Nonprofit Leadership’s Role in Cybersecurity

As technology experts, we cringe every time we hear a story about ransomware and data breaches. We regularly advise our clients on best practices, and provide services to help minimize cybersecurity risk. However, we are not cybersecurity experts, lawyers, or insurance agents. In fact, if your organization experiences a cybersecurity event, there isn’t much we can do! But we can recommend that nonprofit leadership consider some options that will protect your organization in the event of a breach or cyber attack.

Have you ever been involved in an emergency situation? A car accident, an injury at your organization, a bomb threat etc… in the heat of the moment, it’s stressful and hard to think. That’s why you plan ahead! You might have handbooks for Emergency Evacuation Procedures and Building Safety Protocols, and carry liability insurance and property insurance. All of this is a part of a plan to ensure your organization is protected and everyone knows what to do when an emergency arises.

Cybersecurity must be part of this strategic plan.

Has your Board had a discussion about cybersecurity? There are liability risks for any organization with a data breach. If that were to happen today, would the Board, Executive Director, and staff know what to do? If you’re not sure, we recommend having that conversation sooner rather than later. Here are a few things to start thinking about:

• Who is the point person in the organization if there is a cybersecurity event?
• Do you educate employees about phishing, email cloning, suspicious links etc. in the onboarding process, and on an ongoing basis?
• Is there a manager in charge of overseeing all technology projects to make sure preventative measures are taken across the board?
• Do you have a technology protocol handbook, and solid password policies?
• Do you have a cybersecurity event plan?
• Do you have an experienced cyber response team?
• Do you have a Cyber Consultant?
• Do you have Cyber Insurance?

Consider Cyber Insurance

At BackOffice Thinking, we decided it was important for us to carry Cybersecurity Insurance. We asked our agent, Mark D. Sammarone of Arthur Hall Insurance, to provide information on what Cyber Insurance is and what to consider for your own decision-making. Here is what he said:

• Cyber insurance provides support when you need to respond to cyber threats / attacks / breaches. Ransomware is one of the biggest threats today.
  • A cyber insurance policy can provide you with a breach response team at your fingertips, a Lawyer, a third party investigator to show transparency, and they may be able to provide a multi-state response.
  • Cyber coverage endorsed onto your property and liability policy is not the same as a separate policy!
• The right advisors can make all the difference.
  • If something goes wrong, who are you tendering the problem to? An IT company isn’t in the position to understand the legal and regulatory requirements you are responsible for.
• The potential impact of a breach is enormous.
  • Don’t forget the importance of reputation, especially when it comes to a non-profit organization. Many policies provide consultation on protecting your reputation, and can actually help to write what is released to your donors and the public.
• Protection starts with your own processes.
  • When you purchase Cyber Insurance, your nonprofit is responsible for identifying all the sources of data and where it is stored. Identify who has access to the different data sources and what level of access they have. Take everyone’s security levels and clean them up now. Don’t give everyone Admin access.
• As you build your cyber plan, consider a few of the recommended guidelines from this White House Fact Sheet.
• Assess your organization’s risk level.
  • Use this scorecard to determine what your risk exposure is. This list is also a great starter for your cyber plan.

If you know anything about us at BackOffice Thinking, you know we are big fans of doing what’s possible now, and planning for growth at the same time. You can’t go from nothing to a fully written out cyber plan overnight. Take it in phases. Get started and assess your situation. Make a list of what you can’t get to right away, and make a plan to review it over time.

Make preparations for a cybersecurity breach now, and you’ll save a lot of time and scrambling in the event of an emergency.

More from Our Series on Cybersecurity:

• Proactive Cybersecurity Action for Your Website and CiviCRM
• Protect Your WordPress Ecosystem
• Salesforce Password Security Practices

Additional Resources:

• National Council of Nonprofits article on Cybersecurity
• Arthur Hall Insurance
• NTEN’s 2020 Guide to cybersecurity
• White House – FACT SHEET: Act Now to Protect Against Potential Cyberattacks
• Cyber Risk Exposure Card