Security checklist
Charity cybersecurity checklist for nonprofit technology teams
Charity cybersecurity should start with boring controls that staff can actually run. This checklist connects source-checked nonprofit benefits to the security jobs that reduce real operational risk.
First controls
- Turn on multi-factor authentication for email, admin, finance, CRM, and website accounts
- Keep an account owner register for staff, trustees, volunteers, agencies, and contractors
- Separate public website admin access from general shared accounts
- Store recovery codes and domain/DNS ownership details where more than one trusted person can access them
File and data controls
- Classify donor, beneficiary, employee, volunteer, trustee, and public data
- Use Google, Microsoft, Box, or Adobe document workflows consistently rather than scattering files
- Set external sharing rules before inviting partner organisations
- Review access after staff, trustee, volunteer, or supplier changes
Website and cloud controls
- Use Cloudflare or an equivalent DNS/security layer for exposed public-interest sites
- Use Cisco infrastructure grants only when network, security, support, procurement, and lifecycle ownership are clear
- Use Splunk donations only when log sources, data sensitivity, retention, alert ownership, and training time are clear
- Use AWS or Azure credits only with budget alerts, tagging, and a technical owner
- Document incident contacts before a campaign or public controversy
- Review backups and restore procedures before they are needed
Related tools
Interactive tool
Charity cyber insurance readiness checker
Check whether a charity has the operational evidence often requested before cyber insurance quotes, renewals, trustee review, or supplier due diligence. The checker scores controls, highlights urgent warning signs, and links to source-checked security benefits without giving insurance advice or quoting premiums.
Interactive tool
Charity cybersecurity budget calculator
Estimate a practical annual cybersecurity budget before buying tools or applying for nonprofit security benefits. The calculator separates software or service spend from internal staff time, incident readiness, backups, DNS and website protection, identity controls, logging, training, and supplier access review.
Interactive tool
Charity IT support budget calculator
Estimate a practical annual IT support budget before hiring an IT supplier, renewing managed services, expanding Microsoft or Google administration, or adding security monitoring. The calculator separates outsourced support spend from internal admin hours, device support, backups, onboarding, cloud operations, website/DNS support, and software governance.
Interactive tool
Charity cloud hosting cost calculator
Estimate a practical annual cloud hosting and operations budget before applying for AWS, Azure, Cloudflare, GitHub, GitLab, mapping, or monitoring routes. The calculator separates recurring cloud run rate from one-off migration work, internal admin hours, budget-alert controls, backups, environments, traffic, storage, and supplier support.
Interactive tool
Charity data protection readiness checker
Check whether a charity has practical evidence ready before launching forms, fundraising campaigns, CRM migrations, AI tools, beneficiary systems, staff data workflows, or supplier questionnaires. The checker scores operational readiness and links to official ICO guidance without giving legal advice.
Interactive tool
Charity password and access security checker
Check whether a charity has the core access controls needed before expanding software accounts. The checker gives a risk band, an action list, and source-checked benefits to review; it does not replace professional security advice, legal advice, or provider eligibility checks.
Interactive tool
Nonprofit software eligibility checker for UK charities
Check whether a charity has the evidence, ownership, and workflow clarity needed before applying for nonprofit software benefits. The checker does not decide eligibility; it builds a practical application checklist and links to source-checked provider pages.
Interactive tool
Nonprofit software savings calculator for UK charities
Estimate the annual value of reviewing charity software costs across email, design, CRM, project tools, cloud, security, AI, documents, and marketplace routes. The calculator does not promise savings or eligibility; it helps prioritise what to verify.
Decision notes
- Cloudflare Project Galileo can be relevant for public-interest organisations exposed to attack, but it requires an application and DNS ownership.
- Cisco Technology Grant Program can be relevant for nonprofit networking and security infrastructure, but charities should choose the Cisco-managed or TechSoup pathway only after checking current eligibility, country availability, and support ownership.
- Splunk Product and Training Donation Program can support security analytics and observability, but charities need a clear owner for log ingestion, retention, alert response, and staff training.
- Cloud credits are not a security plan; charities need budgets, least-privilege access, and monitoring.
- This checklist is operational guidance, not a replacement for professional security, legal, or regulatory advice.