A nonprofit data security self-check gives each of the six areas below one of three answers: yes, not sure, or no. Treat “not sure” as “no” until someone can show you the setting, the log, or the restore. Partner accounts deserve the same scrutiny as your own.
Across the email security Scottship Solutions manages for nonprofit and small business clients, more than 2,000 phishing attacks were blocked in the year before March 2026, about 5.5 a day, with zero credentials compromised. Two of the attacks documented in the case study on email security for nonprofits came from real, compromised Microsoft 365 accounts at partner organizations, and both passed every email authentication check.
None of the six checks requires a security background. Each one ends in a document, a report, or a date you can put in front of your board.
What you’ll learn
- How do you know if your nonprofit’s data is secure?
- Where does your nonprofit’s sensitive data actually live?
- Who has access to your donor and client records?
- Is MFA turned on for every account, and is that enough?
- Do former staff and volunteers still have logins?
- Have your backups ever been test-restored?
- Can a partner’s compromised account reach your data?
- Who can tell you in plain language how exposed your nonprofit is?
- Frequently Asked Questions
- What should you do this week?
- What sources does this post cite?
How do you know if your nonprofit’s data is secure?
You know because someone can show you, not because nothing bad has happened yet. Score each area below yes, not sure, or no, using only the evidence in the second column. Six yeses means your data is in good shape. Any “no” is your first project.
The last column maps each area to a function of the NIST Cybersecurity Framework (CSF) 2.0, the free framework the National Institute of Standards and Technology (NIST) released in February 2024. Its six functions are Govern, Identify, Protect, Detect, Respond, and Recover.
| Area | Evidence to ask for | What “secure” looks like | NIST CSF 2.0 function |
|---|---|---|---|
| Where sensitive data lives | A list of every system holding donor, client, staff, or financial data, with an owner | No unknown copies, exports, or personal drives | Identify |
| Who has access | Admin roster and user list from Microsoft 365 or Google Workspace, the donor database or CRM, and the finance system | Named accounts only, no shared logins, few admins | Protect |
| MFA | MFA enforcement report from the admin console | Enforced on every account, including admins and volunteers | Protect |
| Offboarding | Today’s HR and volunteer roster compared to active accounts | Zero active accounts for people who have left | Protect |
| Tested restores | Date and result of the last restore test | A real file or mailbox restored in the last 12 months | Recover |
| Partner and vendor accounts | List of outside parties with access or email trust, plus what each vendor commits to on breach notification and MFA | Each one known, limited, and reviewed | Govern |
One honest limit. This self-check does not test Detect or Respond, meaning whether anyone notices an attack and who acts on it. Who owns that response is a leadership question, covered in our post on nonprofit cybersecurity governance.
Where does your nonprofit’s sensitive data actually live?
Start with the places everyone knows about: Microsoft 365 or Google Workspace, the donor CRM, and the finance system. Then look for the places nobody planned. Spreadsheet exports from the CRM, shared drives full of intake forms, and files on staff laptops and phones hold the same donor, client, and staff records.
The Nonprofit Risk Management Center opens its advice on securing confidential data with the same first step: take inventory. Ask what personal or confidential data your nonprofit holds today, and where every copy sits.
The evidence is a one-page inventory. For each system, it records three things:
- What data it holds: donor, client, staff, or financial
- Who owns it, by name
- Whether exports or copies exist outside it
Cleaning up or consolidating that data is a separate project. For this check, you only need to know where it is.
Who has access to your donor and client records?
Access problems hide in three places. Shared logins mean nobody knows who did what. Too many global admins means one stolen password opens everything, and CRM roles that give every user full export rights put your entire donor list one download away from a personal inbox.
Export the admin and user lists from Microsoft 365 or Google Workspace, your CRM, and your finance system. Count the admins. Flag any account that is not tied to one named person.
Secure looks like named accounts only, no shared logins, and a short list of admins you can name from memory. The tools that enforce this, and what they cost, are covered in our nonprofit cybersecurity guide.
Is MFA turned on for every account, and is that enough?
Ask for the MFA enforcement report from the Microsoft 365 or Google Workspace admin console. A staff survey is not evidence. People remember setting up an authenticator app and assume it covers every account, and the report shows which accounts are actually enforced.
Secure means enforced on every account, including admins and volunteers. No exceptions for the executive director’s phone.
MFA is the floor, not the finish line. A fact sheet on implementing phishing-resistant MFA from the Cybersecurity and Infrastructure Security Agency (CISA) explains that common methods such as text message codes, app codes, and push notifications are still vulnerable to phishing, and it calls FIDO authentication, used by security keys and passkeys, the only widely available phishing-resistant option.
The next step after full enforcement is phishing-resistant MFA for admins and finance staff, plus Conditional Access policies that control where and how people sign in. That is a configuration project, not a self-check item.
Do former staff and volunteers still have logins?
Nonprofits run on people who come and go. Seasonal staff, interns, event volunteers, and board members on fixed terms all get a login somewhere. Taking it back is nobody’s job until someone is named.
The evidence is a comparison. Put today’s HR and volunteer roster next to the active accounts in every system, not just email: the CRM, the finance system, file sharing, the donation platform, and social media.
Secure looks like zero active accounts for people who have left. Access comes off the same day someone leaves, and one named person owns that step.
Have your backups ever been test-restored?
Having backups and being able to restore them are two different facts. A backup job can report success for months while skipping the folder that matters.
Ask for the date and result of the last restore test, for both a file and a mailbox. As a practical rule, a real restore inside the last 12 months is what secure looks like. If nobody can name a date, score this one “no.”
Designing the backup itself is a bigger topic, covered on our backup and disaster recovery for nonprofits page.
Can a partner’s compromised account reach your data?
Yes, and the email looks completely legitimate. In two incidents documented in our phishing case study, attackers sent phishing from real Microsoft 365 accounts they had taken over at partner organizations. One account belonged to a director at a human services nonprofit. The other belonged to a manager at a behavioral health organization.
Both emails passed SPF, DKIM, and DMARC, the checks that confirm a message came from the domain it claims. They passed because the sending account was real. Google Workspace filtering held the first message, and IRONSCALES AI detection flagged the second.
When our team reached out to warn the behavioral health organization, the attacker, still in control of the account, replied within an hour: “It is legit. I sent the file for your review. Please let me know what you think about it. It is safe and secure.”
These were the partners’ compromises, not our clients’. That is the lesson. Your partners’ security is part of your security.
The evidence to ask for covers both partners and vendors:
- A list of every partner and vendor with access to your systems or a trusted email path into your inboxes
- What your CRM and donation platform commit to on breach notification timelines
- Whether those platforms support MFA for your users, and whether you have turned it on
Secure looks like every outside party known, limited to what it needs, and reviewed on a set schedule. Compliance rules such as HIPAA, PCI DSS, and SOC 2 add vendor requirements of their own and deserve a separate review.
Who can tell you in plain language how exposed your nonprofit is?
Start with the self-check above. If more than one area came back “not sure” or “no”, an outside review is worth it.
Scottship Solutions reviews security controls for nonprofits with 15 to 250 staff as part of its 10-day Tech Stack Audit. The findings come back as a written, board-ready report with a prioritized roadmap.
What does each option cost?
Here is how the options compare, with prices as of October 2026.
| Option | What it covers | Cost (as of October 2026) |
|---|---|---|
| Self-check (this post) | The six evidence areas, done by your own team | $0 plus staff time |
| Baseline security tool stack | MFA, endpoint protection, email filtering, and a password manager, using nonprofit programs from Microsoft 365 and Google Workspace for Nonprofits | $0 to $10 per user per month (about $3,000 a year for a 25-person nonprofit) |
| 10-day Tech Stack Audit (includes a security controls review) | Outside review of systems, access, and security gaps | Scoped per organization after a short call |
| Ongoing managed security | Monitoring, email security, and account management | Scoped per organization after a short call |
Two related questions sit outside this self-check. Board oversight and accountability after a breach are covered in the governance post linked above. Cyber insurance and compliance requirements each deserve their own review.
Frequently Asked Questions
How do nonprofits protect donor data from breaches?
Nonprofits protect donor data by limiting who can reach it, enforcing MFA on every account, removing access the day someone leaves, and keeping backups that have been test-restored. Phishing goes after donor data through staff inboxes, so email filtering and staff training belong in the baseline. The specific tools and their costs are in our nonprofit cybersecurity guide.
What are affordable cybersecurity solutions for nonprofits?
As of October 2026, Scottship Solutions puts a baseline security stack for nonprofits at $0 to $10 per user per month, about $3,000 a year for a 25-person nonprofit. That stack covers MFA, endpoint protection, email filtering, and a password manager. Nonprofit programs from Microsoft 365 and Google Workspace for Nonprofits keep the cost down, so check what your current licenses already include before buying anything new.
Tech stack audit vs security assessment: which should a nonprofit do first?
A small nonprofit does not need to choose. The Scottship 10-day Tech Stack Audit includes a security controls review, so access and security gaps are examined alongside software costs and integrations. Run the self-check in this post first to see which areas need the closest look.
Which cybersecurity firms focus on nonprofits with 20 to 200 staff?
Look for three things: a stated nonprofit focus, findings written in plain language, and a published scope that tells you what the review covers before you sign. Ask to see a sample deliverable and who does the work. Scottship Solutions works with nonprofits of 15 to 250 staff.
What kind of data breaches happen in the nonprofit sector?
Nonprofit breaches include phishing that steals staff passwords, account takeovers, donor exports saved where they should not be, and access left open for former staff or volunteers. In two incidents documented in the case study cited above, attackers sent phishing from real, compromised Microsoft 365 accounts at partner organizations. Both emails passed every email authentication check.
What should you do this week?
Pick one owner for the self-check and give it a deadline. Then work through these steps in order.
- Score the six areas: Answer yes, not sure, or no for each, using only the evidence column in the table above.
- Pull the two fastest reports: Export the MFA enforcement report and the admin list from Microsoft 365 or Google Workspace.
- Compare rosters: Match today’s staff and volunteer roster against active accounts in every system.
- Run a restore test: Restore one file and one mailbox, and write down the date and result.
- List your partners: Write down every outside organization and vendor with access to your systems or a trusted email path.
- Decide on outside help: If more than one area is “not sure” or “no”, schedule an outside review.
What sources does this post cite?
- NIST, Cybersecurity Framework 2.0: released February 2024, with six functions (Govern, Identify, Protect, Detect, Respond, Recover)
- CISA, Implementing Phishing-Resistant MFA fact sheet: common MFA methods remain vulnerable to phishing, FIDO authentication is the only widely available phishing-resistant option
- Nonprofit Risk Management Center, How to Secure Private and Confidential Data: take inventory as the first step
- Scottship Solutions, Phishing Attack Prevention case study (linked above): more than 2,000 phishing attacks blocked in the year before March 2026, about 5.5 a day, 0 credentials compromised, and two attacks from compromised partner accounts
- Scottship Solutions, nonprofit cybersecurity guide (linked above): baseline security stack at $0 to $10 per user per month, about $3,000 a year for a 25-person nonprofit
At Scottship Solutions, we help nonprofits find out where their data actually stands and close the gaps in the right order. From managed IT services for nonprofits to cybersecurity for nonprofits, our team manages email security for clients and reviews security controls during the 10-day tech stack audit.
If the self-check left more than one “not sure”, a 10-day tech stack audit can give you a clear picture of where your nonprofit data stands.
Written by
Josh Bass
Cybersecurity Consultant at Scottship Solutions
Josh leads security assessments and compliance audits for mission-driven organizations. He helps nonprofits build defensible security postures, meet HIPAA and state privacy requirements, and respond to threats before they become incidents.
Certifications
CompTIA Security+ Certified
Industries Served
Healthcare & Community Health (HIPAA), Human Services, Child Advocacy, Foundations & Grantmakers