What Should Nonprofits Include in a Cybersecurity Incident Response Plan?

A nonprofit cybersecurity incident response plan should explain how the organization will identify, contain, investigate, communicate about, and recover from a cyberattack. The plan should assign responsibilities, protect donor and program data, preserve evidence, establish backup recovery procedures, and document notification requirements.

For nonprofits with limited internal technology resources, a documented response plan can reduce confusion, shorten downtime, and help staff continue delivering mission-critical services during a cybersecurity incident.

Why Nonprofits Need an Incident Response Plan

Nonprofits often maintain sensitive donor records, payment information, employee data, grant documentation, and information about the communities they serve. A ransomware attack, compromised email account, or stolen device can disrupt operations and damage stakeholder trust.

An incident response plan gives leadership, staff members, vendors, and IT providers a coordinated process to follow when an incident occurs.

1. Define Incident Response Roles

The plan should identify who is responsible for making decisions and coordinating the response.

• Executive leadership
• IT support or managed service provider
• Legal counsel
• Communications staff
• Insurance provider
• Program and operations leadership

Primary and backup contacts should be documented in case a key person is unavailable.

2. Establish a Process for Reporting Incidents

Employees and volunteers should know how to report suspicious activity immediately.

• Unexpected multi-factor authentication prompts
• Suspicious emails or payment requests
• Missing or encrypted files
• Lost or stolen devices
• Unauthorized account access
• Unusual system behavior

Reporting procedures should be simple, clearly communicated, and included in employee security training.

3. Contain the Threat

Once an incident is identified, the organization should take steps to limit further damage.

• Disconnect affected devices
• Disable compromised accounts
• Reset exposed credentials
• Block malicious activity
• Preserve security logs
• Contact the organization’s IT provider

Staff members should avoid deleting files or resetting systems until the technical response team has preserved necessary evidence.

4. Protect Donor, Program, and Grant Information

The response team should determine what information may have been accessed or exposed.

• Donor contact information
• Payment and financial records
• Employee information
• Program participant data
• Grant documentation
• Passwords and account credentials

The organization should also review contractual, insurance, grant, and legal notification obligations with qualified advisors.

5. Restore Systems from Verified Backups

Reliable backups are essential for recovering from ransomware, hardware failure, accidental deletion, and other disruptions.

• Confirm backups are not infected
• Prioritize mission-critical systems
• Restore data in a controlled environment
• Test applications before returning them to service
• Monitor systems for recurring threats

Backups should be encrypted, monitored, stored separately from production systems, and tested regularly.

6. Communicate with Stakeholders

The plan should establish who communicates with employees, donors, board members, vendors, insurance carriers, and other affected parties.

• Approved communication templates
• Internal notification procedures
• Board communication responsibilities
• Donor and community messaging
• Media response procedures

Communications should be accurate, coordinated, and reviewed by appropriate legal or compliance professionals when necessary.

7. Review the Incident and Improve Security

After recovery, leadership should conduct a post-incident review.

• Identify the root cause
• Document actions taken
• Evaluate response times
• Update policies and procedures
• Improve employee training
• Address unresolved vulnerabilities

Lessons learned should be incorporated into future planning, budgeting, and security improvements.

How Our Compliance Package Helps

Incident response planning works best when it is supported by ongoing cybersecurity management.

Our compliance package helps nonprofits identify and reduce risk through:

• Compliance management assistance
• Vulnerability scanning
• Penetration testing
• Risk assessments
• Security documentation
• Strategic technology guidance

These services help organizations prepare before an incident occurs and improve their ability to respond effectively.

Our Experience Supporting Nonprofits

1-UP IT Consulting helps nonprofits throughout Frederick, MD and surrounding areas strengthen cybersecurity, protect donor information, manage technology costs, and align IT decisions with organizational missions and grant requirements.