Cybersecurity for Nonprofits on a Tight Budget

Your nonprofit holds exactly what attackers want: donor names, addresses, giving history, sometimes payment details, plus an email domain people trust. And you probably protect it with a part-time IT volunteer, a shared spreadsheet of passwords and whatever security came with your email plan.

That’s not a criticism. Most nonprofits run lean by design. The good news is that the controls that stop the most common attacks, such as phishing, account takeover and ransomware, are mostly settings and habits, not expensive products.

This guide covers the low-cost controls that matter most, how to handle volunteer access safely and which nonprofit technology programs can lower your costs.

Why attackers target nonprofits

Nonprofits face the same attacks as any small business, with a few extra pressure points:

• Donor data is valuable. Contact details and giving history can be sold or used for targeted scams.
• Trust is easy to borrow. A hijacked nonprofit email account can send convincing fake donation appeals or invoice changes.
• Access is spread out. Volunteers, board members and part-time staff often use personal devices and shared logins.
• Money moves on email instructions. Grant payments, vendor bills and event deposits are classic targets for business email compromise.

Every US state has a data breach notification law, and the rules on what counts as personal information and who must be told differ by state. A breach can bring notification costs, legal advice and lost donor trust, which hurts more than any software bill. Our guide to US state data privacy laws covers the wider picture. This is not legal advice.

The 8 controls that matter most

If you can only do a few things this quarter, do these. Most cost little or nothing.

Key takeaway: For most nonprofits, the biggest security gains come from MFA, unique accounts and a rule that payment changes are always confirmed by phone. None of these needs a new budget line.

1. Turn on MFA everywhere it matters

Start with email, because email resets every other password. Then add MFA to your donor CRM, payment processor, bank, website admin and social media accounts. Prefer an authenticator app or passkeys over text messages where possible. Our step-by-step guide to setting up two-factor authentication walks through it.

2. Replace the password spreadsheet

A shared document of passwords is one phishing email away from a full breach. A business password manager lets you share specific logins with specific people and revoke access in one click. See how to choose a business password manager.

3. Lock down your email platform

Whether you use Google Workspace or Microsoft 365, the built-in security settings are strong if you turn them on. Use our Google Workspace security checklist or our guide on how to secure Microsoft 365.

4. Back up what you can’t lose

Back up your donor database exports, financial records and grant files. Keep at least one copy separate from your main account so ransomware or a compromised admin can’t delete it. Test a restore once a quarter. Our guide to backing up business data explains the options.

Protecting donor data

Donor data deserves its own rules because it’s the asset you’d least like to explain losing.

• Know where it lives. List every place donor data sits: CRM, email marketing tool, payment processor, spreadsheets, event apps and volunteer laptops.
• Shrink the footprint. Delete old exports and stop emailing spreadsheets of donors. Share a link with access controls instead.
• Limit access by role. A volunteer making thank-you calls doesn’t need giving history or home addresses for every donor.
• Don’t store card numbers. Let your payment processor handle cards. If you accept card payments, you’re still expected to follow the PCI Data Security Standard. Our PCI DSS guide for small businesses explains what that means for you.
• Set a retention rule. Decide how long you keep records of lapsed donors and event attendees, then delete on schedule.

Managing volunteer access safely

Volunteers are the heart of most nonprofits, and the trickiest part of security. People come and go, use their own phones and laptops, and often get handed a shared login on day one.

Practical rules that work:

1. Give every volunteer their own account for any system with sensitive data. Shared logins make it impossible to see who did what or to cut off one person.
2. Use the lowest access that does the job. Many CRMs and email tools offer read-only or limited roles.
3. Set expiry dates. For event volunteers, create accounts that expire when the event ends.
4. Keep sensitive work in the browser. Ask volunteers to use web apps rather than downloading donor files to personal devices.
5. Train in 15 minutes, not 2 hours. A short orientation on phishing, password managers and “never pay or change payment details from an email” covers most risk. Our guide to security awareness training has ideas you can adapt.
6. Offboard the same day. When someone leaves, remove their accounts, shared folder access and password manager entries. Use an offboarding checklist.

Check licensing rules, too. Microsoft’s nonprofit eligibility page says granted licenses are only for paid employees and unpaid executive staff, while discounted licenses can cover all staff, including volunteers. Plan your volunteer accounts with that in mind.

Nonprofit tech programs that stretch your budget

Several programs offer donated or discounted technology to eligible nonprofits. Terms change, so always confirm current eligibility and pricing on each program’s own site.

A note on Microsoft: Business Premium includes security features such as device management and advanced threat protection that Business Basic lacks. If you lost the free grant, compare the discounted Business Premium price against adding separate tools before downgrading.

For a broader look at how nonprofits are using these tools, see how technology is changing nonprofits and churches.

Where to start: a 30-day plan

Week 1: Accounts - Turn on MFA for email, banking, payment and donor systems. - Remove accounts for anyone who no longer volunteers or works with you.

Week 2: Passwords and sharing - Set up a password manager and move shared logins into it. - Replace shared accounts with individual ones where your systems allow.

Week 3: Data and backups - Map where donor data lives and delete stray exports. - Set up and test backups for donor, finance and grant records.

Week 4: People and plans - Run a 15-minute phishing and payment-verification briefing for staff and volunteers. - Write a one-page incident plan: who to call, how to reach your bank and who decides on donor notification. Our incident response plan guide has a template.

CISA’s Cybersecurity Performance Goals include a self-assessment checklist that small organizations can use to prioritize next steps once the basics are in place. If you want outside help later, our comparison of MSSP vs MDR explains managed security options.

Conclusion

Strong nonprofit cybersecurity doesn’t start with a big purchase. It starts with MFA, individual accounts, careful donor data handling and quick offboarding of volunteers. Add donated and discounted tools where they fit, check program terms every year and you’ll protect your donors’ trust without draining your mission budget.

Sources

• Microsoft Learn: Microsoft for Nonprofits updates — Business Premium and E1 grant discontinuation, 300 Business Basic grants, discounts up to 75%
• Microsoft for Nonprofits eligibility — granted licenses for paid staff and unpaid executives; discounted licenses for volunteers; ineligible organization types
• Google for Nonprofits eligibility — eligibility rules and excluded organization types
• Google Workspace for Nonprofits help center — no-charge Workspace edition and activation steps
• CISA: Free cybersecurity services and tools — no-cost services, regional advisors and Cybersecurity Performance Goals assessment
• Cloudflare Project Galileo — free protection for at-risk public-interest organizations