Best Practice Guide to Cybersecurity for Nonprofits

Nonprofit organisations work hard to make a positive difference in their communities, but their mission-driven work can also make them an attractive target for cybercriminals. Charities and community organisations often manage sensitive donor information, employee records, payment details, beneficiary data and confidential communications while operating with limited budgets and small IT teams.

The good news is that effective cybersecurity for nonprofits does not always require a large technology budget. By following practical security measures, training employees and volunteers, protecting important data and creating a clear incident response plan, nonprofits can significantly reduce their cyber risk.

This guide explains the most important nonprofit cybersecurity best practices and provides practical steps Australian charities and other not-for-profit organisations can use to build a stronger and more resilient security programme.

Why Cybersecurity Matters for Nonprofits

Cyberattacks can affect organisations of every size. A common misconception is that cybercriminals only target large corporations with substantial financial resources. In reality, nonprofits can be appealing targets because they may hold valuable information while having fewer cybersecurity resources than larger businesses.

A successful cyberattack can result in financial losses, stolen data, operational disruption, reputational damage and a loss of trust among donors, supporters and the communities a charity serves.

For nonprofits, cybersecurity is therefore more than an IT issue. It is an important part of protecting the organisation’s mission, reputation, people and resources.

Common cybersecurity threats facing nonprofits include:

• Phishing and social engineering attacks
• Ransomware and malware
• Business email compromise
• Stolen or weak passwords
• Unauthorised access to cloud accounts
• Data breaches and information theft
• Fraudulent payment requests
• Compromised employee and volunteer devices
• Unpatched software and systems
• Risks associated with third-party suppliers and service providers

A strong security strategy helps nonprofits identify these risks before they become costly and disruptive incidents.

1. Start With a Cybersecurity Risk Assessment

One of the best ways to improve nonprofit cybersecurity is to understand what needs to be protected.

A cybersecurity risk assessment helps a charity identify its most valuable information, systems, devices, users and potential vulnerabilities. Instead of trying to secure everything at once, nonprofits can prioritise the areas that present the greatest risk.

Start by identifying:

• What sensitive information the organisation stores
• Where donor and financial information is kept
• Which systems are essential to daily operations
• Who has access to sensitive information
• Which employees or volunteers have administrator privileges
• What third-party services have access to organisational data
• Which devices connect to nonprofit systems
• How important data is backed up and recovered
• What security controls are already in place
• Which weaknesses could have the greatest impact

The results of the assessment can become the foundation of a practical cybersecurity plan.

For smaller charities, the process does not need to be complicated. Start with the systems and information that would cause the greatest disruption if they were stolen, unavailable or compromised.

2. Protect Every Important Account With Multi-Factor Authentication

Passwords alone are no longer enough to protect important accounts. Even strong passwords can be stolen through phishing, malware, credential leaks and other attacks.

Multi-factor authentication (MFA) adds another layer of protection by requiring users to verify their identity using an additional factor, such as an authentication app, security key or biometric method.

Nonprofits should prioritise MFA for:

• Email accounts
• Cloud storage platforms
• Financial and accounting systems
• Donor management platforms
• Social media accounts
• Remote access services
• Administrator accounts
• Website management systems
• Online banking and payment platforms

MFA can make it significantly harder for attackers to access an account even when a password has been compromised.

Where possible, use stronger authentication methods for highly sensitive accounts and regularly review who has access to them.

3. Create a Strong Password Policy

Employees, volunteers and contractors should understand how to create and manage secure passwords.

A good nonprofit password policy should encourage users to create long, unique passwords or passphrases and avoid reusing credentials across different services.

Charities should also consider using a reputable password manager. A password manager can help staff create and securely store unique credentials without requiring them to remember dozens of passwords.

Important password practices include:

• Use long and unique passwords
• Never reuse passwords for important accounts
• Avoid predictable personal information
• Use a password manager where appropriate
• Enable MFA whenever available
• Never share passwords through email or messaging platforms
• Change credentials immediately after a suspected compromise
• Remove accounts that are no longer required

Strong password management is one of the simplest ways for a nonprofit to improve its overall security posture.

4. Train Employees and Volunteers to Recognise Phishing

Technology alone cannot prevent every cyberattack. People are an essential part of an organisation’s security defences.

Phishing remains one of the most common ways attackers gain access to accounts and systems. A fraudulent email may appear to come from a manager, donor, supplier, bank or technology provider and ask the recipient to click a link, open an attachment, provide login details or transfer money.

Regular cybersecurity awareness training should teach employees and volunteers how to identify suspicious messages.

Training should cover:

• Unexpected email attachments
• Suspicious links
• Urgent payment requests
• Fake password-reset notifications
• Requests for confidential information
• Unusual messages from executives or managers
• Fake invoices and supplier requests
• Social engineering techniques
• SMS-based phishing, also known as smishing
• Procedures for reporting suspicious activity

Training should be ongoing rather than a once-a-year exercise. Short, regular security reminders can help employees recognise threats as they evolve.

Staff should also feel comfortable reporting a mistake or suspicious message. A culture where people are encouraged to report potential incidents quickly can help limit the damage caused by an attack.

5. Keep Software, Devices and Systems Updated

Cybercriminals frequently exploit known vulnerabilities in outdated software. Failing to install security updates can leave systems exposed even when other security controls are working properly.

Nonprofits should establish a process for keeping operating systems, applications, browsers, plugins, mobile devices, network equipment and other technology up to date.

Where possible, enable automatic security updates for supported devices and applications.

The organisation should also maintain an inventory of its technology. You cannot reliably secure systems that you do not know exist.

Regularly review old computers, unused applications, forgotten cloud services and unsupported software. Removing technology that is no longer required can also reduce the organisation’s attack surface.

6. Use Reliable Antivirus and Endpoint Protection

Every computer and mobile device used for nonprofit business should have appropriate security protection.

Endpoint security tools can help detect malware, suspicious behaviour, unauthorised activity and other threats. Organisations should ensure that security software is regularly updated and properly configured.

Employees should not be encouraged to disable security controls simply because they interfere with convenience or productivity.

For nonprofits with limited IT resources, managed security or endpoint protection services may provide a practical alternative to managing everything internally.

Security controls should also cover devices used by remote workers where those devices access organisational systems or sensitive information.

7. Back Up Critical Data Regularly

A reliable backup strategy is essential for protecting nonprofits against ransomware, accidental deletion, hardware failures and other incidents.

Important information should be backed up regularly, including:

• Financial records
• Donor databases
• Documents and contracts
• Website content
• Email data where appropriate
• Grant information
• Programme and beneficiary records
• Configuration information
• Other mission-critical files

Backups should be protected from unauthorised access and ransomware. Organisations should also test their backups periodically to confirm that information can actually be restored.

A backup that has never been tested should not be treated as a guaranteed recovery solution.

Consider maintaining backups in a way that prevents an attacker who compromises the main network from easily deleting or encrypting every backup.

8. Limit Access to Sensitive Information

Not every employee or volunteer needs access to every system or file.

The principle of least privilege means users should receive only the access they need to perform their responsibilities. Limiting unnecessary access can reduce the potential impact of a compromised account.

For example, a volunteer who manages social media may not need access to financial records, while a finance employee may not need administrator privileges across the organisation’s entire technology environment.

Nonprofits should regularly review:

• User accounts
• Administrator permissions
• Shared folders
• Cloud applications
• Database access
• Remote access privileges
• Former employee accounts
• Volunteer accounts
• Third-party access

Access should be removed promptly when a person leaves the organisation or no longer requires it.

9. Secure Email and Cloud Accounts

Email and cloud services are central to modern nonprofit operations, making them valuable targets for attackers.

Charities should use security features offered by their email and cloud platforms, including MFA, suspicious-login alerts, spam filtering, access controls and security monitoring where available.

Administrators should also review account activity for unusual logins or unexpected changes.

Because compromised email accounts can be used to impersonate employees, nonprofits should establish procedures for verifying sensitive requests, particularly requests involving payments, banking information or confidential data.

For example, a request to change a supplier’s bank account details should be independently verified using a trusted communication method rather than relying solely on the email request.

This simple verification process can help prevent business email compromise and payment fraud.

10. Protect Donor and Beneficiary Data

Nonprofits often collect sensitive information from donors, beneficiaries, volunteers, employees and community members. Protecting this information is essential for both cybersecurity and organisational trust.

Organisations should understand what personal information they collect, why they collect it, where it is stored, who can access it and how long it needs to be retained.

Good data protection practices include:

• Collect only information that is genuinely needed
• Restrict access to sensitive information
• Encrypt sensitive data where appropriate
• Secure data transfers
• Delete information that is no longer required
• Protect databases with strong authentication
• Review third-party data processors
• Maintain appropriate retention policies
• Train employees on handling confidential information

Australian nonprofits should also consider the privacy and data protection obligations that apply to their activities and the personal information they handle.

Where an organisation operates across multiple countries, it may also need to consider privacy requirements that apply in those jurisdictions.

11. Create a Clear Cybersecurity Policy

A written cybersecurity policy gives employees, volunteers and contractors clear expectations about how technology and information should be used.

A nonprofit cybersecurity policy can address topics such as:

• Password requirements
• MFA
• Acceptable use of technology
• Email security
• Remote work
• Personal devices
• Data protection
• Software installation
• Access control
• Incident reporting
• Backup procedures
• Social media security
• Supplier access
• Employee and volunteer responsibilities

Policies should be practical and easy to understand. A complicated policy that nobody follows is less valuable than a straightforward policy that staff can apply every day.

Review policies regularly and update them when the organisation introduces new technology, changes working arrangements or faces new cybersecurity threats.

12. Develop an Incident Response Plan

Even organisations with strong cybersecurity controls can experience security incidents. Preparing in advance can reduce confusion and minimise damage.

A nonprofit incident response plan should explain what employees should do when something goes wrong.

The plan should identify:

1. Who is responsible for managing a security incident
2. Who should be notified internally
3. Which IT providers or technology partners should be contacted
4. How compromised accounts should be contained
5. How affected devices should be isolated
6. How evidence should be preserved
7. When legal, privacy or regulatory advice may be required
8. How donors, partners, employees or affected individuals should be informed
9. How essential operations will be restored
10. How the organisation will learn from the incident

Employees should know exactly how to report a suspected phishing email, compromised account, lost device or other security problem.

Fast reporting can make a major difference during a cyber incident.

The response plan should also be tested periodically. A simple tabletop exercise can help staff understand their responsibilities before a real incident occurs

13. Secure Remote and Hybrid Work

Remote and hybrid work can introduce additional cybersecurity risks. Employees may connect from home networks, public Wi-Fi, personal devices or locations outside the organisation’s normal environment.

Nonprofits should establish clear rules for remote work and provide employees with secure tools.

Recommended practices include:

• Use MFA for remote access
• Keep home and work devices updated
• Use approved cloud services
• Avoid accessing sensitive systems through unsecured public networks
• Lock screens when stepping away
• Use organisation-approved devices where possible
• Protect home Wi-Fi with a strong password
• Avoid storing sensitive information locally unless necessary
• Report lost or stolen devices immediately
• Use secure connections when accessing organisational systems remotely

Remote work security should be part of the organisation’s overall cybersecurity programme rather than treated as a separate issue.

14. Secure Third-Party Suppliers and Technology Providers

Nonprofits often rely on external providers for payment processing, donor management, cloud storage, website hosting, email, fundraising platforms, payroll and other services.

A security weakness at a third-party provider can potentially affect the nonprofit as well.

Before selecting a supplier, organisations should consider:

• What information the provider will access
• How the provider protects customer data
• Whether MFA is available
• How information is encrypted
• Where information is stored
• What happens if the provider experiences a data breach
• How accounts and access are managed
• Whether the provider has appropriate security certifications or independent assessments
• How data is returned or deleted when the relationship ends

Supplier security reviews should be proportionate to the sensitivity of the information involved.

For example, a provider handling sensitive beneficiary information may require a more detailed assessment than a supplier providing a low-risk service

15. Protect Social Media and Public-Facing Accounts

Nonprofits depend heavily on social media for fundraising, awareness, advocacy and community engagement. These accounts can therefore become attractive targets.

A compromised social media account can be used to distribute scams, damage the organisation’s reputation or trick supporters into sending money.

Protect social media accounts by:

• Enabling MFA
• Using unique passwords
• Limiting administrator access
• Removing former employees from account access
• Reviewing connected applications
• Avoiding shared credentials
• Monitoring unusual account activity
• Keeping recovery information current
• Reviewing account administrators regularly

Social media security should receive the same attention as other important organisational accounts

A Practical Cybersecurity Checklist for Nonprofits

For nonprofits looking for a simple starting point, the following checklist can help prioritise essential security improvements:

• Inventory all important devices, systems, applications and accounts
• Identify and classify sensitive information
• Enable MFA on critical accounts
• Require strong and unique passwords
• Use a reputable password manager where appropriate
• Train employees and volunteers about phishing
• Install security updates promptly
• Deploy appropriate endpoint protection
• Maintain secure and tested backups
• Apply least-privilege access controls
• Remove inactive and former-user accounts
• Protect email and cloud services
• Secure donor and beneficiary information
• Create written cybersecurity policies
• Develop and test an incident response plan
• Secure remote working environments
• Evaluate third-party suppliers
• Protect social media and public-facing accounts
• Establish a formal employee and volunteer offboarding process
• Review cybersecurity practices regularly

This checklist can serve as a starting point, but each nonprofit should adapt its security priorities according to its size, technology environment, information holdings, activities and risk profile.

How Nonprofits Can Improve Cybersecurity With Limited Budgets

Limited resources should not prevent an organisation from improving its cybersecurity.

Start with the highest-impact controls. Strong passwords, MFA, security awareness training, software updates, backups, access management and a basic incident response plan can provide substantial protection without requiring a large security department.

Nonprofits can also investigate technology programmes, security guidance, community resources, managed IT services and discounted technology offerings that may be available to eligible organisations.

Another effective approach is to prioritise security investments according to risk rather than trying to purchase every cybersecurity product available.

For example, enabling MFA across critical accounts may provide greater value than purchasing an advanced security platform that the organisation does not have the resources to manage effectively.

A simple, well-maintained security programme is often more effective than a complex collection of tools that are poorly configured or rarely reviewed.

Common Cybersecurity Mistakes Nonprofits Should Avoid

Understanding what not to do is just as important as knowing which controls to implement.

• Relying Only on Passwords: Passwords can be stolen through phishing, malware and data breaches. MFA should be enabled for important accounts whenever possible.
• Assuming the Organisation Is Too Small to Be Targeted: Cybercriminals often use automated attacks, which means organisations of all sizes can become targets.
• Ignoring Software Updates: Unpatched vulnerabilities can provide attackers with an easy entry point into systems and devices.
• Giving Everyone Administrator Access: Excessive privileges increase the potential impact of a compromised account.
• Keeping Former Accounts Active: Inactive accounts can become an overlooked pathway into organisational systems.
• Failing to Test Backups: A backup is only useful if the organisation can successfully restore its data when needed.
• Treating Cybersecurity as an IT-Only Responsibility: Employees, volunteers, managers and leadership all play an important role in protecting a nonprofit.
• Waiting Until an Incident Happens to Create a Response Plan: During a security incident, uncertainty wastes valuable time. Preparation allows an organisation to respond faster and more effectively.
• Using Shared Accounts Without Proper Controls: Shared credentials make it harder to determine who accessed information and make it difficult to remove access when someone leaves.
• Overlooking Third-Party Risk: A nonprofit’s security can be affected by suppliers, cloud services and technology providers. Vendor security should therefore form part of the overall risk management process.

A Simple Cybersecurity Roadmap for Nonprofits

If your nonprofit is unsure where to begin, focus on the basics first.

First 30 Days: Start by identifying important systems and information. Enable MFA on critical accounts, review administrator access, update devices and applications, and make sure important data is being backed up.

Next 60 Days: Introduce or improve cybersecurity awareness training. Create basic security policies, review supplier access, strengthen password management and establish a clear process for reporting suspicious activity.

Within 90 Days: Develop an incident response plan, test backups, review remote access, assess third-party risks and conduct another review of user permissions.

Ongoing: Continue security awareness training, monitor important accounts, apply updates, review access, test recovery procedures and reassess cybersecurity risks as the organisation changes. This staged approach makes cybersecurity more manageable for nonprofits with limited budgets and resources.

Final Thoughts: Building Stronger Cybersecurity for Nonprofits

Effective cybersecurity for nonprofits does not have to be complicated or prohibitively expensive. The strongest starting point is a practical security strategy built around people, processes and technology.

Nonprofits should begin by identifying their most important assets and risks, protecting critical accounts with MFA, training employees and volunteers to recognise scams, keeping systems updated, maintaining reliable backups, controlling access and preparing for potential incidents.

Cybersecurity is ultimately about protecting more than computers and data. It is about protecting donor trust, beneficiary privacy, financial resources, employees, volunteers and the mission that the organisation works every day to achieve.

By making cybersecurity a continuous part of organisational planning and culture, nonprofits can reduce risk, respond more confidently to threats and build a stronger foundation for their long-term mission.

The goal is not to eliminate every possible cyber risk. No organisation can guarantee that. The goal is to understand the risks, put sensible protections in place, prepare for incidents and continually improve.

For Australian nonprofits, a proactive approach to cybersecurity can help protect valuable information, maintain community trust and support the organisation’s ability to continue delivering its mission when it matters most.