Board members can oversee cyber risk with plain questions: what data do we hold, who can access it, how would we know about a problem, what is our plan if we lose access, and who owns each answer. You are listening for named owners and dates, not technical detail.
Why boards should ask
For most nonprofits, a security failure becomes a trust problem: donors, clients and funders hear about it. The board's job is the same as for money or safeguarding. Confirm someone is responsible and that the answers are checked.
You do not need to approve technical choices. You do need to see that basics exist.
Seven questions and good answers
| Question | A good answer sounds like |
|---|---|
| What sensitive data do we hold? | A short list: donors, clients, staff, with locations |
| Who can access it? | Named roles, reviewed on a schedule |
| Is MFA on email and admin accounts? | Yes, with a date it was checked |
| How do we back up, and have we tested a restore? | Describes the process and the last test date |
| What is our plan for a bad day? | A one page plan with names and numbers |
| What do we do when someone leaves? | A checklist, applied every time |
| What outside help do we have? | A named contact or volunteer program |
If an answer is "I think so" or "I will check", ask for a date to confirm. That is a normal and fair response, not a failure.
Use a recognized baseline
CIS describes Implementation Group 1 as "essential cyber hygiene," the foundational set of safeguards that every enterprise should apply against the most common attacks. It is a useful frame for a small organization: ask management which of those basics are in place and which are planned. See our explainer on IG1 for small organizations.
Ask for a short annual report
Once a year, ask for a one page update:
- What changed: new systems, new vendors, new risks.
- What we fixed.
- What we found and did not fix, with the reason.
- Any incidents, even small ones.
- What we need: time, help or money.
A report that says everything is fine every year deserves a gentle follow up. Real organizations find small issues.
Support, do not scold
If management reports a gap, thank them. Boards that punish honesty get silence. Offer resources: a volunteer with security skills, a funder conversation, or time in the budget. Where you hold cyber insurance, read the conditions with management. See cyber insurance for small nonprofits and schools.
Red flags worth a second look
- No one can say where donor or client data is stored.
- The same few people hold every admin login.
- Backups exist but nobody has restored one.
- The answer to every question is "we use a good vendor", with no detail on what the vendor does and what you still own.
A flag is a prompt for a conversation, not an accusation. Most small organizations will have two or three of these, and naming them is the first step to fixing them.
Quick check
Do we need a board member with security skills?
Helpful but not required. Good questions and a habit of follow up are enough for oversight of basics.
How often should this come up?
At least once a year, and after any incident or major system change.
Sources
Last reviewed: 19 October 2026.
