How to report cyber risk to your nonprofit board on one page

Why should a nonprofit board see a cyber risk report on one page?

A nonprofit board needs a one-page cyber risk report because directors are accountable for oversight, and most board packets give them either nothing on cybersecurity or a stack of technical output they cannot act on. A single page puts the few decisions that matter in front of the people who approve the budget and answer to funders, donors and clients.

California makes that duty concrete for nonprofit public benefit corporations. Corporations Code section 5231 requires a director to act in good faith and with the care, including reasonable inquiry, that an ordinarily prudent person would use in a similar position. The same section lets directors rely on reports from officers, employees and outside experts they believe to be reliable and competent. A regular written cyber report is one practical way a board shows both: that it asked, and what it relied on when it decided.

The stakes behind the report are specific. A nonprofit that holds personal information about California residents is covered by the reasonable security requirement in Civil Code section 1798.81.5, because section 1798.80(a) defines a business to include organizations whether or not they are organized to operate at a profit. A breach of names combined with Social Security numbers, account credentials or medical information triggers notice to affected residents within 30 calendar days of discovery under the 2026 amendment to section 1798.82. And organizations spending federal awards issued on or after October 1, 2024 must take reasonable cybersecurity and other measures to safeguard information under 2 CFR 200.303(e).

Does any rule require a nonprofit to report cyber risk to its board?

For most nonprofits, no rule prescribes a cybersecurity report to the board. The laws above require reasonable security and timely breach notice, and they leave the reporting format to the organization. That gives the board room to ask for what it actually needs.

The NIST Cybersecurity Framework 2.0 is voluntary, and its Govern function is a useful frame for that request. Subcategory GV.RR-01 states that organizational leadership is responsible and accountable for cybersecurity risk. GV.OV-01 and GV.OV-03 describe reviewing strategy outcomes and evaluating risk management performance so leaders can adjust course. A one-page report is the mechanism for that review at board level. For more on how the Govern function maps to directors, see what board oversight looks like under CSF 2.0.

What belongs on the one page?

A one-page board cyber report needs five blocks, in this order: top risks, decisions requested, a small set of measures, incidents and near misses, and commitments and dates. Each should be short enough to read in under a minute, and everything else lives in an appendix or the risk register, available on request.

• Top risks. Three to five risks stated in mission terms, each with likelihood, impact, owner and trend since the last report. "Donor database exposed through a compromised staff account" is a risk a director can weigh. "Unpatched endpoints" is too vague to act on.
• Decisions requested. Anything that needs board approval or acceptance: a budget line, a policy exception, or a risk the organization is choosing to carry.
• A small set of measures. Four to six numbers that move, such as multi-factor authentication coverage, devices current on updates, backup restore tests and training completion.
• Incidents and near misses. What happened since the last meeting, whether any notice obligation was considered, and what changed as a result.
• Commitments and dates. What staff and vendors promised at the last meeting, and whether it got done.

Where do the top risks come from?

The top risks come from a cybersecurity risk register that staff and the IT provider maintain between meetings. The one page summarizes that register, and directors can always ask to see the full entry behind any line.

NIST revised IR 8286, Integrating Cybersecurity and Enterprise Risk Management, in December 2025. With its companion reports, it describes how cybersecurity risk registers feed an organization-wide view of risk: IR 8286A covers identifying risks and estimating their likelihood and impact, and IR 8286C covers bringing register information into the enterprise risk portfolio so senior leaders can oversee it. NIST states the concepts are intended to be useful for all enterprises, and the structure scales down to a small organization.

A nonprofit's register can be a spreadsheet with one row per risk: description, affected data or program, likelihood, impact, current controls, planned response, owner and next review date. CSF 2.0 subcategory GV.RM-03 calls for cybersecurity risk management activities and outcomes to be included in enterprise risk management. If the board already reviews a general risk register for finance, programs or facilities, cyber risks belong on that same list.

Which numbers should a board track?

A nonprofit board should track four to six measures that show whether key controls are in place and working, always shown with the trend. A board that sees the same handful of numbers every quarter learns what normal looks like and notices when something slips.

NIST SP 800-55 Volume 1, the December 2024 measurement guide, distinguishes implementation measures (is the control deployed?) from effectiveness measures (is it working?). It also advises that with quantitative metrics, initially at least, less is often more. For a nonprofit board, a workable starting set is:

• Percentage of staff and volunteer accounts protected by multi-factor authentication.
• Percentage of devices with current security updates.
• Date and result of the last backup restore test.
• Security awareness training completion rate.
• Number of open high-severity findings and their average age.
• Accounts belonging to departed staff or volunteers that are still active, with a target of zero.

Show each one as current value, prior value and target. Use color coding sparingly and define what each color means in a footnote. Our piece on metrics for each NIST CSF 2.0 function goes deeper on choosing them.

How should the report handle risks the organization chooses to accept?

Accepted risks should be named plainly on the report, and the board should accept them on the record. Nonprofits run lean, and some risks will stay open because the fix costs more than the organization can spend this year. That is a legitimate governance decision when directors make it knowingly.

CSF 2.0 subcategory GV.RM-02 calls for risk appetite and risk tolerance statements to be established, communicated and maintained. On the one page, an accepted risk needs four things: what the risk is, why it is being accepted, what it would cost to reduce, and when the board will look at it again. The minutes then record the decision, which also documents the information directors relied on when they made it.

What should you do before the next board meeting?

Before the next board meeting, name a report owner, gather current measures and open findings, refresh the risk register and draft the page. Most organizations can produce a first version in a few weeks with the data they already have.

• Ask the executive director to name one staff owner for the report.
• Have the IT provider export current measures and a list of open findings.
• Build or refresh the risk register, then pick the top three to five risks in mission terms.
• Draft the page using the five blocks above and keep it to one side of one sheet.
• Agree with the board chair or finance committee chair on a standing agenda slot.
• Tie the cyber budget request to the risks it reduces, so the report and the technology budget tell the same story.
• File the page and its appendix with the board packet so the next report can show the trend.

The same material also answers many of the cybersecurity questions on grant applications, so the work pays off twice.

What should your counsel review before the first report goes to the board?

Counsel should confirm which security, breach notice and federal award rules apply before the board adopts its first one-page report, and again when the organization accepts a new federal award or a new vendor starts handling personal information. Bring these questions and documents:

• Whether the reasonable security requirement in Civil Code section 1798.81.5 applies to you, or an exemption in subdivision (e) does, such as the one for HIPAA covered entities. Bring a list of the personal information each program collects.
• Which federal awards were issued on or after October 1, 2024 and fall under 2 CFR 200.303(e), and what added security terms they carry. Bring the award agreements and any subaward terms.
• Who notifies whom when a vendor that maintains your data has a breach, under Civil Code section 1798.82, and whether your contracts require the vendor security that section 1798.81.5(c) calls for. Bring the contracts for vendors that hold donor, client or staff data.
• Whether Corporations Code section 5231 governs your directors, which depends on how the organization is incorporated. Bring the articles of incorporation and bylaws.

How can s90 help?

If your board keeps asking whether the organization is secure and nobody can answer it on one page, or a funder wants proof your controls are working, that is where s90 helps. Through Complete IT, s90 manages IT and security for nonprofits in Los Angeles and Orange County, with proof every quarter that it is working, and our reporting produces the measures, findings and risk register entries that feed a page like this. If your board wants a clearer view of cyber risk, we are glad to walk through what a first one-page report could look like for your organization.