors are expected to act in their organization’s best interests and exercise reasonable care, diligence, and skill. Cybersecurity oversight is one application of these broader governance responsibilities.

Boards regularly discuss budgets, fundraising, programs, and organizational risks. But cybersecurity can be overlooked, even though a cyber incident could affect an organization’s finances, essential services, confidential information, and community trust.

To help nonprofit directors navigate these responsibilities, KnowledgeFlow Cybersafety Foundation has introduced Cyber Duty: A Cybersecurity Oversight Guide for Nonprofit Board Members.

This free resource helps board members understand what cybersecurity oversight looks like and how to incorporate it into their existing governance responsibilities.

You Don’t Need to Be a Cybersecurity Expert

Many nonprofit board members serve as volunteers, and not every organization has access to dedicated IT staff or cybersecurity specialists.

Cyber Duty recognizes these realities and explains that directors don’t need to manage technology themselves. Instead, they should understand significant risks, ask informed questions, support appropriate safeguards, and follow up on important concerns.

Practical Tools for Your Next Board Meeting

Cyber Duty goes beyond explaining responsibilities. It includes four ready-to-use tools to help nonprofit boards put oversight into practice:

A Board Discussion Guide
A Cyber-Risk Report template
An Annual Cybersecurity Oversight Calendar
A Cyber Incident Escalation Checklist

Whether your organization is reviewing its existing safeguards or discussing cybersecurity for the first time, these tools provide a practical starting point.