Nonprofit Data Protection & Mission Resilience Checklist

1.1 Have you identified and classified all sensitive data your nonprofit handles (donor financial info, beneficiary PII, grant details) and where it is stored?

1.2 Are strict, role-based access controls implemented for all sensitive data, ensuring only authorized personnel can access it?

1.3 Is sensitive data encrypted both when being transmitted (email, cloud services) and when stored (servers, laptops)?

2.1 Do you have automated, regularly tested data backups with offsite or cloud-based storage to ensure rapid recovery from data loss?

2.2 Is there a documented and regularly tested Incident Response Plan with clear roles, communication protocols, and recovery steps?

2.3 Are critical IT systems (donor databases, financial platforms, communication tools) designed with redundancy to avoid single points of failure?

3.1 Is your network infrastructure (Wi-Fi, firewalls, VPN) secured with current best practices including regular vulnerability scans?

3.2 Do you have a process for vetting and monitoring cloud service providers to ensure they meet your security and compliance requirements?

3.3 Are all devices used for nonprofit work (laptops, phones, tablets) protected with endpoint security, encryption, and remote wipe capabilities?

4.1 Do all staff and volunteers receive regular cybersecurity awareness training covering phishing, social engineering, and safe online practices?

4.2 Do you conduct periodic phishing simulations and have a clear process for employees to report suspicious emails or activity?

4.3 Are staff and volunteers trained on secure data handling practices (strong passwords, MFA, secure file sharing, clean desk policy)?

5.1 Do you have a clear, communicated data privacy policy that complies with relevant regulations and is reviewed annually?

5.2 Are you aware of and actively meeting the data security and privacy requirements of your grantors and major funders?

5.3 Do you transparently communicate your data protection practices to donors, beneficiaries, and stakeholders to build trust?