Cybersecurity Starter Kit: Section 2
In this section, you’ll learn to:
Section 2: Decide who is responsible
Once you know what needs protection, decide who will make decisions, take action and follow up.
In a small nonprofit, security tasks often fall informally to whoever is comfortable with technology. That person can make a valuable contribution, but they need clear expectations, support and someone to turn to when a decision is beyond their authority.
You do not need a dedicated IT team to establish these arrangements. Begin with the people already involved in your organization and agree on what each person will handle.
Separate decisions from tasks
Being responsible for a security decision does not mean personally carrying out every technical task.
For example, an executive director might approve the use of a password manager, an operations coordinator might organize its introduction, and a provider might help configure it. Staff and volunteers would then follow the agreed process for using it.
Four functions need to be covered:
Approve decisions
Set expectations, approve resources and resolve issues that affect the organization.
Who might handle it: Executive director or another authorized leader; board involvement where appropriate
Coordinate Safeguards
Track agreed actions, maintain documentation and bring gaps to leadership’s attention.
Who might handle it: Operations lead, administrator or designated coordinator
Carry Out Tasks
Manage settings, update devices, adjust access or check backups.
Who might handle it: Staff member, qualified volunteer or service provider
Report Concerns
Raise suspicious activity, mistakes and difficulties following agreed practices.
Who might handle it: Everyone, through a clearly identified contact
One person may cover several functions. The important point is that they understand their role and have the authority, time and support to fulfil it.
Be specific about what people handle
A broad assignment such as “Sam handles cybersecurity” leaves too much open to interpretation. Describe the work and the limits of the role.
For providers and volunteers, confirm what is included, what is excluded and when help is available. Record these arrangements so others can find them.
Vague assignment
Clear assignment
Plan for absence and turnover
Your organization should be able to continue essential work when someone is away or leaves.
For important accounts and services:
– Identify a backup person and explain when they should step in.
– Document where instructions and trusted support contacts are kept.
– Confirm that organizational accounts have appropriate ownership and recovery arrangements.
– Arrange handover before removing a departing person’s access.
– Give each person the access needed for their role; backup coverage does not require unrestricted access to everything.
Avoid relying on one person’s memory, personal inbox or personal device as the only route to essential information.
Turn responsibilities into clear rules
Responsibilities explain who does the work. Policies explain what your organization expects. Procedures describe how people carry out those expectations.
Policy
What do we require?
Access to client information is limited to people who need it for their work.
Responsibility
Who approves, implements and checks it?
The program manager approves access; the account administrator applies it.
Procedure
How do we carry it out?
Request access through the program manager and review it when someone leaves or changes roles.
A useful policy can be short and written in everyday language. It should be specific enough that people know what to do and realistic enough that they can follow it.
Begin with the priorities from your inventory. Later sections of this kit will help you develop expectations for account protection, information handling, backups and incident response.
A short policy example
Access to client information
Purpose
Protect client information while allowing authorized people to deliver services.
Scope
This policy applies to staff, volunteers and contractors who access the organization’s client information.
Requirements
Access must be approved by the program manager and limited to what the person needs for their role. Client information must be kept in approved locations. Changes in duties or departures must be reported promptly so access can be adjusted or removed.
Responsibility
The program manager approves access and checks whether it remains appropriate. The account administrator applies approved changes. Anyone who notices inappropriate access or sharing reports it promptly to the designated contact.
Exceptions
Any exception must be approved by the executive director or authorized delegate, with the reason, protective measures and expiry or review date recorded.
Review
Review the policy at least annually and when relevant systems, services or responsibilities change.
Make policies workable
Before approving a rule, check whether people can reasonably follow it.
If you require MFA, people need a workable setup and recovery process. If you prohibit storing client files on personal devices, provide an approved way to access those files. If staff must report concerns, make the contact details easy to find.
Introduce policies during onboarding, explain why they matter and use examples relevant to people’s work. Give staff and volunteers a way to ask questions and flag practical difficulties.
Encourage prompt reporting of mistakes. Someone who attaches the wrong file or approves an unexpected sign-in request should know whom to contact immediately, even if they are uncertain about what happened.
If a rule is regularly bypassed, investigate the reason. The organization may need clearer instructions, different tools, additional support or a revised rule.
Agree who does what
Return to the three priorities you chose in Section 1. For each one, record an answer for each priority in each section.
Discuss the assignments with the people named. Confirm that they understand and accept the work, know its limits and have the support to do it.
Then choose one priority that needs a written rule.
Draft your first policy
Use these prompts on the worksheet to prepare a short draft.
Before putting it into use, ask someone affected by the policy to read it. Can they explain what they need to do? Do they have what they need to comply?
Your takeaway
By the end of this section, you should have:
- Agreed responsibilities for your first three priorities.
- Backup coverage for essential tasks and decisions.
- A clear reporting contact and an alternative if they are unavailable.
- One short policy draft, with a plan for approval and introduction.
Next, you will look at multifactor authentication—one of the safeguards you can use to protect your organization’s accounts.
Section 3: Protect accounts with multi-factor authentication
Your nonprofit’s accounts connect people to email, files, finances and essential services. Protecting those accounts helps protect everything accessible through them.
English 
French 
Chinese 
Spanish 
Ukrainian 
