Supporting Nonprofits with Their Technology Needs — From the Field to the Fix
I wrote the original piece after years of volunteering and working inside a nonprofit sector, shoulder-to-shoulder with people who would give you their last ounce of energy to keep services running. What I saw was inspiring—and a little alarming. Heroic teams. Fragile systems. Budgets that made every technology decision feel like a referendum on the mission. This merged version blends that lived experience with current sector insights, so leaders, funders, and technologists can act with clarity.
Reality Check: What's Really Happening
- Outdated & unsupported systems. Critical databases and servers live on borrowed time. Yesterday's temporary fix becomes today's backbone.
- Unmanaged devices & BYOD sprawl. Staff and volunteers handle donor or client data on personal phones and laptops without central oversight.
- Single points of failure. One aging server. One spreadsheet. One person who "knows the system." If any one of these fails, everything stops.
- Daily security threats, thin defenses. Phishing, malware, and ransomware target nonprofits as often as businesses, but most organizations lack advanced protections or dedicated cyber staff.
The bottom line: dedicated people are doing vital work on fragile foundations.
Stats at a Glance (Canada)
- 18% of nonprofits reported a cybersecurity incident in 2021; among those, 27% said it disrupted core services.
- 36% have no employees with regular cybersecurity duties; over half of these rely on contractors.
- Adoption of basic controls is high (80% email security, 79% anti-malware, 72% network security, 60% web security), but deeper safeguards lag (48% mobile security, 42% data protection/controls, 33% software/app security).
- Training gaps are stark for small orgs: 14% train IT staff in cybersecurity; 17% train non-IT staff. Only 7% are aware of formal cyber standards.
- Nonprofits spend ~$21K annually on cybersecurity on average—about 40% of business spend (~$55K).
- Digital maturity: only ~14% of Canadian charities report having an active digital strategy with dedicated staff; most are still early in their journey.
What I've Seen Up Close (A Personal Note)
I've sat in budget meetings where a $2,000 security line item felt impossible—until a scare turned "optional" into "urgent."
I've watched a single hard drive failure knock out operations for days because backups were on the to-do list.
I've helped "accidental techies" (brilliant program staff dragged into IT by necessity) untangle systems they never asked to own.
None of this is about negligence. It's about impossible choices.
Root Causes We Have to Name
- The Budget Paradox. Every dollar on tech can feel like a dollar not serving clients. Many nonprofits spend only a few percent of revenue on IT—never enough to replace aging tools or build security in.
- The Expertise Gap. Nonprofits struggle to hire and retain technologists. Many rely on staff who wear multiple hats. Turnover means institutional knowledge walks out the door.
- The Technical-Debt Spiral. Quick fixes stick. Without a digital roadmap, ad-hoc tools harden into critical infrastructure. Risk (and cost) compound quietly.
- Compliance Pressure Without Resources. Privacy expectations, cyber insurance requirements, and funder questions are rising—but budgets and bandwidth aren't.
The Human Cost (Why This Matters)
- People get hurt. When data leaks, it's not abstract—it's donors, clients, and staff whose trust is on the line.
- Services pause. A downed system can stall intake, dispatch, or food distribution right when people need help most.
- Burnout accelerates. Constant workarounds and fire-fighting drain staff who already wear too many hats.
- Reputation suffers. A single breach or outage can undermine years of community trust and hard-won funding.
What Works (Without Breaking the Mission)
1) Treat Open Source as Enterprise-Grade
Fortune-level companies run on open source. Nonprofits can, too. Think Linux, Apache, PostgreSQL/MySQL, and tools like CiviCRM. With the right support, these are secure, proven, and license-fee-free.
Field tip: Pair open source with an MSP or skilled volunteer bench for updates, monitoring, and hardening.
2) Modernize in Phases
- Year 1: Move email and files to the cloud; enable MFA; implement automated backups.
- Year 2: Replace the riskiest legacy system; adopt an MDM for devices; standardize password management.
- Year 3: Consolidate data; implement basic SIEM/EDR; formalize incident response and DR testing.
Field tip: A simple 24–36 month roadmap makes tech funding "bite-sized" and trackable for boards and funders.
3) Share Capacity Through Partnerships
Tap sector collaboratives, donation programs, corporate skills-based volunteering, and local colleges for practicum placements.
Field tip: Name a convener in your region; meet quarterly to share vendor lists, grant intel, templates, and lessons learned.
4) Fund Tech Like Program Infrastructure
Include cybersecurity, devices, software, and training in every grant budget.
Field tip: Add a one-page "Tech Enables Impact" appendix to proposals.
5) Build a Security Culture
Start small: MFA everywhere, least-privilege access, quarterly phishing drills, monthly patching, and tested backups.
Field tip: Appoint a board-level cyber champion and give them a 10-minute security briefing at each meeting.
A 90-Day Starter Plan (Copy-Paste Ready)
Week 1–2:
- Turn on MFA for email, file storage, and finance systems.
- Inventory hardware, software, and data flows.
- Enable automatic cloud backups and test a restore.
Week 3–6:
- Roll out a password manager with shared vaults.
- Standardize devices: require disk encryption and auto-updates.
- Run an all-hands 45-minute security training.
Week 7–12:
- Retire one high-risk legacy system or isolate it.
- Draft three lightweight policies: Acceptable Use, Data Handling, and Incident Response.
- Present a 12–24 month tech roadmap to the board.
My Call to Action
To IT Professionals: A few volunteer hours can prevent a breach or outage. Offer a mini-assessment, set up MFA and backups, or mentor an accidental techie.
To Nonprofit Leaders: Start with the 90-day plan, publish a simple roadmap, and ask funders to back it.
To Funders: Require and resource basic cyber hygiene. Fund devices, software, MSP time, and training as part of program delivery.
Originally published on LinkedIn by Ross Moravec.
Written by Ross Moravec, founder of Nonprofit Tech Support.