Nonprofits hold some of the most personal information in any community: donor contact and giving history, payment details, case notes, and records about children, families and people in crisis. Most of that data is protected by a small staff, a rotating group of volunteers and a security budget that competes with programs.
This guide explains where nonprofit data actually lives, the threats that hit nonprofits most often, the controls every organization needs, and how to handle the volunteers, shared devices and outside questions that make nonprofit security different.
Corporate Data Solutions (CDSI) is a Microsoft Partner that has protected Arizona organizations for more than 20 years. Our cybersecurity services are built around practical controls that small teams can live with every day.
Why Nonprofits Are Targets
Attackers look for organizations that move money, trust email and have limited security staff, which describes most nonprofits.
Nonprofit leaders know it. In the NC State and Protiviti 2027 Top Risks survey, nonprofit respondents ranked cyber threats fourth and privacy and identity protection fifth among their near-term risks, ahead of access to capital.
Across all organizations, the FBI's 2025 Internet Crime Report logged nearly $20.9 billion in reported losses, a 26% increase from the year before. Business email compromise alone accounted for almost $3.05 billion, and phishing was the most commonly reported crime.
Where Nonprofit Data Actually Lives
Before you can protect your data, you need to know where it is. In most nonprofits we support, it's spread across more places than leadership expects:
- Email and file storage. Microsoft 365 or Google Workspace, including OneDrive, SharePoint and shared mailboxes.
- Donor and client databases. CRMs like Salesforce, case management systems and spreadsheets that grew into databases.
- Payment platforms. Online giving forms, event registration tools and payment processors.
- Laptops and shared desktops. Staff devices, check-in computers and machines used by volunteers.
- Personal devices. Phones and home computers used to check email or approve payments.
- Third-party tools. Volunteer scheduling, survey and marketing platforms connected to your accounts.
Each of these is a door into your organization. Good security starts with an inventory of them and a clear answer to who can open each one.
The Threats That Hit Nonprofits Most
Email Fraud and Payment Redirection
The most damaging attacks on nonprofits rarely involve sophisticated hacking. They start with an email that looks like it came from the executive director asking for gift cards, a vendor announcing new bank details, or a donor asking to update where a refund should go.
These messages work because nonprofits run on trust and goodwill. The most effective protection is a simple process: any request to change payment details or send money gets confirmed through a second channel, like a phone call to a number you already have.
"Email is the largest vector for cyber attacks and many solutions, like conditional access and multifactor authentication, are not configured properly."
Derek Achterfeldt, President, CDSI
Stolen Passwords
Credential abuse was the leading way attackers got in, accounting for 22% of initial access in Verizon's 2025 Data Breach Investigations Report. Reused passwords, shared logins and accounts without multi-factor authentication make it easy.
Ransomware
Ransomware appeared in 44% of breaches in the same report, up 37% from the previous year. For a nonprofit, it can lock staff out of files, donor records and email until systems are restored, which is why tested backups matter as much as prevention.
Vendors and Connected Tools
Breaches involving a third party doubled to 30% in Verizon's 2025 report. Every app connected to your Microsoft 365 or donor database, and every provider with remote access, extends your risk to their security too.
Security Controls Every Nonprofit Needs
You don't need an enterprise security team. You need a handful of controls set up correctly and kept that way. These are the standards CDSI puts in place for every client.
Multi-Factor Authentication on Every Account
MFA is one of CDSI's two non-negotiables. It should cover email, file storage, donor databases, payment platforms and remote access, with no exceptions for executives or long-time staff.
Conditional Access and Fewer Admins
Conditional access blocks sign-ins from unexpected locations or unmanaged devices. Pair it with a short list of global administrators. We regularly find nonprofits with too many people, or the wrong people, holding full admin rights.
Verified Requests
Before acting on any support request, we confirm it comes from someone at the organization. One nonprofit we support told us this simple step adds a level of security and trust to their whole culture.
24/7 Monitoring and Endpoint Protection
Every device should run endpoint detection and response, watched around the clock by a security operations center. Suspicious activity at 2 a.m. on a Sunday gets investigated right away instead of waiting until Monday.
Spam Filtering and a Fast Second Opinion
Filtering stops most malicious email before it arrives. For the rest, staff need a quick way to forward anything suspicious and get an answer right away, without feeling like they're bothering anyone.
Backups You've Actually Tested
CDSI uses hybrid backup: an appliance in your office plus real-time replication to the cloud, with restore tests every month. Learn more about our backup and disaster recovery services.
"Many businesses believe they are backing up their data until the day comes when a restore is needed, and problems arise. Backup verification and testing is essential."
Derek Achterfeldt, President, CDSI
Staff and Volunteer Training
People are part of every attack. Short, regular cybersecurity awareness training helps staff spot fake invoices, unusual payment requests and login pages that aren't what they seem.
Volunteers, Interns and Shared Devices
Volunteers are the backbone of many nonprofits, and they create security challenges most businesses never face.
- Give everyone their own account. Shared logins make it impossible to know who did what or to remove one person's access.
- Grant only what each role needs. A volunteer scheduling events doesn't need access to donor giving history.
- Remove access the day someone leaves. Build offboarding into your volunteer process, and review active accounts every quarter.
- Lock down shared computers. Check-in desks and common-area machines should not stay signed into sensitive systems.
- Set rules for personal devices. If volunteers use their own phones for email, require MFA and a screen lock at minimum.
When Insurers, Funders and Boards Ask Questions
More outside groups are asking nonprofits how they protect data. Cyber insurance applications commonly ask about MFA, backups and endpoint protection. Boards want to know the organization isn't carrying risk it can't afford, and some funders ask about data handling as part of due diligence.
The controls in this guide answer most of those questions. Keep a one-page summary of what's in place, who manages it and when it was last reviewed, so you can respond quickly and consistently.
"Businesses feel that cybersecurity makes things harder. Security does increase steps to get certain tasks done, but they are essential, not optional due to inconvenience."
Derek Achterfeldt, President, CDSI
Warning Signs Your Security Has Gaps
- No MFA on email accounts
- Volunteers sharing logins
- Former staff or volunteers with active accounts
- More than three global admins
- No backup restore test in the past six months
- Payment changes approved by email alone
- No one monitoring devices after hours
- No staff security training in the past year
A 30-Day Security Plan for Nonprofits
| Week | Focus | Actions |
|---|---|---|
| 1 | Accounts | Turn on MFA everywhere, remove former staff and volunteers, cut global admins to the minimum |
| 2 | Email and payments | Tighten spam filtering, set up conditional access, write a payment-change verification rule |
| 3 | Devices and backup | Deploy endpoint protection with 24/7 monitoring, confirm backups, run a test restore |
| 4 | People and records | Run awareness training, document controls in a one-page summary for your board |
Not sure where your organization stands? Start with our Microsoft 365 security checklist or request a free cybersecurity checkup.
Protecting Nonprofits Across the Valley
CDSI supports nonprofits throughout the Phoenix area, including dedicated support for donor and client data protection in Scottsdale. We also donate base monitoring agents, software and virtual CIO time to the nonprofits we support, so security isn't something only well-funded organizations can afford.
Protect the People Who Trust You
Donors, clients and families trust your organization with information they don't share lightly. A few well-run controls go a long way toward keeping that trust, and you don't have to set them up alone.
If you'd like an outside look at where your organization stands, we'll walk through it with you. There's no cost and no pressure.
Related Resources
- Free Cybersecurity Checkup
- Microsoft 365 Security Checklist
- Cybersecurity Services
- Cybersecurity Awareness Training
- Security Incident Response
- IT Services for Nonprofits in Phoenix
