fbpx

< Back to Thought Leadership

Cyber Security for Not-For-Profits

Data breaches can occur in any organization, and not-for-profits (NFPs) are not immune. Oftentimes NFPs can be at risk because their systems are not up-to-date or are simplistic in nature. It’s very important for NFPs, especially those that collect donor or member information (including names, addresses, email addresses, and credit card information), to address cyber security frequently and holistically. Data breaches don’t have to just mean cyber attacks, either. They can be caused by human error, like employee misplacement of equipment; i.e. laptops, smartphones or flash drives. Most cyber attacks can be prevented through a more vigilant approach to cyber security. There are several components to consider when assessing your organization’s overall security.

There are four cyber security principles to consider:

  • Confidentiality – ensuring information is protected from unauthorized access.
  • Availability – ensuring information and systems are reliable and available for end users.
  • Integrity – ensuring information is protected from unauthorized changes.
  • Security – ensuring that information is confidential, available, and held in integrity through the use of appropriate controls.

There are several controls or tools to consider to improve your organization’s cyber security.

  • Access controls – do you have strong passwords? Are they changed often? Passwords should be user specific and never shared.
  • Encryption – messages can be encrypted for secure delivery; this feature is becoming more cost effective, especially for smaller organizations as security needs increase.
  • Backups – off-site backups are a key component of security.
  • Firewalls – create a barrier between your secure systems and the rest of the internet.
  • Anti-virus and anti-malware software – invest in good software, which includes regularly installing updates from the vendors.

Have a plan for your organization that considers the factors above. Some additional components to consider when developing your organization’s plan include considering:

  • What’s important? Determine critical assets and what the threats could be.
  • How to be proactive? Include controls to prevent problems, not just to detect them.
  • Are we changing as often as necessary? Look at cyber security on an annual basis at a minimum and adjust accordingly.
  • Do we have the right people? Sometimes it’s necessary to outsource security needs to an information technology (IT) firm. There are firms that specialize in NFP security available.
  • Is open dialogue encouraged? All employees of an organization should be involved in assessing risk on a day-to-day basis. Encourage open dialogue if circumstances appear risky or out of the ordinary.
  • Is proper training in place? Educating employees about all aspects of the security plan, as well as current security threats, is key to preventing data breaches.

For more information, please visit the American Institute of CPAs Cybersecurity Resource Center.

If you would like to discuss your organization’s particular cyber security needs, please contact Tom Skoog, head of our IT Advisory Services, at tskoog@blueandco.com.

quickbooks desktop discontinued

QuickBooks Desktop No Longer Available for New Subscriptions after July 2024

By Nancy Orben, CPA, Senior Manager at Blue & Co. Intuit has announced an official cutoff date for new purchases of QuickBooks Desktop. How does this effect you? If your […]

Learn More
donor advised funds

IRS Proposed Regulations: Impact on Donor Advised Funds

By Corey Schunemann, CPA, Manager at Blue & Co. The IRS issued proposed regulations that could dramatically affect the landscape and operations of Donor Advised Funds (“DAF”). While many organizations […]

Learn More

Participate in the 2024 Dental Survey: Help Blue & Co. Offer Better Solutions for the Dental Industry

Since 1995, Blue & Co. has partnered with private practice dentistry to give something back to the profession that our dental clients desperately needed: good data. And we aim to […]

Learn More