Safeguarding sensitive supporter and donor information should be a top priority for nonprofit institutions seeking to cultivate lasting, trust-based relationships.
As data breaches increasingly threaten to compromise contributors’ personal details, comprehensive cybersecurity strategies and specialized liability insurance for nonprofits prove essential.
Assessing Cybersecurity Risks
Before a nonprofit organization can strengthen its security posture, it helps to understand the common vulnerabilities within the sector fully. A Bloomerang study shows some worrying statistics:
- 38% of nonprofits lack formal, documented policies on handling cybersecurity risks, equipment usage, and data privacy.
- 68% of nonprofits don’t have incident response plans outlining steps to take in the event of a cyber attack.
- 56% of nonprofits don’t use multi-factor authentication or other controls to limit access to sensitive donor data.
These statistics indicate that many organizations have major gaps in policies, plans, and access controls surrounding donor data security. Real-world examples of data breaches and cyber attacks aimed at nonprofits further demonstrate the need for better security:
- In 2017, the large international nonprofit Save the Children was scammed out of nearly $1 million.
- In 2015, the Utah Food Bank had 10,000 donor records containing personal information stolen due to a website hack.
- In 2015, a smaller organization called Red Barn lost its website and entire digital presence during a major online fundraising campaign due to a hack.
The impacts of these attacks ranged from massive financial loss to permanent reputation damage. To avoid becoming another statistic, nonprofits must thoroughly evaluate security vulnerabilities by auditing technology systems, documenting digital assets, reviewing policies, and cataloging access controls.
This makes identifying weaknesses in donor data protection that require priority attention is easier.
Implementing Safeguards
Once organizational cybersecurity vulnerabilities have been identified, nonprofit entities can start taking action to implement security safeguards and risk reduction measures.
Invest in Secure Software Platforms
Nonprofits should invest in secure software solutions such as encrypted donor databases, fundraising platforms, CRMs, and email tools that safeguard sensitive donor data in motion and at rest using encryption, tokenization, and multi-factor authentication.
Establish Strong Password Policies
Organizations should institute strong password policies requiring 8+ characters, including uppercase, lowercase, numbers, and symbols without dictionary words or personal information. Deploying password management software for secure generation and storage is also advisable.
Promptly Install Software Updates
Nonprofits should keep all software updated to fix security vulnerabilities as discovered, but backup systems and check changelogs first to understand the impact and risk of new releases. Prompt updating reduces the window of exposure.
Obtain SSL Certificates
Entities should obtain SSL certificates to enable HTTPS website encryption to secure donor data entry and verify site validity.
Control User Access
Organizations should tightly control software user accounts and access permissions based on roles and data needs rather than providing universal access, which risks entire databases. Multi-factor authentication should be added.
Set Up Network Protections
Nonprofits should implement network protections such as firewalls to block threats by monitoring traffic and VPNs to encrypt data tunnels, hiding IP addresses and identifiers.
Developing Cybersecurity Policies
While technical controls are key, comprehensive cybersecurity policies and procedures make security sustainable long-term for nonprofits. Organizations should have a formal incident response plan outlining steps to contain breaches and attacks to minimize damage.
Response teams should be designated and rehearsed regularly. Rapid response capability manages crisis events better. Nonprofits should invest in regular cybersecurity training for all staff and volunteers as they represent the front line of defense.
Policies and procedures should be reviewed on onboarding and when changes occur. Everyone’s role in protecting donor data should be reinforced, from executives to interns. Organization-wide security awareness should be fostered.
Entities should conduct periodic risk assessments to identify new vulnerabilities as technology and threats evolve. Audits should be scheduled to measure policy compliance using third-party experts for unbiased evaluation.
Penetration testing to probe for weaknesses should be explored. Ongoing assessments ensure controls continue working. Organizations should explore specialized cyber liability insurance for nonprofits to help manage costs after a data breach or hack. Policies can offset legal, investigation, notification, and credit monitoring expenses.
Importantly, insurers require minimum cybersecurity policies as a condition of coverage, which drives nonprofits to implement better data protection. Coverage also protects nonprofits from financial ruin.
Protecting Donor Data with Secure Technology
Protecting donor data relies heavily on secure software, platforms, and systems. Here are some best practices that technology-focused nonprofits employ:
- Encrypt donor data end-to-end along every step of the transaction and communication process. Build encryption into fundraising platforms, donor management systems, email programs, and website interactions.
- Anonymize donor data via tokenization whenever possible. This replaces sensitive fields such as names, emails, and credit card numbers with random tokenized values.
- Transmit donor data only via secure protocols such as HTTPS, SFTP, SSL, TLS 1.2+, or other strong encryptors. Never send plain text data.
- Collect only the minimum donor information required for your work. Limiting data exposure reduces risk.
- Control access with role-based permissions and multi-factor authentication. Only allow changes to donor profiles with secondary approval and audit logging.
- Mask sensitive donor fields from regular users. Payment info and health details should only be visible when required.
- Implement data loss prevention controls that watch for suspicious transfers of donor information outside the organization.
- Have secure backup and recovery systems in place. Back up donor databases nightly to enable fast restoration after an attack or failure.
Nonprofits Work with CI Solutions to Elevate Donor Protection
Nonprofits must prioritize multifaceted cybersecurity strategies to safeguard donor data and build lasting, trust-based supporter relationships.
Implementing secure systems, comprehensive policies, ongoing training, encrypted backups, role-based access controls, and liability insurance coverage allows nonprofits to reinforce data stewardship despite proliferating threats.
The CI Solutions team specializes in customized cyber liability insurance tailored specifically to meet the needs of today’s nonprofit entities. We take the time to understand each organization’s unique risks and requirements truly.
Contact us today at 703.988.3665 or online to discuss your nonprofit’s cybersecurity insurance and risk management needs.