Start with the accounts and information your nonprofit depends on: email, donor records, participant information, grant files, and the systems staff use each day. Ask what would happen if an account were taken over, a device were lost, or a service became unavailable.

Know your systems and responsibilities

Inventory key accounts, devices, software, websites, and outside providers. Identify who administers each system, how recovery works, and where sensitive information is stored. Include tools used informally by staff and volunteers. For foundations, consider application portals and grantee information as well as internal records.

Prioritize essential accounts and basic protections: strong unique passwords, a password manager, multifactor authentication, timely updates, and access limited to current responsibilities. Establish an offboarding process so former staff and vendors do not retain unnecessary access. Ask your IT provider to explain backup arrangements and test restoration rather than assuming that a backup will work.

Assess gaps with specialist support

Digital Defense Fund is listed in the resilience chart. Its current service overview describes full security evaluations, training, and other project support. An evaluation can help turn a broad concern into a prioritized improvement plan. Confirm fit, capacity, and the information needed before sharing internal details.

The Ford Foundation Cybersecurity Assessment Tool provides a structured starting point for understanding strengths and weaknesses. Treat a self-assessment as one input to planning, with expert advice for your circumstances. It does not establish legal compliance or guarantee security.

Explore the UC Berkeley Cybersecurity Clinic or the Consortium of Cybersecurity Clinics for clinic options. Eligibility, project scope, and academic schedules vary. The Democracy Security Project and Democracy Protection Network are additional starting points for relevant assistance; check their current requirements.

Practice before an incident

Write a short incident plan naming the person to contact, a backup contact, and a communication channel that does not depend on the affected account. Discuss a realistic scenario, such as a compromised executive email account or an unavailable donor database. Decide who engages technical help, counsel, insurers, and leadership, and who approves external updates.

Give staff an easy, supportive way to report suspicious activity. Schedule training and reviews that fit actual work, and assign owners and dates to improvements. If an account is already compromised, seek incident-response help promptly rather than treating the issue as a routine assessment. Technical and legal decisions should be tailored by qualified advisers.

Explore the Nonprofit & Foundation Resilience guide for related resources. For strategic or crisis communications support, contact Caitlin at CBKStrategies.

Back to all resilience resources · Home · About CBKStrategies

Back to all resilience resources