How should you build a nonprofit technology budget for next fiscal year?

If you are an executive director or finance lead building next year's budget, technology is often the line that gets cut first and noticed last. A nonprofit technology budget built around programs shows the board, your auditor and your funders what your services depend on and what it costs to keep them running.

Why should a nonprofit treat technology as mission infrastructure?

A nonprofit should treat technology as mission infrastructure because its programs stop when technology fails. Case management, donor records, payroll, grant reporting and client communication all run on the same accounts, laptops and cloud services. When technology is budgeted as whatever overhead is left over, replacements get deferred, security tools are the first thing cut, and the organization learns what it depends on during an outage.

The board has a stake as well. California's Corporations Code section 5231 requires directors of a nonprofit public benefit corporation to act in good faith and with the care, "including reasonable inquiry," that an ordinarily prudent person in a like position would use. A technology budget the finance committee can read and question gives directors something concrete to inquire into.

How much should a nonprofit spend on technology?

There is no required percentage. The Uniform Guidance decides which technology costs a federal award can pay for and how they are charged, and it does not set a share of the budget that must go to technology. A survey average tells you what other organizations spent, not what your programs need.

A more defensible number is one you build from your own headcount, asset list and risk, using the three lines below. A finance committee can question that figure line by line, which a borrowed percentage does not allow.

What belongs in a nonprofit technology budget?

A nonprofit technology budget needs three lines: recurring per-person costs, scheduled replacement, and a reserve. Together they cover almost everything a small or midsize organization spends on technology.

Recurring costs, per person

• Email and productivity licenses, including the security features that come with higher license tiers.
• Endpoint protection, email filtering and multifactor authentication. Our list of free cybersecurity wins for nonprofits covers controls to turn on before you buy anything.
• Backup for cloud data and for any servers still in the office, sized to the records your document retention policy says you must keep.
• Managed support or internal IT staff time.
• Security awareness training for staff and regular volunteers.

Expressing these as a per-person figure makes the budget scale with headcount. When a program adds four case managers, the technology cost of those hires is already known instead of discovered in the middle of the year.

Scheduled replacement

Laptops, firewalls, Wi-Fi access points and servers wear out on predictable schedules. Divide each asset's replacement cost by its expected life and fund that amount every year, so a replacement never arrives as an emergency request. Any server still running Windows Server 2016 belongs in this line now, because Microsoft ends its security updates on January 12, 2027.

A reserve

A modest reserve for incident response, an unexpected hardware failure or an unplanned audit request keeps one bad week from eating into a program budget. Size it to what your organization could not absorb from operating cash.

Can federal grant funds pay for technology?

Yes, when the cost is allowable and allocable to the award. Federal awards can pay for technology either as a direct cost or through your indirect cost rate. For recipients and subrecipients, three provisions of the Uniform Guidance matter most.

• Computing devices can be direct costs. 2 CFR 200.453(c) says charging computing devices as direct costs "is allowable for devices that are essential and allocable, but not solely dedicated, to the performance of a Federal award." A laptop a caseworker uses on a funded program can be charged to that award to the extent it is allocable to it.
• Most devices are supplies. Under the 2 CFR 200.1 definitions, equipment is property with a useful life of more than one year and a per-unit cost at or above the lower of your capitalization level or $10,000. A computing device that costs less than that threshold is a supply, regardless of its useful life, so it is handled under the supplies rules rather than the equipment management rules.
• Indirect costs have a simple option. A recipient without a current negotiated indirect cost rate may elect a de minimis rate "of up to 15 percent of modified total direct costs (MTDC)," and that rate "does not require documentation to justify its use."

Costs must be charged consistently, as either direct or indirect, never both. How a specific cost is treated under a specific award is a question for your finance lead, auditor and program officer, and the answer belongs in writing before the budget is final.

Do federal grants require cybersecurity measures?

Yes, for federal awards issued on or after October 1, 2024. The 2024 revision of the Uniform Guidance amended 2 CFR 200.303(e) to require recipients and subrecipients to "take reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information." The rule does not list specific tools, so each organization decides and documents what reasonable means for its own data. An organization that expends $1,000,000 or more in federal awards during its fiscal year must also have a single or program-specific audit under 2 CFR 200.501(a), and that audit looks at internal control over the federal programs.

State law reaches nonprofits too. California's customer records chapter defines "business" to include nonprofit organizations in Civil Code section 1798.80(a), and section 1798.81.5 requires a business that owns, licenses or maintains personal information about California residents to implement and maintain reasonable security procedures and practices. The statute's definition of personal information covers a name combined with items such as a Social Security number, a financial account number with its access code, or medical information, which describes many client and donor records.

Where does technology spending go on Form 990?

Technology spending goes on line 14, Information technology, in Part IX of Form 990, the Statement of Functional Expenses. Each expense is split among program services, management and general, and fundraising. Shared costs are allocated across those columns, so technology that supports programs does not all have to land in management and general, which matters to anyone who reads your return for overhead. A budget built around programs makes that allocation easier to support when the return is prepared.

What should a nonprofit do this quarter to build its technology budget?

Start with five steps a finance lead can finish before the budget goes to the finance committee.

1. List every recurring technology charge and divide the total by headcount to get a per-person figure.
2. Inventory devices and servers with purchase dates, and flag anything past its expected life or still running Windows Server 2016.
3. Ask your finance lead how technology is charged on each federal award today: as a direct cost, through the indirect rate, or not at all.
4. Check whether federal spending could reach the $1,000,000 single audit threshold in the coming fiscal year.
5. Bring the three-line technology budget to the finance committee with a short note on the risk of deferring each line.

How s90 helps

s90 supports nonprofits and social service agencies across Los Angeles and Orange County. We build the asset inventory and replacement schedule, give your finance team a per-person cost model that drops into the budget, and document security controls in a form your auditor and funders can follow. If a conversation would help as you build next year's budget, reach out.