You are reading Part 2 of our 12-part Non-Profit Authority Series.
A non-profit should prepare for ransomware using a 5-layer defense and recovery framework: protect endpoints, protect users, monitor activity, maintain recoverable data, and establish a response plan. No security product can guarantee that ransomware will never occur. For a 15-30 employee organization, the objective should be to reduce the likelihood of compromise, detect suspicious activity quickly, limit the damage, and create a realistic path to restoring operations if an incident succeeds.
The 5-Layer Ransomware Defense and Recovery Framework
Ransomware preparation should address five separate layers:
- Endpoint protection
- User and email protection
- Monitoring and detection
- Backup and recovery
- Incident preparation
Organizations become vulnerable when they treat one of those layers as a substitute for all the others.
1. Protect the Endpoint Before Ransomware Executes
Workstations and servers need more than basic antivirus.
WTITC’s Essentials Security Package includes antivirus and Endpoint Detection and Response, along with unified device backup and Datto SaaS Protection where applicable.
Endpoint Detection and Response is important because ransomware and other malicious activity may not always resemble a traditional known virus. Security controls should help identify suspicious behavior and provide the IT team with information needed to investigate and respond.
Endpoints also need consistent patching.
The $40-per-endpoint Managed Services Fee includes Datto RMM monitoring and patching plus proactive alerting and remediation. This allows endpoint health to be managed as an ongoing operational responsibility rather than waiting for employees to report problems.
2. Protect the User, Email, and Identity
Technology alone cannot eliminate human risk.
Email remains an important path into business environments, and a compromised identity can create problems even when the employee’s physical computer is functioning normally.
WTITC’s Complete Security Package adds:
- Inky email security
- BullPhish ID security awareness training
- Dark Web ID monitoring
- SaaS Alerts
- Microsoft 365 management and maintenance
A properly managed Microsoft 365 environment adds user, email, identity, and cloud-service protection to an organization’s endpoint security strategy.
For a non-profit, that matters when staff members regularly communicate with donors, volunteers, vendors, board members, and outside organizations.
Training also helps employees recognize suspicious messages rather than treating cybersecurity as solely an IT department responsibility.
3. Detect Problems Before They Become Larger Incidents
A security tool that generates an alert is useful only if someone is positioned to review and act on that information.
WTITC’s Tiered Technology Fee supports 24/7 monitoring infrastructure, security operations, alert triage, automation, internal escalation, and service management.
This does not mean every incident can be prevented. It means the environment is being actively managed instead of relying entirely on an employee to notice that something is wrong.
Technology alignment contributes here as well. Recurring weaknesses, missing controls, poor documentation, outdated systems, and unmanaged access can increase risk over time. Identifying those gaps before an incident is part of building a more resilient environment.
4. Understand the Difference Between Backup and Business Continuity
Having a backup does not automatically mean an organization has a complete disaster recovery strategy.
Questions leadership should ask include:
- What data is being backed up?
- How frequently is it protected?
- Has restoration been validated?
- Where are backups stored?
- How quickly could critical operations resume?
- What happens if a server is unavailable?
- What happens if cloud data is deleted or compromised?
- Who makes recovery decisions?
WTITC offers Business Continuity and Disaster Recovery as an a la carte service because recovery requirements vary between organizations.
Backup protects data, while a properly designed BCDR strategy addresses how the organization will restore systems and continue operating after a serious disruption.
If BCDR is declined, leadership should understand the additional operational and recovery risk it is accepting.
5. Build an Incident Response Decision Process
A ransomware response plan should define what happens before anyone is under pressure.
At minimum, leadership should identify:
- Who employees contact when suspicious activity is discovered.
- Who has authority to isolate affected systems.
- Who communicates with leadership and the board.
- How cyber insurance contacts are involved when applicable.
- How legal or regulatory advisors are engaged when necessary.
- How recovery priorities are determined.
- How the organization communicates internally during an outage.
The exact process depends on the organization, its data, insurance coverage, regulatory obligations, and contractual requirements.
Cybersecurity controls can support regulatory compliance readiness, provide evidence for audits, and help document active management, but they do not guarantee legal or regulatory compliance.
Example: A Suspicious Email at a 19-Employee Non-Profit
Consider a hypothetical 19-employee Odessa non-profit with 21 managed endpoints.
An employee receives an email that appears to come from a familiar outside contact and is asked to open a document and enter Microsoft 365 credentials.
In an environment relying primarily on antivirus, the malicious activity might not involve a traditional infected attachment at all. The attacker may be trying to steal the employee’s cloud credentials.
A layered environment would approach the situation differently:
- Email security provides an initial filtering layer.
- Security awareness training helps the employee recognize warning signs.
- Microsoft 365 management strengthens the cloud environment.
- SaaS monitoring can provide additional visibility.
- Endpoint protection addresses device-level threats.
- Monitoring and escalation provide a process for responding to alerts.
- Backup and BCDR planning establish options if systems or data are affected.
The expected result is not “ransomware becomes impossible.” The result is multiple opportunities to prevent, detect, contain, and recover from an incident.
Ransomware Readiness Checklist for Non-Profit Leadership
Ask your IT provider:
- Do we have EDR on managed endpoints?
- Are workstations and servers being patched?
- How is email protected?
- Are employees receiving security awareness training?
- How is Microsoft 365 managed?
- Are suspicious SaaS activities monitored?
- What data is backed up?
- Have restoration procedures been validated?
- Do we have BCDR where the operational risk justifies it?
- Who reviews security alerts?
- What is our incident escalation process?
- What evidence can we produce for an insurer, auditor, funder, or compliance review?
The board should understand these issues at the risk-management level rather than needing to become cybersecurity technicians. A useful board cybersecurity discussion focuses on controls, recovery capability, accepted risk, accountability, and evidence rather than technical jargon alone.
What Should a Non-Profit Expect From Its IT Provider?
The provider should be able to explain which controls are present, which are optional, what the organization has declined, and what risk remains.
WTITC’s approach combines endpoint management, security packages, monitoring, documentation, user protection, and technology alignment. BCDR and other specialized risk-management services can then be added where appropriate.
For planning purposes, a properly secured managed environment can reasonably fall in the $125-$175 per endpoint per month range, but actual pricing varies based on the security package, users, endpoints, environment size, optional services, projects, and other requirements.
Explore managed services that protect users, devices, cloud systems, and business operations through proactive security management.
