Grant application cybersecurity questions: what should a nonprofit say?

Why are funders asking about cybersecurity now?

Because federal grant rules now name it. The 2024 revision of the Uniform Guidance added a cybersecurity duty to the internal control section: under 2 CFR 200.303(e), recipients and subrecipients must take reasonable cybersecurity and other measures to safeguard information, including protected personally identifiable information and anything the federal agency or pass-through entity designates as sensitive. The revision applies to federal awards issued on or after October 1, 2024, so any new award issued since then carries the requirement.

Pass-through entities carry a second reason to ask. A state agency, county or larger nonprofit that passes federal funds to you must, under 2 CFR 200.332(c), evaluate each subrecipient's fraud risk and risk of noncompliance before deciding how closely to monitor it. The factors it should consider include the results of previous audits and whether the subrecipient has new personnel or new or substantially changed systems. A security questionnaire is one practical way to gather that information. Private foundations are not bound by the Uniform Guidance, so any security questions they ask come from their own application or grant agreement. Either way, your answers become part of what you have represented to the funder.

What do grant application cybersecurity questions usually cover?

Questions vary by funder, and most can be answered by pointing to a recognized baseline. The CIS Controls Implementation Group 1 is a set of 56 safeguards that CIS describes as essential cyber hygiene and a minimum standard for every organization. Most funder questions map cleanly to one of its safeguards:

• Do you require multi-factor authentication? CIS Safeguards 6.3, 6.4 and 6.5 cover MFA for externally exposed applications, remote network access and administrative access.
• Do you back up data and can you restore it? Control 11 covers a documented recovery process, automated backups, protected recovery data and an isolated copy.
• Do staff receive security training? Safeguard 14.1 calls for a security awareness program.
• Do you have an incident response plan? Safeguards 17.1 through 17.3 cover who handles incidents, who to contact and how staff report them.
• Which vendors hold your client or donor data? Safeguard 15.1 calls for an inventory of service providers.
• Do you know where sensitive data lives? Safeguards 3.1 and 3.2 cover a data management process and a data inventory.

Mapping each answer to a safeguard number gives the reviewer a common reference and gives you a consistent answer to reuse across applications. Our CIS IG1 explainer walks through all 56 safeguards.

How should you answer a question you cannot fully say yes to?

State what is true today and the date by which the gap will close. A partial answer with a scheduled fix is something a reviewer can work with. A yes you cannot support becomes a problem the first time a monitor asks for evidence.

That evidence request is more likely than many organizations expect. A nonprofit that spends $1,000,000 or more in federal awards in a fiscal year must have a single or program-specific audit under 2 CFR 200.501(a), and a pass-through entity's monitoring can include its own reviews and site visits. Answers written to win the grant are read again when the monitoring starts. Keep a copy of every questionnaire you submit with the date and the name of the person who signed it.

Which framework should you name in your answers?

Name the one you actually use. For a small or mid-sized nonprofit, CIS IG1 is the most practical starting point because it is specific and finite. If a funder asks about governance, the NIST Cybersecurity Framework 2.0 provides the language: its Govern function covers roles, policy, oversight and supply chain risk, which is how a board-level reviewer tends to think about the question.

California adds a state-law reason to pick a baseline. Civil Code section 1798.81.5 requires a business that owns or licenses personal information about California residents to maintain reasonable security procedures and practices, and section 1798.80(a) defines business for that chapter to include nonprofit organizations. The statute does not define reasonable. In its 2016 Data Breach Report, the California Attorney General named the CIS Controls as the starting point for a reasonable security program. The report is guidance. It remains the clearest public signal of what a California regulator will look for.

What evidence should you have ready before you submit?

Have the documents behind each answer ready to send the same day. Reviewers rarely ask for all of them at once, and the ones they ask for tend to be these:

• A written information security policy and incident response plan, approved by the board or executive director, with the approval date.
• An MFA enrollment report from Microsoft 365 or Google Workspace showing every account, including shared and volunteer accounts.
• Backup job reports and the date and result of the most recent restore test.
• Security training completion records for staff and volunteers who handle client or donor data.
• A vendor list showing which providers hold client, donor or program data, and the security terms in each contract.
• A device inventory showing encryption and endpoint protection status.

If a document does not exist yet, say so in the answer and give the date it will.

What should your nonprofit do this quarter?

Spend one quarter building an answer bank you can reuse for every application and renewal:

• Collect every security question from current applications, grant agreements and subaward terms into one document.
• Assign one owner for the answers, usually the executive director or operations lead, with board visibility.
• Map each answer to a CIS IG1 safeguard and mark it as in place, partial or planned.
• Close the cheapest gaps first: MFA on email, finance and donor systems, and a tested backup restore.
• Have the board approve the security policy and incident response plan, and record the date in the minutes.
• Review the answer bank before each grant cycle so the answers stay current.

How does s90 help?

s90 is a managed IT provider for nonprofits and social service agencies in Los Angeles and Orange County. We map your controls to CIS IG1 and NIST CSF 2.0, keep the reports funders ask for current, and help your team answer security questionnaires accurately. Our agreements include 72-hour breach notification and 24-hour evidence production, so when a monitor asks for proof, you have it. Talk to s90 before your next grant application.