Cybersecurity Starter Kit
Cybersecurity doesn’t have to be complicated. This starter kit helps nonprofits understand the basics, protect their people and information, and take practical steps toward a safer digital environment.
Cybersecurity: protecting your people, information and mission
Your nonprofit already makes decisions about trust and safety: who can access client records, who approves payments and what happens when a staff member leaves. Cybersecurity extends that care to the digital tools and information your organization relies on.
You do not need to become a technical expert to participate in these decisions. Understanding a few core ideas can help you ask useful questions, choose practical safeguards and explain your approach to donors, staff, volunteers and clients.
Start Where you left off
What is cybersecurity?
Cybersecurity is the practice of protecting digital information, accounts, devices and services from unauthorized access, misuse, disruption, and accidental loss, damage or disclosure.
For a nonprofit, that might mean protecting donor records, keeping client information confidential, preventing someone from taking over your email account, or ensuring that essential program files can be recovered if a laptop fails. It also means reducing the chance of everyday mistakes, such as a well-meaning volunteer exposing an email distribution list or attaching the wrong file to a message.
Security professionals often describe three goals:
Confidentiality
Information is accessible only to people authorized to see it.
Example for non-profits: Only staff who need client records can access them.
Integrity
Information remains accurate, and changes are authorized.
Example for non-profits: A supplier’s banking details cannot be changed without verification.
Availability
Information and services are accessible when needed.
Example for non-profits: Staff can recover essential files and continue delivering programs after a disruption.
How are cybersecurity and privacy connected?
Security asks: How do we protect this information from unauthorized access, loss or misuse?
Privacy asks: Should we collect this personal information? What will we use it for? Who will receive it? How long should we keep it?
For example, a securely protected registration form could still collect more personal information than a program needs. Good privacy practices help an organization make appropriate decisions about information; good security practices help protect it. Canadian privacy guidance addresses both the handling of personal information and the safeguards used to protect it.
“ You can have security without privacy but you can’t have privacy without security”
How is cybersecurity done?
Cybersecurity combines people, processes and technology:
People
Staff and volunteers know how to verify requests, handle important information and report concerns about cybersecurity.
Processes
The organization has clear routines for approving payments, managing access, backing up files and responding to incidents.
Technology
Tools and settings such as multi-factor authentication, automatic updates and access permissions support those routines.
These protections work together. A strong password helps protect an account; multifactor authentication adds another safeguard; a clear reporting process helps the organization respond if something unusual happens.
Security is also an ongoing activity. Accounts change, people join and leave, and organizations adopt new tools. A useful routine is to identify what matters, put safeguards in place, check that they work and adjust when circumstances change.
A “security control” is simply a safeguard that reduces risk. It could be a setting, a written procedure or a habit, such as calling a known contact to verify a request to change banking details.
Understanding the cybersecurity industry
The cybersecurity industry includes people who design secure systems, manage risk, assess safeguards, train staff, investigate incidents, and help organizations recover. Privacy professionals focus on handling personal information responsibly and meeting privacy obligations.
An IT provider may maintain your computers and software, while a security specialist assesses how well they are protected. Some providers do both. When discussing services, ask what is included, what remains your organization’s responsibility and who will help if something goes wrong.
You may also hear about certifications, standards and frameworks:
Professional Certifications
A credential held by an individual. For example, ISC2’s Certified in Cybersecurity (CC) covers foundational knowledge, while its Certified Information Systems Security Professional (CISSP) requires relevant professional experience.
Standard or framework
A structured way to organize security practices and assess gaps. These resources help organizations plan improvements.
Organizational Certification
An assessment against specified requirements. For example, ISO/IEC 27001 certification concerns an organization’s information security management system.
Credentials can be useful, but they should be considered alongside relevant experience, the scope of the work and the provider’s ability to explain recommendations clearly. A certification is not a promise that an incident can never happen.
You do not need a professional certification to start improving your nonprofit’s security. Formal requirements may arise through contracts or other obligations, but many everyday improvements begin with decisions your team can make now.
Standards and frameworks help organizations turn broad security goals into specific safeguards and identify gaps. Examples include the Canadian Centre for Cyber Security’s baseline guidance for small and medium organizations and the CIS Critical Security Controls. You can use these resources to guide improvements without pursuing formal certification.
This starter kit introduces practical safeguards that appear across established security guidance. It is a starting point, rather than a complete assessment against a particular standard. As your nonprofit’s needs develop, these resources can help you decide what to address next.
Talking about security with confidence
Clear, specific explanations are more useful than broad promises such as “our systems are completely secure.” Describe the practices your organization actually follows:
We limit access to our donor records that only the people who need them can see them.
If a message or request seems unusual, here is how to verify it and report a concern.
We can explain why we collect your information and where to ask questions.
Use these statements only when they accurately describe your practices. If a safeguard is still being developed, explain what you are improving rather than implying it is already in place.
Section 1: Know what you need to protect
Before choosing security tools or changing settings, take stock of what your nonprofit relies on. This includes information, accounts, devices and services as well as the people who depend on them.
Section 2: Decide who is responsible
Once you know what needs protection, decide who will make decisions, take action and follow up.
Section 3: Protect accounts with multi-factor authentication
Your nonprofit’s accounts connect people to email, files, finances and essential services. Protecting those accounts helps protect everything accessible through them.
Section 4: Make passwords manageable
Nonprofits need strong, unique passwords and effective account access management to keep information secure and ensure continuity when staff are away or leave.
Section 5: Keep devices and access secure
Protecting your nonprofit’s devices starts with understanding built-in security features, why they matter, and who is responsible for ensuring they are enabled and maintained.
Section 6: Protect sensitive information
Protecting your nonprofit’s information means managing how it is collected, stored, used, shared and deleted to prevent accidental loss, exposure or unauthorized access.
Section 7: Back up and practice recovery
Backups help your nonprofit recover important information after data loss, device failure or cyberattacks by ensuring recoverable copies are available and someone is responsible for restoring them.
Section 8: Ask vendors the right questions
Protecting your nonprofit when using third-party services means understanding each provider’s security responsibilities, managing access and information, and knowing how to get support when needed.
Section 9: Respond to incidents and assess notification needs
An incident-response plan helps your nonprofit respond quickly to security incidents by outlining responsibilities, key contacts and immediate actions to protect people and maintain essential operations.
Section 10: Protect your nonprofit from scams and fraud
This section builds on the safeguards you’ve learned to help protect your nonprofit’s information, accounts, and funds from cybercriminals who use deception to persuade people into taking unsafe actions.
English 
French 
Chinese 
Spanish 
Ukrainian