Nonprofits hold exactly the data attackers most want: names, addresses, payment information, and giving history tied to high-net-worth individuals. The security programs that protect that data, on nonprofit budgets, look different than commercial programs, but the threat doesn't discount itself for tax-exempt status.
01PCI compliance for nonprofits.
If your nonprofit accepts donations by credit card, you're subject to PCI-DSS. The scope depends on how you process payments, a donation form that hands off to Stripe or PayPal is much lower scope than an on-prem payment terminal or a phone-taken donation manually keyed into a system.
The lowest-friction, highest-security pattern: all payment processing is handled by a PCI-validated third-party processor (Stripe, Bloomerang Pay, Donorbox, iATS). The nonprofit never stores or transmits cardholder data directly. Scope drops dramatically.
02CRM security: Raiser's Edge, Salesforce NPSP, Bloomerang.
Donor CRMs contain the data that matters most. Access controls need to be real, not "everyone has full access because we're a small team." Role-based access, MFA on all accounts, documented offboarding when staff or volunteers leave.
The CRM audit log is an under-used resource. Most donor CRMs track who viewed what, when, and from where. Reviewing this log quarterly (even lightly) catches insider-access problems before they become incidents.
03Volunteer reality.
Volunteers have a different security relationship than employees. Background checks are often minimal, credentials are shared informally, and offboarding is rarely documented. The data-access footprint of a typical volunteer corps is often larger than the paid-staff footprint.
Practical approach: volunteers access data through tightly-scoped accounts, never shared with other volunteers. Sunset every volunteer account quarterly, if they're still active, they get reissued.
04Email and social engineering.
Nonprofit email accounts get phished aggressively. Common patterns: wire-transfer fraud targeting finance staff, gift-card scams impersonating the executive director, and payroll-diversion attacks around tax season.
The baseline defenses are the same as any other small organization: MFA, email security gateway, anti-impersonation policies, and quarterly phishing simulation with coaching for clickers. Free security training is available (Cyber Readiness Institute, CISA) for operations that can't afford commercial platforms.
05The data-retention conversation.
Nonprofits tend to accumulate donor data indefinitely. The retention policy that matters: define what you need, define how long, define what happens after, and document it. Keeping 15 years of credit-card-last-4 and mailing addresses for donors who gave once to a gala is a risk with zero operational upside.
Minimum-necessary is a security principle with direct operational benefit, less data means less to protect, less to breach, less to audit.
Five local nonprofits on the managed program today, a Naples food-security organization, two arts nonprofits, a Fort Myers human-services agency, and a conservation group on Sanibel. TechSoup licensing applied where eligible (typically saves $4,000–$12,000/yr), Form 990 tech-expense lines documented cleanly, and restricted-funds grant reports generated on request.