Cybersecurity Starter Kit: Section 1
In this section, you’ll learn to:
Know what you need to protect
Before choosing security tools or changing settings, take stock of what your nonprofit relies on. This includes information, accounts, devices and services as well as the people who depend on them.
You do not need a technical assessment to begin. A conversation with the people who manage your programs, administration, finances and communications can reveal what matters most and where there are gaps.
Look beyond computers
Your website and office laptops may come to mind first, but important information and access can be spread across many places.
Information
Client records, donor details, volunteer applications, payroll, banking information, grant documents, photographs and consent forms
Accounts
Email, online banking, social media, website administration, fundraising platforms and shared cloud storage
Devices
Organization-owned laptops, staff phones used for work, shared tablets, external drives and equipment used by volunteers
Services
Internet access, payment processing, accounting software, scheduling systems and tools used to deliver programs
Access and Recovery information
Administrator accounts, account recovery contacts, MFA recovery codes and password-manager access
Include personal devices and accounts when they are used for organizational work. For example, a volunteer may manage your social media through a personal account, or a staff member may keep program files on their own laptop. Identifying these arrangements helps you plan appropriate protection and handover.
Ask four questions:
1. What is it, and why do we need it?
2. Where is it, and who can access it?
3. Who is responsible for it?
4. What would happen if it were exposed, changed, lost or unavailable?
This question helps you decide what to address first. A public event flyer and a confidential client file require different levels of protection.
Consider the impact on people
Information can be sensitive because of what it reveals about someone, not just because it includes a credit card number or password.
A client’s connection to a particular service, their location, a photograph or details about their circumstances could cause harm if disclosed. An exposed mailing list could reveal who receives support from your organization.
Ask:
- Could disclosure put someone’s safety or privacy at risk?
- Could incorrect information affect a payment, a service decision or someone’s access to support?
- Could losing access interrupt an essential program?
- Could an account be used to impersonate your organization or request money?
Consider accidental events too. A file sent to the wrong recipient, an incorrectly shared folder or an overwritten record can have serious consequences even when nobody intended harm.
Identify your priorities
You do not need to give every item equal attention. Start with the information and systems whose compromise would have the greatest impact.
Common priorities include:
- Sensitive personal information, especially information about clients or people in vulnerable circumstances.
- Financial accounts and records, including banking, payroll and payment approvals.
- Email and administrator accounts, which may provide access to other accounts or allow changes to organizational systems.
- Essential program information and services, particularly those needed to keep delivering support.
Also look for dependence on a single person. If only one volunteer can access your website, or account recovery messages go to a former employee, your organization may struggle to regain access even without a cyberattack.
Create a protection inventory
Use the worksheet below to record your most important items. Start with five to ten; you can expand it over time.
Record where credentials are managed, but do not put passwords, recovery codes or sensitive client information in this worksheet. Limit access to the completed inventory because it describes your organization’s systems and responsibilities.
If you do not know an answer, write “to confirm” and assign someone to check. An unanswered question is a useful finding.
Check whether you still need it
As you build the inventory, ask whether your organization still needs each account, copy of a file or piece of personal information.
An unused account, an old download or unnecessary information creates something else to manage and protect. Before deleting records, check applicable retention requirements and organizational commitments. For accounts you close, first confirm that important files, ownership and connected services have been transferred.
Your takeaway
By the end of this section, you should have:
- A starting inventory of your important information, accounts, devices and services.
- A responsible person for each priority item.
- Three priorities to address first.
- A short list of questions that need follow-up.
Next, you will turn those priorities into clear responsibilities, so important safeguards do not depend on everyone assuming someone else is taking care of them.
Section 2: Decide who is responsible
Once you know what needs protection, decide who will make decisions, take action and follow up.
English 
French 
Chinese 
Spanish 
Ukrainian 