A small nonprofit can eliminate most realistic cyber risk by working through 20 prioritized steps: enable MFA and a password manager, remove departed users, patch systems, train staff against phishing, and test backups, all within a few weeks.
A practical 20-step cybersecurity checklist for nonprofits with no IT staff, with the risk each step reduces and how long it takes to do.
Most nonprofits that suffer a cyber incident are not hit by sophisticated attackers. They are hit by predictable problems: reused passwords, missing multi-factor authentication, outdated software, and no tested backup. This checklist gives you 20 steps in priority order, each with the risk it reduces and roughly how long it takes, so a team with no IT staff can work through it over a few weeks.
You do not need enterprise tools or a security budget to do almost everything here. The majority of these steps use features already built into the software you own, and the rest are inexpensive subscriptions designed for small teams. If you want broader context on setting up technology from scratch, see our small business technology guide.
The nonprofit cybersecurity checklist should be worked through top to bottom, in priority order, by a single named owner over several weeks. The list is ordered by the ratio of risk reduction to effort, so the first five items deliver more protection than everything below them combined. Block out two hours for the first session and treat the rest as a weekly task you chip away at.
Before you start, decide who owns the checklist. It does not need to be a technical person, but it must be a named person, not “the team.” If you rely on volunteer help for anything here, read our guide on managing volunteer tech help effectively first, because security tasks in particular need clear ownership and handoff rules.
Account takeovers, where an attacker uses a stolen or guessed password to enter a nonprofit’s systems, are stopped primarily by multi-factor authentication, unique passwords managed in a password manager, changed default credentials, prompt removal of departed users, and individual accounts for each person. These five steps close most of that door for a small organization. Total time: one afternoon.
MFA means logging in requires your password plus a second proof, usually a code from an app on your phone. Even if a password is stolen, an attacker usually cannot get in without that second factor. Start with email, because whoever controls your email can reset the password on everything else. Time: 30 to 60 minutes for the whole team. Prefer an authenticator app over SMS codes where possible, since phone numbers can be hijacked.
A password manager stores unique, strong passwords for every account and shares logins securely with the right staff, so nobody needs to know the banking password except the people who should. This eliminates reused passwords and password spreadsheets, which are a genuine liability. Time: 2 to 3 hours to set up and migrate critical logins. Our step-by-step guide to setting up a password manager for your team covers the process in detail.
Routers, printers, donation kiosks, and web hosting accounts often ship with default credentials that are published on the internet. Attackers scan for these constantly. Time: 30 minutes to walk the office and check.
Ex-employee accounts that still work are one of the most common audit findings at nonprofits, and they are a risk both from misuse and from unmonitored access. Do this the same day someone departs. Time: 15 minutes per departure, plus a quarterly sweep of user lists. If you use Google Workspace or Microsoft 365, the admin console shows every account in one place; our comparison of Google Workspace vs Microsoft 365 for small teams explains where these controls live in each.
Shared logins mean no accountability, no way to revoke one person’s access, and passwords that never get changed. Create individual accounts and use the password manager’s sharing feature for credentials that genuinely must be shared, like a social media account. Time: 1 to 2 hours.
The easy attack routes that automated tools constantly scan for, namely outdated software, unpatched routers, unencrypted devices, unlocked screens, and stale website plugins, are closed mostly with one-time settings in this group of five steps. Each is a setting a nonprofit turns on once and largely forgets. Together they remove the low-effort attacks most likely to find you.
Outdated software has known holes that attackers scan for automatically. Automatic updates on Windows and Mac close most of them without anyone remembering to act. Time: 15 minutes to enable, per computer.
Your router is the front door of your network, and consumer routers often go years without updates. Check for firmware updates quarterly, change the admin password from the default, and if the device is more than five or six years old and no longer receiving updates, replace it. Time: 30 minutes now, 10 minutes quarterly.
Full-disk encryption (BitLocker on Windows Pro, FileVault on Mac) means a lost or stolen laptop exposes nothing. Without it, anyone who takes the device can read every file on it, including donor and beneficiary data. Time: 10 minutes per device, plus a note of the recovery key somewhere safe, like a printed copy in a locked drawer.
A 5-minute auto-lock with a PIN prevents casual snooping in an office where clients, volunteers, and visitors pass through. Time: 5 minutes per device.
If your site runs a content manager like WordPress, outdated plugins are the most common way nonprofit sites get defaced or used to host malware. Enable automatic plugin updates where you can, and remove plugins you no longer use. Time: 1 hour, or one task for a volunteer with clear instructions.
The human factor, meaning staff clicking phishing emails, paying fraudulent invoices, or running daily work with administrator rights, is the attack vector most likely to actually hit a nonprofit. These four steps combine short training, a payment verification rule, restricted admin rights, and a brief acceptable use policy. Technology filters some phishing, but trained staff catch the rest.
Phishing, meaning fraudulent emails that trick staff into revealing credentials or paying fake invoices, is the attack most likely to actually hit you. A 30-minute walkthrough of real examples, covering suspicious sender addresses, urgent payment requests, and unexpected login links, prevents more incidents than most technical controls. Repeat it twice a year. Our article on how to recognize phishing and train your staff provides a ready-made structure. Time: 30 minutes per session.
Invoice fraud, where an attacker emails pretending to a vendor and asks you to update bank details, targets nonprofits directly. The rule: any change to payment details must be verified by phone using a number you already have, never a number from the email. Time: 15 minutes to write down and circulate.
Staff should log in with a standard account, not an administrator account, for daily work. If malware lands on a standard account, it cannot install software or change system settings, which contains most of the damage. Keep one admin account per computer, used only when needed. Time: 30 minutes per computer.
Cover what staff may install, which devices may touch donor data, and whether personal laptops are allowed for work. A short policy people actually read beats a long one they ignore. Time: 1 hour. If you handle donor or client data, pair this with our article on data privacy basics every small business should know.
Ransomware, meaning malware that encrypts files and demands payment, is survivable for a nonprofit that maintains tested backups the attacker cannot reach, plus a one-page incident response plan and awareness of insurance requirements. These four steps are your insurance against the worst case. Total time is roughly half a day of setup.
Back up donor data, financial records, and documents somewhere separate from your main systems, ideally a cloud backup plus a local copy. The rule of thumb is the 3-2-1 pattern: three copies, two different types of storage, one kept off-site. Time: 2 hours to set up. Our comparison of cloud backup vs local backup helps you choose the right combination.
A backup you have never restored from is a hope, not a plan. Once a quarter, pick a few files and restore them to confirm the backup actually works and you know how to use it. Time: 30 minutes quarterly. This is the single step most organizations skip, and the one that determines whether an incident is an inconvenience or a catastrophe.
The plan should answer four questions: Who do you call first when something goes wrong? Who decides whether to take systems offline? Who notifies donors, insurers, or regulators, and when? Where is the list of accounts and recovery keys? Keep it to one page, printed, in a place any manager can find it. Time: 2 hours. If you are unsure what terms like “ransomware” or “endpoint” mean in this plan, our tech terms glossary for non-technical leaders is a useful companion.
Many policies require specific controls, such as MFA and backups, to be in place before they pay out, and some funders and grant programs now ask about security practices. Knowing this now shapes what you prioritize. Time: 1 hour of reading your policy.
Nonprofit security is maintained over time through a recurring quarterly review by the checklist owner and a small annual budget line for security tools. Security is not a project that ends; it is a habit. These last two steps keep every control above from decaying through staff turnover and forgotten settings.
Put a recurring calendar hold for whoever owns the checklist. Walk through: any new accounts or software since last quarter, any departures to clean up, a restore test, and a check that updates are flowing. Time: 30 minutes per quarter.
A password manager, a backup subscription, and an occasional hardware replacement cost real money, and security fails when it is unbudgeted. Our guide on budgeting for technology in a small organization shows how to fit these into a realistic plan, and our list of free and discounted software for nonprofits covers donation programs that reduce the cost.
The table below summarizes all 20 steps of the nonprofit cybersecurity checklist with the risk each one reduces, the time it takes, and whether the task recurs. Most one-time steps take 30 minutes to 2 hours, while recurring tasks like restore tests and router updates take under an hour per quarter. Use it to plan sessions and track what is done.
| Step | Risk it reduces | Time | Recurs? |
|---|---|---|---|
| Enable MFA | Account takeover with stolen password | 30-60 min | No |
| Password manager | Reused and shared passwords | 2-3 hrs | No |
| Change default passwords | Trivial device access | 30 min | No |
| Remove departed users | Unauthorized access by outsiders | 15 min each | Quarterly |
| Individual accounts | No accountability, no revocation | 1-2 hrs | No |
| Automatic updates | Known software vulnerabilities | 15 min/device | No |
| Router updates | Network-wide compromise | 30 min | Quarterly |
| Device encryption | Data exposure from lost devices | 10 min/device | No |
| Lock screens | Casual snooping | 5 min/device | No |
| Website updates | Site defacement, hosted malware | 1 hr | Monthly |
| Phishing training | Credential theft, fraud | 30 min | Twice yearly |
| Payment verification rule | Invoice fraud | 15 min | No |
| Restrict admin rights | Malware damage containment | 30 min/device | No |
| Acceptable use policy | Ambiguity, shadow IT | 1 hr | Yearly review |
| Automated backups | Total data loss | 2 hrs | No |
| Test restores | Useless backups | 30 min | Quarterly |
| Incident response plan | Chaos during an incident | 2 hrs | Yearly review |
| Insurance check | Uncovered losses | 1 hr | Yearly |
| Quarterly review | Slow decay of all controls | 30 min | Quarterly |
| Security budget | Everything above failing | 1 hr | Yearly |
The common objections to nonprofit cybersecurity, namely “we are too small to be a target,” “we have nothing worth stealing,” and “nobody knows the passwords,” all fail on inspection. Attackers’ automated tools find whoever is exposed, nonprofits hold data worth stealing, and lost credentials are recoverable with an hour of work before an incident rather than a crisis during one.
“We are too small to be a target.” Attackers do not target you personally; their automated tools find whoever is exposed. Nonprofits are attractive precisely because they hold donor payment data and often have weaker defenses than the businesses next door.
“We have nothing worth stealing.” You have donor bank details, beneficiary personal information, and an email account that can send convincing fundraising appeals to your entire list. That is worth stealing.
“Our IT person left two years ago and nobody knows the passwords.” That is exactly why the password manager and the account inventory in step 17 come first. Recovering access before an incident is an hour of work; during one, it is a crisis.
The key takeaways of the nonprofit cybersecurity checklist are that the first five steps eliminate most realistic risk in one afternoon, MFA on email is the highest-value single action, backups only count after a tested restore, and every control needs a named owner. Most steps are free or cheap using built-in features and nonprofit discount programs.
Start with multi-factor authentication and a password manager, because stolen passwords are the most common way small organizations get breached. Both can be set up in a single afternoon and cost little or nothing. After that, turn on automatic updates and schedule a backup check.
Most of the highest-impact protections are free or nearly free: MFA, automatic updates, built-in encryption, and basic staff training. A reasonable budget covers a password manager subscription, a cloud backup, and possibly one paid security review every few years. Donations and nonprofit pricing from major vendors can reduce costs significantly.
Volunteers can help with one-time projects like setting up a password manager or writing an incident response plan, but recurring tasks like updates and backups should be automatic rather than dependent on a volunteer's availability. Assign clear ownership of security decisions to a staff member. See our guide on managing volunteer tech help for structuring that work.
Credential theft through phishing is the leading cause of breaches at small organizations, followed by unpatched software and missing backups. A nonprofit that enables MFA, keeps software current, and verifies backups regularly has addressed the majority of realistic threats without any specialized staff.
A decision framework for small maintenance and aviation businesses weighing rent, lease or buy, using the LEAP-1A engine stand as the worked example.
Learn how phishing really works, with annotated scam scenarios and a low-cost staff training plan you can run without an enterprise platform.
A practical rollout plan for team password managers: choosing a tool, onboarding staff, emergency access, and offboarding departing members.
.jpg){kind=link}
