A nonprofit with no IT staff can get a long way in 90 days by doing a few basics in a fixed order: inventory what you have, turn on multi-factor authentication, set up backups and updates, then write a one page response plan. None of it needs a budget line. It needs an owner and a calendar.
Pick one owner first
Security work dies when it belongs to everyone. Name one person, even a part-time staffer or a board member with a tech background, and give them an hour a week. Their job is to keep a short list and report once a month.
Month one: know what you have
You cannot protect accounts you have forgotten about. List every system that holds donor, member, client or staff data: email, the donor database, payment pages, the website, shared drives, the accounting tool, any volunteer sign-up form.
For each one, write down who has admin rights and who pays for it. This list is the most useful thing you will produce. It also tells you where multi-factor authentication matters most.
The FTC's small business guidance puts the same basics together: keep software updated, back up files, use strong passwords and multi-factor authentication, secure Wi-Fi, train staff, and have an incident response plan.
Month two: close the common doors
Turn on multi-factor authentication for email and for every admin account first. Then move to the donor database and the website login.
Switch on automatic updates for laptops, phones and browsers. CISA advises installing updates rather than postponing them, and turning on automatic updates so they happen without anyone remembering.
Set up backups of the files you cannot lose, and do one test restore before the month ends. A backup you have never restored is a hope, not a backup.
Month three: plan for a bad day
Write a one page incident plan. Who do you call, who can shut off an account, who talks to donors, who contacts your insurer. Print it. If email is down, a plan stored in email is no use.
Then review your list of systems again. Remove accounts for people who left. Ask each vendor what they would do if they were breached.
What to leave for later
Skip tools you cannot staff. A dashboard nobody reads adds cost and false comfort. Free options first: built-in browser password managers, the free scanning CISA offers to eligible organizations, and the free guidance linked from its catalog.
If your volunteers built your website, the code and plugins behind it are part of your attack surface too. Safeguard offers a free scan at gold.safeguard.sh/scan that checks dependencies for known vulnerabilities.
Quick check
What is the single best first step?
Turn on multi-factor authentication for email and admin accounts. Email resets everything else, so protecting it protects the rest.
How much time does this take?
About an hour a week from one named owner, plus a few short sessions for staff.
Sources
Last reviewed: 19 October 2026.
