Cybersecurity for nonprofits: five free wins this October

Good cybersecurity for nonprofits does not start with a new budget line. If your organization holds donor records, client case files and grant funds with a small staff, rotating volunteers and no full-time IT person, the five steps below close the gaps attackers try first, and October's Cybersecurity Awareness Month is a natural deadline to finish them.

What is Cybersecurity Awareness Month, and why should a nonprofit care?

It is the annual October campaign co-led by the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance. The 2026 theme is "Don't Make It Easy for Them," and the habits it promotes close the gaps attackers most often try first: strong passwords, multifactor authentication, current software, and a pause before acting on a suspicious message.

For a nonprofit, the stakes are concrete. A single compromised mailbox can redirect a grant disbursement, expose client information, or put a funder relationship at risk.

Win 1: Is multifactor authentication turned on for every account?

If it is not, this is one of the most valuable hours you can spend this month. CISA's Cross-Sector Cybersecurity Performance Goals, written partly to help small and medium-sized organizations get started, call for MFA "using the strongest available method" for each system.

Most nonprofits run email on Microsoft 365 or Google Workspace, and both include MFA at no extra charge. In Microsoft 365, Microsoft's security defaults are free and require every user to register for MFA, require administrators to use it at every sign-in, and block older sign-in methods that cannot do MFA at all. Microsoft describes them as being for "organizations who want to increase their security posture, but don't know how or where to start."

Start with the accounts that can move money or change settings: the executive director, finance staff, and anyone with administrator rights. Then extend it to the donor database, the payroll provider, and the bank portal.

Win 2: Who still has access who should not?

Former staff, departed board members and last year's volunteers are often still in the system. CISA's performance goals call for "a defined and enforced administrative process applied to all departing employees by the day of their departure."

Spend one afternoon on a cleanup:

• Export the user list from your email system and compare it to your current staff and volunteer roster.
• Disable any account that does not belong to a current person, and remove forwarding rules on mailboxes you keep for records.
• Check who holds administrator rights in email, the donor database, the website and the bank portal. Keep that list as short as practical.
• Review shared logins. Where several people use one password, move them to individual accounts or at least change the password when someone leaves.

Win 3: Would your team catch a fake payment request?

Payment fraud is one of the costliest risks for any organization that moves money. The FBI's 2025 Internet Crime Report recorded 24,768 business email compromise complaints with reported losses of more than $3 billion. These schemes target organizations that regularly pay vendors and send wire transfers, which describes most nonprofits with grant programs or contractors.

The defense is a simple written rule. Write down and announce this policy: any request to change bank details, send a wire, or buy gift cards gets verified by phone using a number already on file, never a number in the email. Apply it to vendors, sub-grantees, and requests that appear to come from the executive director.

If money does go out, speed matters. The FBI advises victims to "immediately, contact your financial institution and request a recall of the funds," and to file a complaint at ic3.gov regardless of the amount.

Win 4: Is every computer still getting security updates?

CISA's guidance is direct: keeping software current "is the best way to make sure you have the latest security patches." Turn on automatic updates for operating systems, browsers and Office apps on every machine.

Then look for software that no longer gets regular updates. Windows 10 reached end of support on October 14, 2025, and now receives security updates only through Microsoft's Extended Security Updates program. Office 2021 reached end of support on October 13, 2026, with Microsoft confirming "no extension and no extended security updates." Donated and hand-me-down computers are a common place for unsupported software to hide. List every machine still running either version, and give each one a replacement or retirement date.

Win 5: Does everyone know what to do when something looks wrong?

A fast report turns a near miss into a non-event. CISA's performance goals call for incident response plans that are drilled at least annually and for known incidents to be reported to CISA and other necessary parties.

You do not need a long document to start. Write one page that answers four questions:

• Who does a staff member or volunteer tell first, by name and phone number?
• Who calls the bank if a payment may be fraudulent?
• Who contacts your IT provider, your insurance carrier, and your board chair?
• Where are the contact numbers kept if email is down?

Then run a 30-minute tabletop at your next staff meeting: someone clicked a link in a fake donation receipt and entered their password. Walk through who does what, and fix any gaps you find.

What does a one-month cybersecurity plan for nonprofits look like?

A realistic plan assigns one win to each week of October, with a named owner and a date for each:

• Week 1: turn on MFA for finance, leadership and administrator accounts.
• Week 2: run the account and administrator cleanup.
• Week 3: adopt and announce the phone verification rule for payment changes.
• Week 4: inventory unsupported computers and run the 30-minute tabletop.

Record what you did and when. If a funder, insurer or auditor asks about these controls, a dated record answers the question quickly.

How s90 helps

s90 supports nonprofits and social service agencies in Los Angeles and Orange County with managed IT built for lean budgets. We set up MFA, clean up accounts, keep every device patched, and help you write the one-page response plan your team will actually use. If you want help turning this month's wins into habits, we are happy to talk.