Identity and access — security foundations
MFA enabled on all accounts (email, CRM, grant systems, social media, online banking). Password manager deployed for all staff — every account has a unique, strong password. Former staff and volunteer accounts deactivated within 24 hours of departure. Role-based access control — every user accesses only the data necessary for their tasks. Administrator list reviewed quarterly. Access recovery procedure in case of lost MFA device.
Data protection and backups
3-2-1 rule for backups — 3 copies, 2 media types, 1 copy offline. Automatic daily donor CRM backups. Backup restoration testing quarterly. Disk encryption on all devices (BitLocker/FileVault). Data retention policy compliant with GDPR — data deleted after retention period expires. Sensitive beneficiary data stored with enhanced protection. Record of Processing Activities current and reviewed every six months.
Email and network protection
SPF, DKIM, and DMARC records configured for the organization’s domain. Anti-spam and anti-phishing filters active on the mail server. Website protected with SSL/TLS certificate. Firewall and antivirus active on all devices. Automatic operating system and software updates enabled. Office Wi-Fi secured with strong WPA3 password and separated from guest network. VPN for staff connecting remotely.
People and procedures
Cybersecurity training in onboarding for every new staff member and volunteer. Quarterly phishing simulations with results review. Designated person responsible for IT security. Written security incident response procedure. Data breach notification procedure for the supervisory authority (72 hours). Data processing agreements with IT vendors. Annual security review — internal or external audit. Business continuity plan for a major incident.
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
Why this matters for organizations
A complete cybersecurity checklist for nonprofit organizations for 2026. 30 points across five categories — from basics to advanced safeguards. In the context of growing cyber threats and tightening regulations (NIS2, DORA), organizations must proactively manage this security area. Failure to implement adequate safeguards can lead to data breaches, financial penalties, and reputational damage.
Best practices for implementation
Effective implementation requires several key steps:
- Risk assessment and inventory — identify assets, threats, and vulnerabilities specific to your organization.
- Policy development — document requirements, roles, and responsibilities.
- Technical controls — deploy tools and configurations proportionate to identified risks.
- Training and awareness — engage employees in protecting organizational security.
- Monitoring and continuous improvement — regularly verify effectiveness and adapt to the evolving threat landscape.
Related topics
See also:
