Skip to content

Security & Protection

Protect the technology your mission depends on.

Nonprofits depend on email, websites, cloud applications, files, accounts, and people to serve their communities.

Everybody Connects helps organizations identify practical security improvements that can reduce unnecessary risk and strengthen their ability to recover when problems occur.

Good security isn't about creating fear. It's about being prepared.

Request Security HelpExplore Security Assistance
Illustration of a nonprofit team working together, surrounded by soft protective layers and icons for accounts, email, websites, cloud files and backups

Practical security

Security doesn't have to become a full-time job for your nonprofit.

You don't need perfect security. You need thoughtful, repeatable security practices.

Cybersecurity can feel overwhelming, especially for organizations without dedicated security staff. But many meaningful improvements begin with practical fundamentals:

  • Protect important accounts.
  • Use stronger authentication.
  • Remove access that is no longer needed.
  • Keep systems updated.
  • Back up important information.
  • Help staff recognize suspicious activity.
  • Know who controls critical systems.
  • Have a plan for when something goes wrong.

Everybody Connects helps nonprofits identify practical improvements based on their technology, resources, and risks.

Your mission depends on trust

Nonprofits have information and systems worth protecting.

An organization doesn't need to be a large corporation to experience technology or security problems. A compromised account or unavailable system can interrupt the organization's ability to operate and serve its community.

Security should protect the mission—not get in the way of it.

Nonprofits may rely on systems containing or providing access to:

  • Donor information
  • Employee information
  • Volunteer information
  • Organizational email
  • Financial systems
  • Cloud documents
  • Websites
  • Community information
  • Program information
  • Administrative accounts
  • Payment and fundraising platforms
  • Social media
  • Other important organizational data

Start with the fundamentals

Small improvements can close surprisingly large gaps.

  • “We still share passwords.”

    There are usually safer ways to provide people with the access they need without passing credentials between staff and volunteers.

  • “We're not sure who has administrator access.”

    Administrative access should be limited, understood, and reviewed.

  • “Some people use MFA. Some don't.”

    Strong authentication is most useful when it is applied consistently to important systems.

  • “Former employees may still have accounts.”

    Offboarding should include technology access—not only HR paperwork.

  • “We have backups, but nobody has tested them.”

    A backup strategy should consider whether important information can actually be recovered.

  • “Our staff know phishing exists, but that's about it.”

    Security awareness works best when people understand what suspicious activity looks like and what they should do when they see it.

Security maturity often starts by consistently doing the basics well.

How we can help

Practical protection for the systems your organization relies on.

Identity, Accounts & Access

Protect the keys to your organization.

Many security incidents begin with compromised accounts, unnecessary permissions, or administrative access that isn't well controlled.

The right people should have the right access for the right amount of time.

Technology & IT Assistance

Potential assistance may include

  • Multifactor authentication
  • Administrative account reviews
  • User access reviews
  • Groups and permissions
  • Role-based access
  • Shared-account review
  • Account recovery
  • Single sign-on considerations
  • Password-management practices
  • Privileged access
  • User onboarding
  • User offboarding
  • Session and account management

Email Security

Protect one of the most frequently used doors into your organization.

Email is essential to nonprofit operations and is also commonly used for phishing, impersonation, malicious attachments, credential theft, and fraudulent requests.

Good settings and awareness reduce risk, but no email security setup can eliminate phishing entirely.

Potential assistance may include

  • Multifactor authentication
  • Email security settings
  • Spam and phishing protections
  • Domain email authentication
  • SPF
  • DKIM
  • DMARC
  • Administrative configuration
  • Suspicious forwarding-rule review
  • External sender considerations
  • Account security
  • Security awareness
  • Reporting processes

Website Security

Your public website deserves ongoing protection too.

Public websites are exposed to automated attacks, software vulnerabilities, malicious traffic, credential attacks, and configuration problems.

Hosting & Website Care

Potential assistance may include

  • Software updates
  • Vulnerability review
  • Administrative access
  • Login protection
  • SSL / HTTPS
  • Website backups
  • Security configuration
  • Monitoring
  • Malicious traffic mitigation
  • Recovery planning
  • Hosting review

Backup & Recovery

Security isn't only about preventing problems. It's also about recovering from them.

Backups can provide an important recovery path after accidental deletion, technical failure, account compromise, corruption, or other problems.

A backup is part of a recovery strategy—not the entire strategy.

Depending on your environment, planning may consider

  • What needs to be backed up
  • Backup frequency
  • Retention
  • Backup access
  • Off-site or separate storage
  • Recovery procedures
  • Restore testing
  • Ownership
  • Documentation
  • Recovery priorities

Security Awareness

People are part of the security system.

Staff and volunteers make security decisions every day. They receive email. They approve access. They open files. They use passwords. They respond to unexpected requests. They handle organizational information.

The goal isn't to make people afraid to click anything. It's to help them recognize when something deserves a second look.

Awareness can help people recognize threats such as

  • Phishing
  • Smishing
  • Vishing
  • Business email compromise
  • Fake login pages
  • Unexpected MFA prompts
  • Malicious attachments
  • QR-code phishing
  • Social engineering
  • Impersonation

Security Reviews & Practical Assessments

Sometimes the first step is simply understanding where you stand.

A practical security review can help identify important gaps and establish priorities.

Focus on what matters most.

The objective isn't to create an intimidating list of everything that could possibly go wrong. It's to identify the improvements that matter most.

Depending on the organization, a review may consider

  • Important accounts
  • Administrative access
  • Multifactor authentication
  • Email configuration
  • Website security
  • Cloud applications
  • File sharing
  • User access
  • Backups
  • Offboarding
  • Password practices
  • Security awareness
  • Documentation
  • Recovery preparedness

Where do we start?

Not every security improvement has the same value.

Organizations with limited time and resources need to prioritize. We help nonprofits focus first on improvements that meaningfully reduce risk.

  1. Step 1

    Protect Accounts

    Strong authentication, administrative access, account recovery, and appropriate permissions.

  2. Step 2

    Protect Information

    File access, sharing practices, backups, and important organizational data.

  3. Step 3

    Protect Systems

    Websites, email, cloud applications, updates, and configuration.

  4. Step 4

    Prepare People

    Awareness, documentation, responsibilities, and recovery planning.

Security should be prioritized—not simply accumulated.

One of the best places to start

Passwords shouldn't be the only thing protecting important accounts.

Multifactor authentication adds another verification step when someone signs in. It can significantly strengthen account security, particularly for:

  • Email
  • Administrative accounts
  • Cloud applications
  • Financial systems
  • Password managers
  • Websites
  • Social media
  • Other important organizational services

Everybody Connects may help organizations understand where MFA should be enabled and how authentication practices can be improved.

MFA isn't perfect—but relying on a password alone creates unnecessary risk for important systems.

Protect high-impact accounts

Administrator access should be intentional.

Administrative accounts can make significant changes to organizational systems. Organizations should understand:

  • Who has administrative access
  • Why they have it
  • Whether they still need it
  • How those accounts are protected
  • What happens if access is lost
  • Whether recovery options exist

Whenever practical, everyday work should not require unnecessarily powerful administrative access.

Convenience shouldn't quietly become permanent privilege.

Access has a lifecycle

Security starts when access is granted—and continues when it is removed.

New employees and volunteers need appropriate access to do their work. When responsibilities change, access may need to change. When someone leaves, accounts, sessions, applications, and administrative permissions should be reviewed promptly.

Technology & IT Assistance

Potential considerations include

  • Account disabling
  • Group removal
  • Application access
  • Administrative permissions
  • Active sessions
  • MFA methods
  • Shared files
  • Email
  • Organizational data
  • Devices
  • Recovery information

Security is a team practice

People shouldn't be treated like the problem.

Security programs sometimes describe employees as the weakest link. Everybody Connects takes a different approach: people are part of the organization's defense. The goal is to give staff and volunteers clear guidance, useful tools, and an environment where reporting something suspicious is encouraged.

  • Make Reporting Easy

    People should know where to report suspicious activity or mistakes.

  • Teach the Why

    Security guidance is easier to follow when people understand what it protects.

  • Encourage Questions

    Someone asking whether an email is legitimate is demonstrating good security behavior.

A healthy security culture rewards people for speaking up early.

Know who controls what

Security gets harder when nobody knows who owns the technology.

Critical systems should use appropriate organizational ownership and documented administrative control whenever practical. Review areas may include:

  • Domains
  • Email
  • Websites
  • Cloud platforms
  • Social media
  • Password managers
  • Financial platforms
  • Fundraising platforms
  • SaaS applications
  • Backup systems

Avoid situations where only one employee, volunteer, consultant, or vendor can access a critical organizational system.

Security and technology ownership are closely connected.

When something goes wrong

A plan is easier to build before you need it.

No security program can eliminate every technology problem or security incident. Organizations should think in advance about questions such as:

  • Who should be contacted?
  • Which systems matter most?
  • Where are backups?
  • Who has administrative access?
  • How can important accounts be recovered?
  • How will staff communicate?
  • Which vendors may need to be contacted?
  • What documentation exists?
  • What systems should be restored first?

Preparation can turn confusion into a process.

Experiencing an active cybersecurity incident?

Everybody Connects is not positioned as an emergency cybersecurity incident-response provider.

If your organization is currently experiencing any of the situations listed, seek appropriate immediate incident-response assistance.

Depending on the situation and available resources, Everybody Connects may be able to help with security improvements, recovery planning, or technology changes after immediate risks have been addressed.

  • Ransomware
  • Active account compromise
  • Active data theft
  • A significant ongoing cyberattack
  • A major security breach
  • A critical security-related outage

How it works

Understand the risk. Prioritize the improvements.

  1. Step 1

    Listen

    We learn about the organization's concerns, technology, people, and current practices.

  2. Step 2

    Review

    We examine the relevant accounts, systems, configurations, processes, or risks within the agreed scope.

  3. Step 3

    Prioritize

    We identify practical improvements based on importance, effort, available resources, and organizational needs.

  4. Step 4

    Improve

    We help implement agreed security improvements where appropriate.

  5. Step 5

    Prepare

    We help the organization better understand how to maintain improvements and respond when something changes.

Setting expectations

Security assistance should be clear about what it can—and cannot—do.

  • Not a Guarantee

    No technology provider can guarantee that an organization will never experience a security incident.

  • Not Emergency Incident Response

    Everybody Connects is not a 24/7 emergency cybersecurity response organization.

  • Not a Security Operations Center

    This service does not include continuous monitoring, threat hunting, or managed detection and response.

  • Not Automatic Compliance Certification

    Security improvements may support better practices, but they do not automatically make an organization compliant with a regulatory or security framework.

  • Not Fear-Based Selling

    Recommendations are based on meaningful organizational risks—not pressure to purchase unnecessary products.

Security and IT are connected

Many security problems are really technology-management problems.

Accounts, permissions, email, cloud applications, onboarding, offboarding, software, and documentation all sit at the intersection of IT and security. If your organization needs broader help managing those systems, explore Technology & IT Assistance.

Technology & IT Assistance

Concerned specifically about your website?

Website updates, hosting, backups, monitoring, SSL, performance, and security often need to be managed together.

Hosting & Website CareWebsite Design & Development

Our service model

Security shouldn't be something only large organizations can afford to think about.

Everybody Connects provides qualifying nonprofit technology services using a donation-based model.

Organizations are encouraged to contribute when they're able to, while limited financial resources should not prevent a nonprofit from asking for assistance.

Some improvements may require third-party products or services such as software licenses, backup services, security products, cloud services, hardware, or professional services from specialized providers. Those costs should be discussed before the organization commits to a solution.

Start with the risks and concerns—not a shopping list of security products.

Request Security Help

Common questions

Questions about nonprofit security

View all FAQsExplore all services

You don't need to solve every security problem at once.

Tell us what concerns your organization, what technology you rely on, or where you're unsure. We'll start by identifying practical next steps.

Request Security HelpExplore All Services