You are reading Part 11 of our 12-part Non-Profit Authority Series.
A non-profit board does not need to manage firewalls or understand every security product, but it should understand the organization’s major cyber risks, security controls, recovery capability, accepted risks, and accountability structure. For a 15-30 employee non-profit, a practical board discussion can focus on seven questions covering devices, users, Microsoft 365, backups, incident response, compliance readiness, and risk ownership. The goal is governance, not technical micromanagement.
The 7-Question Board Cybersecurity Framework
Board members should be able to ask:
- What are we protecting?
- How are devices protected?
- How are users and identities protected?
- What happens if security controls fail?
- How would we recover?
- What compliance or insurance expectations apply?
- What risks have we consciously accepted?
If leadership cannot answer these questions clearly, the organization may need better documentation or stronger technology governance.
1. What Are We Protecting?
Cybersecurity begins with understanding what matters.
For a non-profit, important assets may include:
- Donor information
- Financial information
- Employee records
- Grant documentation
- Microsoft 365 data
- Shared files
- Credentials
- Program information
- Board documents
- Critical applications
The board does not need a technical inventory at every meeting.
It should, however, understand which systems and information are business critical.
That makes later discussions about security spending more meaningful.
2. How Are Devices Protected?
Boards should understand the basic endpoint-security model.
WTITC’s Essentials Security Package includes:
- Antivirus
- Endpoint Detection and Response
- Unified device backup
- Datto SaaS Protection where applicable
The $40-per-endpoint Managed Services Fee also includes Datto RMM monitoring and patching.
A board-level question might be:
Are our managed workstations and servers protected, monitored, and patched consistently?
That is more useful than asking which antivirus brand is installed.
The goal is to understand whether endpoint security is actively managed.
3. How Are Employees, Email, and Identities Protected?
Modern cybersecurity cannot focus only on devices.
Employees may receive phishing messages, lose credentials, approve fraudulent requests, or unintentionally expose information.
WTITC’s Complete Security Package adds:
- Inky email security
- BullPhish ID security awareness training
- Dark Web ID monitoring
- SaaS Alerts
- Microsoft 365 management and maintenance
The Complete package is WTITC’s standard recommendation for most organizations.
A layered ransomware strategy protects devices, users, email, cloud identities, and recovery capabilities instead of relying on antivirus alone.
The board does not need to understand every tool. It should understand whether the organization has multiple layers of protection and whether user risk is being addressed.
4. What Happens When Prevention Fails?
No credible IT provider should promise that a cyber incident will never occur.
Boards should therefore ask what happens after suspicious activity is detected.
Questions may include:
- Who receives security alerts?
- Who investigates?
- Who can isolate a device?
- When is leadership informed?
- When is the cyber insurer contacted?
- When are legal or regulatory advisors involved?
- Who communicates internally?
- How is the event documented?
The purpose is to establish accountability before an incident occurs.
Incident response should not depend on improvisation under pressure.
5. How Would We Recover?
Boards should understand the difference between having backups and having a broader continuity plan.
Useful governance questions include:
- What systems are backed up?
- Is Microsoft 365 data protected?
- Are restorations validated?
- Which systems are business critical?
- How long could operations tolerate downtime?
- Do we need BCDR?
- Who decides recovery priorities?
Recovery capability should be tied to business impact.
A program-serving system may deserve a different recovery priority than a low-impact administrative application.
6. Are We Prepared for Compliance, Insurance, and Audit Questions?
Non-profits may face cybersecurity expectations from:
- Regulators
- Cyber insurers
- Grant requirements
- Contracts
- Funders
- Auditors
- Partners
Technology controls cannot guarantee compliance, but they can help an organization document active management.
A structured security and compliance review helps leadership identify gaps, gather evidence, document controls, and prepare for regulatory, insurance, grant, or audit questions.
Boards should ask whether the organization can produce evidence such as:
- Device inventories
- Access records
- Training records
- Patch information
- Backup information
- Security controls
- Review documentation
- Risk decisions
That can support regulatory compliance readiness and improve audit readiness.
7. What Risks Have We Accepted?
Add Text here
- Add bullets here
Add Text here
Add H2 Header Here
Not every risk can or should be eliminated.
Some controls are optional.
WTITC specifically identifies:
- BCDR
- Third-party penetration testing through Vonahi
- Compliance Manager
A business that wants its IT provider to accept full responsibility for risk while repeatedly refusing recommended security, lifecycle, or recovery improvements may not align well with WTITC’s proactive service model.
That distinction matters because risk ownership ultimately belongs to organizational leadership.
An IT provider can advise, monitor, manage, and recommend. It cannot make every business decision on behalf of the client.
Hypothetical Example: A Quarterly Board Cybersecurity Discussion
Consider a hypothetical 25-employee Odessa non-profit with 29 managed endpoints.
Instead of reviewing technical dashboards, the board receives a concise quarterly technology summary covering:
- Significant security risks
- Security controls in place
- User-security training status
- Backup and recovery status
- Aging equipment
- Open recommendations
- Risks leadership has chosen to defer
A board member asks whether BCDR has been implemented. Management explains that it has not and outlines the recovery risk associated with that choice. That is a productive governance discussion. The board does not need to configure backups.
It needs to understand the business consequence of the decision.
Board Cybersecurity Checklist
Boards should periodically ask:
- What are our most important technology risks?
- Are all managed endpoints monitored and patched?
- Is EDR deployed?
- How is email protected?
- Are employees trained?
- How is Microsoft 365 managed?
- Are backups monitored?
- Have recovery expectations been defined?
- Do we need BCDR?
- Do we have an incident escalation process?
- What evidence could we provide during an audit?
- What compliance or insurance requirements affect us?
- Are unsupported systems still in use?
- Which security recommendations have been declined?
- Who owns those risk decisions?
What Should the Board Expect From Its IT Provider?
The board should expect clear, business-level explanations.
WTITC’s managed services model is designed around:
- Security
- Reliability
- Predictable costs
- Monitoring
- Documentation
- Technology alignment
- Clear accountability
- Long-term planning
For general budgeting, a properly secured managed environment can reasonably fall around $125-$175 per endpoint per month, with actual pricing depending on endpoints, users, security requirements, environment size, optional services, projects, and other factors.
The board does not need to manage the technical details. It does need enough visibility to make informed risk decisions.
Explore managed services that give leadership clearer visibility into security, risk, documentation, recovery, and long-term technology decisions.
