You are reading Part 8 of our 12-part Non-Profit Authority Series.
A non-profit should prepare for an IT security or compliance review by documenting what systems it uses, who has access, which security controls are active, how data is protected, how incidents are handled, and how risks are reviewed over time. For a 15-30 employee organization, the objective is not to collect paperwork at the last minute. The stronger approach is to maintain evidence continuously so the organization can respond to regulators, insurers, grant requirements, auditors, or other reviewers with clear documentation of active technology management.
The 6-Part Security and Compliance Readiness Framework
Leadership can prepare using six categories:
- Inventory
- Access
- Security controls
- Backup and recovery
- Policies and evidence
- Ongoing review
This framework helps turn compliance readiness into an operational process rather than an annual scramble.
1. Know What Technology You Actually Have
The first step is establishing an accurate inventory.
That should include:
- Workstations
- Servers
- Network equipment
- Microsoft 365
- Cloud applications
- Security tools
- Backup systems
- Critical vendors
- Administrative accounts
An organization cannot demonstrate control over an environment it cannot clearly describe.
WTITC uses IT Glue documentation as part of the Managed Services Fee to help maintain structured information about the environment.
Accurate documentation can also improve support efficiency and reduce dependency on one employee or technician.
2. Document Who Has Access
Reviewers frequently care about who can access sensitive systems and data.
Leadership should understand:
- Who has standard user access
- Who has administrative privileges
- How accounts are created
- How accounts are disabled
- How departing employees are handled
- Whether shared accounts exist
- Whether privileged access is limited appropriately
- Whether changes are documented
Microsoft 365 is especially important because a single user identity may provide access to email, files, collaboration tools, and cloud data.
A properly managed Microsoft 365 environment gives leadership clearer control over identities, email, cloud access, and user-security responsibilities.
For many organizations, this supports stronger audit readiness and better evidence of active access management.
3. Be Able to Explain Security Controls
A reviewer may not need every technical detail, but leadership should be able to explain the security structure at a high level.
WTITC’s Essentials Security Package includes:
- Antivirus
- Endpoint Detection and Response
- Unified device backup
- Datto SaaS Protection where applicable
WTITC’s Complete Security Package adds:
- Inky email security
- BullPhish ID security awareness training
- Dark Web ID monitoring
- SaaS Alerts
- Microsoft 365 management and maintenance
The Complete package is the standard recommendation for most organizations.
That distinction helps leadership explain how the organization protects both devices and users.
A useful review question is:
Which risks are these controls designed to address, and what risks remain?
That is a stronger answer than simply listing product names.
4. Document Backup, Recovery, and Incident Response
Reviewers may ask what happens if data is lost, systems fail, or the organization experiences a security incident.
Leadership should be prepared to explain:
- What is backed up
- How often
- Who monitors backups
- Whether recovery has been tested
- Whether BCDR is in place
- What the incident escalation process looks like
- Who contacts insurers or advisors when needed
- How leadership is notified
A documented backup and BCDR strategy helps a non-profit explain how it protects critical information and plans to restore operations after a serious disruption.
BCDR is offered separately by WTITC because organizations have different continuity requirements.
If it is declined, the associated operational risk should be understood and acknowledged.
5. Maintain Evidence Instead of Reconstructing It Later
Compliance readiness is often an evidence problem.
An organization may believe it is doing the right things but struggle to demonstrate them.
Useful evidence may include:
- Device inventories
- Access records
- Security tool deployment
- Patch status
- Training records
- Backup status
- Security alerts
- Documentation
- Policies
- Risk decisions
- Service audits
- Review notes
WTITC’s Tiered Technology Fee supports monthly service audits and Technology Alignment Manager oversight, which can help create a more consistent management process.
Security controls do not automatically guarantee compliance.
The better language is that active management can support regulatory compliance readiness, help prepare for compliance reviews, provide evidence for audits, and help document controls.
Legal, regulatory, insurance, and contractual interpretation should still come from the appropriate advisors.
6. Ask the Right Questions Before the Review
Leadership should not wait until a questionnaire arrives.
A better process is to periodically ask:
- Which regulations or requirements apply to us?
- What does our cyber insurer expect?
- What do major funders or contracts require?
- Which controls do we currently have?
- Which controls are missing?
- What evidence could we produce today?
- What risks have we accepted?
- Who owns remediation decisions?
A strong Permian Basin IT provider should be able to explain how it documents controls, manages security, communicates gaps, and supports audit readiness without pretending that technology alone guarantees compliance.
That is an important provider-selection signal.
Hypothetical Example: Preparing for a Grant-Related Security Review
Consider a hypothetical 21-employee Midland non-profit with 24 managed endpoints.
The organization is preparing for a review connected to a grant application.
Leadership is asked to explain:
- How devices are protected
- How employee accounts are managed
- Whether staff receive security training
- How Microsoft 365 is secured
- How data is backed up
- Whether security controls are reviewed regularly
Without documentation, the organization may spend days reconstructing information.
With a structured managed environment, leadership can rely on current device inventories, documented controls, training records, backup information, and service reviews.
The expected result is not guaranteed approval.
The benefit is greater readiness and clearer evidence of active technology management.
Security and Compliance Review Checklist
Before a review, confirm:
- Do we have a current technology inventory?
- Are administrative accounts documented?
- Are former employees removed promptly?
- Is EDR deployed where expected?
- Is email security in place?
- Do employees receive security awareness training?
- Is Microsoft 365 actively managed?
- Are backups monitored?
- Is BCDR appropriate for critical systems?
- Can we demonstrate patching?
- Can we show training records?
- Can we explain our incident escalation process?
- Are risk decisions documented?
- Are optional services clearly accepted or declined?
- Do we know which requirements come from law, contracts, grants, or insurance?
What Should Leadership Expect From Its IT Provider?
The provider should help leadership understand and document the technology controls it manages.
WTITC’s role is to support the technology side of readiness through:
- Monitoring
- Documentation
- Security tooling
- User protection
- Microsoft 365 management
- Backup
- Service audits
- Technology alignment
- Optional Compliance Manager
- Optional third-party penetration testing through Vonahi
WTITC should not be represented as guaranteeing legal or regulatory compliance.
That boundary is itself a trust signal.
Trust Signals
A credible compliance-readiness approach is transparent about both capabilities and limitations.
WTITC’s model emphasizes:
- Named tools
- Defined service structure
- Ongoing documentation
- Clear service boundaries
- Risk acknowledgment
- Optional specialized services
- Monthly audits
- Technology Alignment Manager oversight
