Through October we published fifteen short pieces on cybersecurity, written for nonprofits without an IT department. Here’s the whole series in one place, with the one action from each.
Getting started
“We’re too small to be a target” — and why that’s backward. Nobody picks a small nonprofit off a list. Scripts find you. The useful word isn’t target; it’s reachable.
Section 1: Secure your accounts
Your password isn’t the problem. Reuse is. Attackers rarely guess passwords; they reuse them from breached sites. Action: check your work email at haveibeenpwned.com.
The password spreadsheet has to go. A password manager with shared vaults means nobody texts a login again. Action: list every account more than one person uses.
Not all MFA stops a phish. Texted codes and push approvals can be beaten; passkeys can’t be phished. Action: turn on MFA for email first.
Section 2: Recognize the trap
The sender’s name is easy to fake. The display name is just a label. SPF, DKIM, and DMARC are the real defense. Action: find out whether your DMARC policy is set to reject.
The request that sounds like your executive director. Urgency, authority, secrecy, and an unusual channel, together, are an attack pattern. Action: have the ED announce “verify me too.”
Bad grammar was never the real tell. AI fixed the typos. Judge what a message asks, not how it looks. Action: update training to focus on behavior, not spelling.
Write the callback rule down. A habit protects one person; a written rule protects the organization. Action: draft a one-page payment verification rule.
Nobody reports what gets them blamed. Speed is the only part you control, and blame slows it down. Action: name the person everyone reports to.
Section 3: Protect your data
Most leaks start with a share link. No attacker required, just a setting nobody went back to check. Action: check who can open your donor data folder.
Know which rules you’re already under. PII almost certainly applies, PCI applies if you take cards, and HIPAA is narrower than most people think. Action: write down which apply to you.
Your team is already using AI. A ban moves it out of sight. A three-line policy keeps it in view. Action: name one approved tool and write the three lines.
Section 4: Stay resilient
A familiar voice is no longer proof. Cloned audio is cheap now, so verification must go beyond recognition. Action: make sure your payment rule covers voice and video.
Could you run a week without systems? Test backups, a printed contact list, and a plan for minimum operations. Action: print the list and the plan.
The application is the audit. Your insurance application lists the controls you said you have. Action: check that every answer is still true.
If you only do two things
Turn on multifactor authentication for your email. And agree, as an organization, that payment changes always get verified by phone using a number you already have.
Those two cover most of what actually happens to organizations like yours.
Thank you
Thank you to everyone who read along, replied, and forwarded these to a colleague this month. If you’d like a hand with any of it, we’d be glad to help. Get in touch at info@it4causes.org.