Cybersecurity Checklist for Nonprofits: How to Protect Your Organization and Donor Data

Nonprofits are increasingly targeted by cyber attacks due to limited resources and valuable donor data. Most organizations should implement at least 6–8 core cybersecurity protections, including multi-factor authentication, secure backups, and employee training, to reduce risk and protect sensitive information.

1. Secure User Access and Authentication

• Enable Multi-Factor Authentication (MFA) on all systems
• Use strong password policies and password managers
• Limit access based on roles (least privilege)
• Remove access immediately for former employees

2. Protect Devices and Systems

• Install Endpoint Detection & Response (EDR)
• Keep all systems updated with security patches
• Use antivirus and advanced threat protection
• Secure laptops and remote devices

3. Backup and Disaster Recovery

• Perform daily automated backups
• Store backups offsite or in the cloud
• Test recovery processes quarterly
• Maintain a recovery time objective (RTO) under 24 hours

4. Email and Phishing Protection

• Use advanced email filtering tools
• Train staff to recognize phishing emails
• Enable spam and malware protection
• Conduct simulated phishing tests

5. Protect Donor and Financial Data

• Encrypt sensitive data at rest and in transit
• Use secure platforms for donations and payments
• Restrict access to donor databases
• Regularly audit data access and usage

6. Employee Training and Security Awareness

• Conduct annual cybersecurity training
• Educate staff on phishing and social engineering
• Establish clear IT security policies
• Encourage reporting of suspicious activity

7. Ongoing Monitoring and Risk Management

• Implement 24/7 system monitoring
• Run regular vulnerability scans
• Perform periodic penetration testing
• Maintain an incident response plan

If your organization is reviewing IT providers, see our guide on what to look for in an IT provider .

You can also explore how to budget for IT services in our nonprofit IT cost guide .

Our Experience Supporting Nonprofits

We work with nonprofit organizations to improve cybersecurity, reduce risk, and align IT strategies with budget and mission requirements. Our approach ensures technology supports your organization—not disrupts it.