Scenario 05 Illustrative
Security Basics for a Small Non-Profit
An illustrative non-profit with no IT team builds practical security on a tight budget, starting with the few controls that stop most attacks.
Illustrative scenario, not a client engagement. This is a hypothetical example based on common attack patterns. It shows how we'd approach the problem, and doesn't describe a real client, incident or result.
- Sector
- Non-profit
- Scenario
- Security program
- Written for
- Leadership and IT teams
The situation
A 30-person Calgary non-profit runs on donated laptops, a Microsoft 365 account set up years ago by a volunteer, and a donor database holding names, addresses and giving history. There's no IT staff; a program manager fixes things when they break.
After a peer organization is hit by ransomware, a board member asks a simple question at the next meeting: “Are we safe?” Nobody can answer it.
What's at stake
The risks
- Donor trust and future funding depend on protecting personal information.
- Client records may include information about vulnerable people.
- With a tight budget and thin reserves, a serious incident could threaten the organization's ability to operate.
- Funders and insurers increasingly ask about security before they commit.
Our approach
How we'd help
- Baseline. Run a short, low-cost assessment: who has access to what, whether MFA is on, where data lives and whether backups actually work.
- Quick wins. Turn on MFA for everyone, remove former staff and volunteer accounts, separate admin accounts, enable built-in security features and back up email, files and the donor database.
- Right-sized policies. Write a one-page acceptable use policy, an onboarding and offboarding checklist, and a one-page incident plan with the right phone numbers.
- Sustain. Review once a year, train staff and volunteers in short sessions, and give the board a simple one-page report.
Decisions for leadership
- Name an owner for security, even part-time, and make it a standing board agenda item.
- Set a realistic budget focused on the handful of controls that stop most attacks.
- Decide how volunteer access is granted, reviewed and removed.
- Find out whether cyber insurance is available and affordable, and which controls insurers require.
Technical notes
- The Canadian Centre for Cyber Security's baseline controls for small and medium organizations are a practical, free framework to follow.
- Many vendors, including Microsoft, offer discounted licensing to eligible non-profits, which can put stronger security features within reach.
- Enable security defaults or Conditional Access, and block legacy authentication.
- Encrypt laptops, turn on automatic updates and use a password manager instead of shared passwords.
- Back up Microsoft 365 data separately. The platform's retention features aren't a full backup.
The takeaway
You don't need a big budget to be a hard target. A few well-chosen controls stop most of the attacks small organizations face.
Related reading
Next step
Could this happen to you?
Tell us what you're protecting. We'll help you find the gaps before an attacker does, and plan how you'd respond if one gets in.
Book a consultationPrefer to talk?