Possibly. CISA uses "high-risk communities" for activists, journalists, human rights defenders, academics and staff of civil society groups who face heightened targeting because of who they are or what they do. If opponents have reason to disrupt or watch you, plan as if you fit.
What CISA says
CISA's high-risk communities page states that these groups play a critical role in providing services and advancing causes, and that many operate on lean budgets and cannot significantly invest in cybersecurity. It adds that this makes them an attractive target for threat actors who use intrusions to undermine the values of free societies.
The page lists three resources: Project Upskill, a series of non-technical how-to labs for people in high-risk organizations, a suite of tools and services from CISA, industry and civil society partners, and a Cyber Volunteer Resource Center that points to local volunteer clinics.
A simple self-check
Ask five questions. Two or more yes answers is a signal to raise your baseline.
- Do we work on a topic that makes someone powerful angry, such as rights, elections, journalism or whistleblowing?
- Do we hold lists of people who could be harmed if exposed, such as clients, sources or members?
- Have we been impersonated, doxxed, harassed or knocked offline before?
- Do staff or volunteers use personal phones and accounts for work?
- Would a leak of internal messages hurt the people we serve?
An animal rescue with a donor list is a normal small organization with normal risk. A group that supports activists in a hostile environment carries a different kind of risk, even if its budget is the same.
What changes if you fit
The basics stay the same, with a shorter fuse.
| Area | Normal baseline | If you may be targeted |
|---|---|---|
| Sign in | Unique passwords and MFA | Stronger MFA for admins and leaders first |
| Data | Collect what you need | Collect less, delete sooner |
| Devices | Updates on | Separate work and personal accounts where you can |
| Help | Ask a volunteer | Line up a contact before an incident |
| Website | Patch and back up | Look into free attack protection programs |
Collecting less is the cheapest control. Data you never stored cannot leak.
Where to start this month
- Use the CISA labs for people who are not technical. They are written for this audience.
- Look at the volunteer resource center for a clinic near you.
- Put MFA on email and admin accounts first, because email resets everything else.
- Write down who you would call on a bad day, including how to report an incident to CISA, which the page says organizations should do around the clock if they see anomalous activity.
Quick check
Is a high-risk community the same as a nonprofit?
No. The term is about targeting, not tax status. Many nonprofits are low risk, and some informal groups are high risk.
Do we have to be in the United States to use these ideas?
CISA is a US agency, so its programs and reporting channel are US centered. The self-check and the controls apply anywhere. Look for a local equivalent if you are elsewhere.
Sources
Last reviewed: 19 October 2026.
