Cybersecurity isn’t just another digital buzzword. It is a vitally important topic, especially in the non-profit sector. Too many non-profits only take cybersecurity measures after they experience an attack, but the consequences can be so damaging, it’s an area non-profits should be prepared in.
Why do non-profits need cybersecurity?
Non-profits collect, process, and store a considerable amount of sensitive data. From processing donations, event registration, to member’s details and email and direct marketing. Considering the range of personally identifiable information they hold, it’s imperative that non-profits understand the importance of having security measures in place and the consequences if they do not.
Day-to-day operations can be compromised, and attacks can result in the exposure of customer, client, member, or donor details, as well as causing financial loss or reputational damage. Collectively, this directly impacts the organisation’s ability to serve its mission and support those who need them most.
Challenges of implementing cybersecurity measures
According to the Charity Digital and National Cyber Security Centre (NCSC) report, The state of cyber security in the UK charity sector 71% of charities surveyed reported that cybersecurity was extremely important to them.
However, the 2022 DCMS Cyber Security Breaches Survey details that charities are less likely to employ technical security controls and measures. There are numerous reasons for this, and we explore a few of these below.
1. Lack the financial flexibility
Often non-profit organisations may be reluctant to spend resources and investment to improve their cybersecurity measures as they would much rather that it would be on the front line serving their mission.
Couple this with recent global events, including the pandemic, international wars and the cost-of-living crisis, it has become even more difficult for non-profit organisations to invest in the technology and expertise to protect themselves against cyber-attacks, leaving them vulnerable.
However, there are a range of free resources that have been made available for non-profits to support them in implementing cybersecurity measures. This includes the National Cyber Security Centre who have a wide range of resources for both large and small organisations.
2. It’s not a part of the culture
Just as technology evolves, so do cyber criminals and the ways in which they look to target your organisation. Therefore, cybersecurity is not something you complete. It must be built into your culture and the way in which you carry out your everyday tasks and activities.
You can help embed this into your culture through training. By empowering your staff to spot, avoid and report attacks, you can build in secure online habits to your organisation.
3. Knowing where to start
It can often be difficult to know where to start but one place we advise is by carrying out a cybersecurity risk assessment. A cybersecurity risk assessment will allow you to assess the risks specific to your non-profit and identify the ways in which you can manage them.
At Hart Square, we can offer a thorough cybersecurity assessment, with clear actionable outcomes. We start by assessing assets and data within the organisation, and the existing approach to cyber risk management. We cover a range of areas including security policies, cloud, remote and wireless security and content management and data theft. Find out more about our cybersecurity assessment here.
