Section 5: Keep devices and access secure
In this section, you’ll learn to:
Keeping devices and access secure
The laptops, phones and tablets your nonprofit uses provide access to information, accounts and services. Protecting those devices helps protect the work you do through them.
Many useful safeguards are already built into your devices and software. You do not need to understand every setting to start. The first step is knowing what protections exist, why they matter and who will check that they are being used.
Keep software supported and updated
Updates can fix security weaknesses as well as improve how software works. This applies to operating systems, browsers, apps and security software.
Automatic updates help reduce the chance that important fixes are missed. Some updates still require a restart or someone to complete the installation, so agree who will follow up.
Supported software means its developer still provides relevant updates and security fixes. A device may continue working after support ends, but newly discovered weaknesses may remain unaddressed.
Before accepting donated equipment or continuing to use an older device, check whether it can run supported software. Include replacement or another workable arrangement in your planning if it cannot.
Understand the protections available
Screen lock
Helps prevent someone from accessing a device left unattended. Use a PIN, password or another appropriate unlocking method.
Device encryption
Helps protect stored information if a device is lost or stolen. It is particularly useful when someone could otherwise read the storage without signing in.
Built-in security software
Can detect and block many harmful files or activities. Check that it is active and receiving updates.
Firewall
Helps control network connections to and from a device. Many devices include one.
Separate user accounts
Helps keep each person’s files and access separate on a shared device.
Limited administrator access
Reduces who can install software or make changes affecting the whole device or service.
App permissions
Let you control access to features such as the camera, microphone, location and files. Grant access when it is needed for the app’s purpose.
These safeguards work together. Encryption helps protect a lost device, for example, but does not prevent someone from reading information on a device that is already unlocked.
Start by checking the protections you already have before purchasing additional products.
Only Give people the access they need
People should have enough access to carry out their work. They should not automatically receive access to every folder, account or setting. For example:
You may hear this called least privilege. It means limiting access to what a person needs for their role.
Administrator access deserves particular attention because it can allow someone to change security settings, create accounts or grant access to others. Use it only where needed. Where practical, the person managing a system should use ordinary access for everyday work and administrator access for administrative tasks.
Know what is being installed
New apps, browser extensions and remote-support tools can introduce additional access to your devices and information.
Use a simple approval process before installing tools for organizational work. Confirm:
Remote-support software can be useful, but it may allow another person to see or control a device. Agree who may authorize its use and which providers are approved.
Review tools that are no longer used. Before removing them, confirm that any information or service your organization still needs has been preserved.
Include personal and shared devices
Your nonprofit’s information needs protection wherever it is accessed. Include staff and volunteer devices used for work in your arrangements.
For personal devices:
Agree what organizational work is permitted, what basic safeguards are required and where work information may be stored. People should understand how organizational access and files will be removed when their role ends, while respecting their personal information.
For shared devices:
Use separate user accounts where possible. Avoid leaving files, accounts or password vaults accessible to the next person.
Note: Public or communal computers may provide less control over security. Establish an approved approach before using them for sensitive information or important administrative tasks.
Consider where devices are used
A device can be lost, borrowed or left unlocked at an event, in a vehicle or in a shared office.
Build simple habits into everyday work:
Some devices and management services offer remote locking or erasing. These options may help after a loss, but they need to be arranged in advance and may depend on the device connecting to the internet.
Review access when roles change
Access should change when someone’s responsibilities change, not just when they leave. Plan the timing so important information is retained and the organization can continue working. Include volunteers, contractors and service providers as well as employees.
As part of joining, changing roles or leaving:
Joining
Agree or check: Which device and accounts the person will use, what access they need and who will explain the organization’s rules.
Changing Roles
Agree or check: Which permissions should be added or removed, including access to shared files and administrator functions.
Leaving
Transfer essential work, remove access, recover organizational devices and review shared credentials and recovery arrangements
Assign someone to check
A simple routine is more useful than assuming the protections are in place.
The responsible person does not have to configure everything themselves. They can confirm what is enabled, ask a provider for help and bring unresolved issues to leadership.
Review arrangements when a device is added, someone changes roles, software loses support or your organization adopts a new service. Periodic checks can also identify protections that have been turned off or access that is no longer needed.
A suggested policy rule
Devices used for organizational work must use supported, updated software and appropriate security protections. Access must be approved and limited to what each person needs for their role. New software and remote-support access must follow the organization’s approval process. Lost devices and changes affecting access must be reported promptly.
Before adopting this rule, identify the protections required for your work, who approves access and software, and how people can get help.
Check your device and access arrangements
Choose a few devices or services from your inventory. Record what is already in place and what needs confirmation.
You do not need to resolve every setting during this activity. “To confirm” is a useful answer when it leads to a clear follow-up.
Your takeaway
By the end of this section, you should have:
- Identified the built-in protections your organization can use.
- Assigned responsibility for checking updates and support.
- Reviewed who needs ordinary and administrator access.
- Included personal devices, shared devices and staff changes in your arrangements.
Next, you will look at protecting sensitive information: what you collect, where you keep it, who can use it and when it should be removed.
Section 6: Protect sensitive information
Protecting your nonprofit’s information means managing how it is collected, stored, used, shared and deleted to prevent accidental loss, exposure or unauthorized access.
English 
French 
Chinese 
Spanish 
Ukrainian 