Cybersecurity for non-profits: member lists, volunteers and a small budget

'We are only a non-profit, who would be interested in us?' We hear it at almost every association we visit: the sports club, the youth movement, the neighbourhood committee, the socio-cultural organisation with three part-time staff and forty volunteers. It sounds logical, but it is not true. A non-profit has exactly what attackers are looking for, and usually less protection than a company of the same size. The good news: the basics cost little money and fit into a few board meetings.

Why a non-profit really is a target

Attackers rarely pick a specific target. They send phishing emails in bulk, try leaked passwords everywhere and see who bites. To them, a non-profit is a door like any other. Only that door is open more often. And what lies behind it is not nothing.

• Member lists with names, addresses, dates of birth, sometimes national register numbers and medical information. Think of a sports club or a youth movement organising camps.
• Grant money and membership fees in the bank account. A fake invoice or a 'changed account number' from a supplier works just as well at a non-profit as at a company.
• Board members doing everything from their private email, on a PC the children also use.
• The trust of your members, which you lose with a single data breach.

What we typically find

No non-profit was built for this. Associations grow organically, with people giving their free time. That explains the situations we see almost everywhere.

• One shared Gmail or Outlook mailbox for the association, with a password that has been the same for years and is known to ten people, three of whom are no longer on the board.
• Board changes without anyone revoking access. The previous treasurer can still get into the bank account, the website and the member list.
• The member administration in an Excel file on the secretary's private PC, without a back-up. If that laptop crashes or is stolen, the association has lost its member records.
• A Word document called 'passwords' in the shared folder.

Recognise a few of these? Then you are in good company. The point is not that anyone is at fault, but that it can get better quickly.

GDPR applies to non-profits too

A short note, not legal advice. Privacy legislation (GDPR) makes no distinction between companies and associations. Whoever keeps personal data of members has to secure it properly, may not keep it longer than necessary and has to know who has access to it. A member list that circulates as an attachment to the entire board is hard to reconcile with that. You do not have to become a lawyer. The five steps below immediately take you a long way.

Five affordable steps

1. Separate accounts with MFA for every board member. No more shared mailbox with one password, but a personal login per person with two-step verification via an app on the phone. Cost: a few hours to set up, nothing after that. How to go about it is in our step-by-step plan for introducing MFA.
2. A password manager with a shared vault. The logins for the website, the membership software and social media sit in one vault that only the right people can access. More on that in a password manager for your team.
3. The member list in one secured place. Pick one location (a shared folder in Microsoft 365 or Google Workspace, or dedicated membership software), limit access to those who need it, and stop emailing attachments.
4. Review access at every board change. Make 'revoking rights' a fixed agenda item after every general meeting. Our offboarding checklist was written for companies, but works just as well for a board.
5. A back-up of the member administration. Automatic, in a second location, and tested once a year to make sure you can restore it.

Free or cheap resources

Budget is always an argument at a non-profit, and rightly so. Know that both Microsoft and Google have a non-profit programme through which recognised associations can use their business tools for free or at a reduced rate. The conditions differ and change from time to time, so check their own pages or ask your IT partner. Password managers also often have a small team plan that is very affordable for a board of five to ten people. Most of the five steps above cost mainly time, not money.

And NIS2?

You may have heard something about it: the European NIS2 directive that obliges organisations to take cybersecurity measures. Most non-profits do not fall under it. There are exceptions in sectors such as healthcare, and if you are a supplier to an organisation that does fall under it, you may get questions. If in doubt, read our explanation of NIS2 and CyFun for SMEs and non-profits. But regardless of the law: the basic hygiene above is what every association needs, mandatory or not.