Yes. CISA advises turning on automatic updates, because many updates fix security risks and attackers will not wait. For volunteers using personal laptops and phones to help your nonprofit, automatic updates on the operating system, browser and apps are the cheapest control you have.
What CISA says
CISA's "Update Software" page gives three steps: watch for notifications, install updates as soon as possible, and turn on automatic updates. It says to install all updates, especially for web browsers and antivirus software, and notes that many updates are created to fix security risks. Its short version: criminals will not wait, so neither should we.
Why this matters more with volunteers
You often do not control the devices. A volunteer may use a family laptop, an older phone or a library computer. You cannot install management software, but you can set a clear, small expectation.
A one paragraph volunteer rule
"If you use a personal device to access our email, files or donor system, keep its system, browser and apps up to date with automatic updates on, and lock the screen with a passcode."
That sentence is easy to agree to. Put it in your volunteer welcome note and ask for a yes.
Steps to check a device in two minutes
- Open the system settings and find the update section.
- Confirm automatic updates are on.
- Check that the browser is on its latest version.
- Confirm a screen lock is set.
- Make sure the device is still supported by its maker. Old devices that no longer get updates should not hold donor data.
What can go wrong
| Concern | Reality | What to do |
|---|---|---|
| An update breaks a tool | Possible but uncommon | Keep a note of the last working steps and ask for help |
| Updates need restarts | Often | Ask volunteers to restart weekly |
| A device is too old for updates | Common on shared hardware | Move work to a supported device or a web based tool |
| Volunteers skip updates | Common | Remind them at each volunteer meeting |
The cost of an occasional broken app is small compared with running years behind on patches.
For your own website and plugins
The same rule applies to your website platform and any add ons. Those need updates too, and they often are not automatic by default. Decide who checks them monthly and write the name down. For code projects, see how to keep software safe in ten minutes a month.
Shared and kiosk machines
If your office has a shared computer used by clients or event guests, give it its own account with no access to staff files and update it on a schedule you control. Reboot it after updates so patches take effect.
Make it visible
Ask volunteers to mention in a team meeting when they last restarted for an update. It sounds trivial, but a light, regular prompt does more than a long policy, and it keeps the habit social rather than enforced.
Quick check
What if a volunteer refuses automatic updates?
Explain the reason and offer an alternative, such as a weekly reminder to update by hand. If they will not, limit what that device can reach.
Do updates matter on phones too?
Yes. CISA's advice covers operating systems, programs and apps on any device.
Sources
Last reviewed: 19 October 2026.
