5 cybersecurity steps every NC nonprofit should take

Nonprofits hold exactly what criminals want: donor records, client and case data, and access to funds, often protected by a single overworked staff member and a few volunteers. You don't need an enterprise budget to defend it. You need to do the basics, well. Here are the five that matter most.

1. Turn on multi-factor authentication (MFA) everywhere

If you do only one thing, do this. MFA, that second code or prompt on your phone, stops the overwhelming majority of account takeovers, even when a password is stolen. Enable it on email, banking, your donor database, and any cloud app. It's usually free and built in.

2. Train your people to spot phishing

The most common way in isn't hacking, it's a convincing email that tricks a busy person into clicking or paying. A short, recurring conversation about what scams look like, fake invoices, "urgent" requests from the director, gift-card asks, pays for itself the first time someone pauses instead of clicking.

3. Back up your data, and test the backup

Ransomware's whole business model collapses if you can simply restore. Keep automatic backups, including a copy that attackers can't reach, and actually test a restore so you know it works before you need it. See backup & recovery for how we approach this.

4. Keep everything updated

A huge share of breaches exploit known flaws that already had a fix available. Turn on automatic updates for computers, phones, and software, and don't run equipment so old it no longer receives security patches.

5. Limit who can access what

Not everyone needs to be an administrator, and former staff and volunteers shouldn't keep access. Give each person only what their role requires, and remove accounts promptly when someone leaves. It contains the damage if any single account is ever compromised.

Where to start

If that list feels like a lot, start with MFA and backups today, they deliver the most protection for the least effort. When you're ready for help putting all five in place (and keeping them there), that's exactly what we do for nonprofits across the Triad. Learn more about IT for nonprofits or our cybersecurity services.