Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteSmall not-for-profit organizations can reduce the most damaging cyber risks without building a large security department. Start with multi-factor authentication (MFA) on critical accounts, unique passwords, prompt patching, protected and tested backups, encryption, phishing training, authenticated email, limited access, safer remote work, data minimization, and a rehearsed incident plan.
The Federal Trade Commission (FTC) says its small-business resources also apply to charities and other nonprofits. That matters because a nonprofit holds valuable email, payment, donor, client, volunteer, employee, and community information even when its budget and staff are small. Cybersecurity is not a one-time software purchase: NIST describes it as “a continuous process.”
As an Amazon Associate I earn from qualifying purchases.
One current warning comes from the UK National Cyber Security Centre (NCSC): its guide, published April 9, 2026 and reviewed July 21, 2026, reports that one in two small businesses experience a cyber incident each year. That statistic describes UK small businesses, not nonprofits specifically, and it should not be treated as a global rate. The controls below are broadly useful, while legal reporting and notification duties depend on your country, state, and the type of information you hold.
Free tools Windows power users keep installed
One-click scans. No signup required.
1. Turn on MFA for every important account
MFA requires more than a password to sign in. Make it the first control you apply to organizational email, cloud file storage, finance and payroll systems, donor databases, remote-access tools, and administrator accounts. If a password is stolen, the additional factor can block an attacker from taking over the account.
#1 Best Overall
Choose the strongest practical method
Use a phishing-resistant method whenever the service supports one. A FIDO2-compatible hardware security key is one optional physical implementation, but it is not universally compatible and is not automatically the right choice for every volunteer or employee. Check each critical service before buying keys, and decide how replacement, spare keys, lost devices, and account recovery will work.
| Implementation choice | What to verify before rollout | Evidence or limitation |
|---|---|---|
| Phishing-resistant MFA supported by the service | Whether the service supports the method, how users enroll, and how administrators recover an account | NIST recommends phishing-resistant MFA where offered |
| FIDO2-compatible hardware security key | Compatibility with every critical service, spare-key custody, and a recovery process for loss | The FTC lists hardware tokens among MFA options; compatibility is service-specific |
| Another MFA option offered by the service | Whether it is available to all staff and volunteers and how securely recovery is handled | The cited guidance does not establish one universally best alternative |
Begin with administrators and people who can move money or access large data sets, then cover everyone else. Keep at least two authorized recovery contacts, document the process, and remove a departing person’s factors when access is revoked.
2. Use unique passwords and a password manager
Never reuse a password between the nonprofit’s email, banking, fundraising, social-media, and personal accounts. Reuse lets one stolen credential unlock several systems. NIST recommends strong passwords and suggests considering a password manager.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Set a workable password policy
- Use long, unique passwords for every service, generated or stored by an approved password manager where appropriate.
- Protect the password-manager account with MFA and limit administrative access to the smallest practical group.
- Do not share passwords through email, chat, spreadsheets, or paper lists.
- Change a password promptly when an account is compromised, a person leaves, or a vendor relationship ends; do not force needless routine changes that encourage predictable patterns.
Maintain an inventory of accounts, including forgotten shared mailboxes, old social accounts, website administration, and payment services. Close accounts that no longer have a legitimate owner.
3. Patch systems, applications, browsers, and network equipment
Updates repair vulnerabilities that attackers may already know how to exploit. Turn on automatic updates for operating systems, browsers, applications, endpoint-security tools, phones, tablets, and routers when the setting is available and safe for your environment.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
Include devices used away from the office
A laptop that connects remotely still needs patches even if it rarely visits the office. Record who owns each device, which operating system it runs, and when it last updated. Replace or isolate equipment that can no longer receive security updates. Apply router and firewall firmware updates as well as computer updates, and test a critical application after major updates so that an operational problem does not become an excuse to leave everything unpatched.
Assign a person to review update failures. An update that repeatedly fails, a device that has not checked in, or a browser that is several versions behind is an exception requiring follow-up, not a status to ignore.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →4. Back up important information and test that it can be restored
A backup is useful only when it is protected from the same theft, ransomware, deletion, or outage as the original and can actually be restored. Keep at least one copy separated from the devices and network holding the working files. Protect backup accounts with MFA, restrict who can delete backups, and periodically restore representative files.
| Backup arrangement | Separation and protection | What a restore test should establish |
|---|---|---|
| Copy connected to the same environment as the originals | Limited separation; an attacker with broad administrator access may reach both | Not sufficient by itself for the separation recommended by FTC and NIST |
| Separated cloud or service copy | Use a distinct account or administrative boundary and protect it from unauthorized deletion | That files, permissions, and essential records can be recovered within an acceptable time |
| Offline or otherwise disconnected copy | Strong separation while disconnected, with careful physical and access control | That the media remains readable and the organization knows the restoration steps |
Write down what must be restored first: email, identity services, finance records, case-management data, website content, or other essential operations. Record the date, files, and result of each test. NIST specifically recommends protecting and testing backups; a backup that has never been restored is an assumption, not evidence.
5. Encrypt sensitive information and devices
Encryption helps protect information if a laptop, phone, removable drive, or backup medium is lost or stolen, and it protects data while it travels between systems. Enable the operating system’s device encryption where available, require a screen lock, and encrypt removable media used for sensitive work.
Match protection to the data
Identify information that could harm donors, clients, service users, employees, or community members if exposed. Apply encryption to sensitive files at rest and use protected connections when transmitting them. Do not assume that a device is safe because it is inside an office: mobile equipment and home-working devices are especially likely to be lost, shared, or connected to untrusted networks.
Recommended Free Tools
Keep recovery keys under controlled access. Test that an authorized administrator can recover an encrypted device without giving every user access to the keys.
6. Train staff and volunteers to recognize and report phishing
People are often targeted with urgent requests to change bank details, buy gift cards, reset a password, open an attachment, or transfer donor information. Training should focus on decisions people make during a busy day, not on blame after an error.
Teach a simple pause-and-verify routine
- Pause when a message creates urgency, secrecy, fear, or an unusual payment request.
- Avoid unexpected links and attachments; open the known service directly instead.
- Verify a payment, credential, or data request through a trusted channel already on file, not through the contact details in the suspicious message.
- Report the message quickly using a clear, non-punitive process, even if someone clicked.
Explain that a familiar name, logo, or apparently correct email address is not proof of identity. Managers should model reporting and thank people for raising concerns. Fast reporting can allow an administrator to revoke a session, reset credentials, or warn others before the problem spreads.
7. Authenticate the organization’s email domain
Ask your email provider or a qualified administrator to configure SPF, DKIM, and DMARC correctly. Together, these controls help receiving mail systems check whether messages claiming to come from your domain are authorized and can reduce successful impersonation of staff or leadership.
Rank #4
Change email records carefully
First list every legitimate service that sends mail for the organization, such as newsletters, donation receipts, event platforms, and ticketing systems. An incomplete SPF or DKIM setup can cause legitimate messages to fail authentication. Introduce DMARC monitoring, review reports, and tighten the policy only after authorized senders are accounted for. Keep a named owner for domain records so a staff change does not leave authentication unmanaged.
8. Limit access, secure devices, and protect Wi-Fi
Give each person only the access required for the current role. Separate ordinary work from administrator privileges, review shared folders and donor databases, and remove access promptly when someone leaves or changes duties. Use individual accounts instead of shared administrator logins so actions can be traced.
Harden the local network
- Change default router and access-point credentials.
- Use the modern Wi-Fi encryption option supported by your equipment and keep the firmware updated.
- Create a guest network separate from systems that hold organizational information.
- Lock screens automatically and keep devices physically secure in offices, vehicles, and shared spaces.
Review access periodically rather than assuming that an old volunteer, contractor, or temporary worker still needs the same permissions. Limit access to sensitive paper records as well as digital files.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.9. Set clear rules for remote work and vendors
Remote work expands the places from which an account or device can be attacked. Require remote devices to use supported operating systems, updates, screen locks, encryption, and MFA. Decide which services may be accessed from personal devices and how organizational information is removed when a device is returned or a person leaves.
Make vendors meet your baseline
Put security expectations in agreements with managed-service providers, payroll firms, fundraising platforms, cloud hosts, and other vendors that can access your systems or personal data. Ask how they control their staff’s access, protect credentials, handle subcontractors, notify you of incidents, and support recovery. Do not expose remote-administration interfaces directly to the internet unless there is a documented need and strong access control.
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
For outside technical support, compare nonprofit experience, access controls, incident-response capability, vendor-access practices, and fit with your organization’s size and budget. NCSC offers guidance for selecting a managed service provider but does not endorse a particular provider.
10. Keep only the personal data you need and secure physical records
Data you do not retain cannot be stolen from your systems. Review donor, client, volunteer, employee, and event records and define how long each category is genuinely needed. Delete or anonymize information when the purpose and retention requirement end, subject to applicable legal and grant obligations.
Control paper and removable media
- Store sensitive paper files and portable media in locked areas with controlled access.
- Do not leave printed lists, laptops, or USB drives unattended in vehicles or public spaces.
- Use a secure destruction method for paper and media rather than placing them in ordinary waste.
- Consider the likely effect on the people represented in the data, not only the organization’s administrative inconvenience.
The FTC’s nonprofit guidance emphasizes protecting information collected from people. Data minimization reduces both the number of records an attacker can take and the number of people affected by an error.
11. Write and rehearse an incident-response and recovery plan
Decide in advance who can declare an incident, shut down a device, disable an account, contact technical support, speak for the organization, and communicate with affected people. Include a current list of technical, legal, insurance, law-enforcement, regulator, and critical-vendor contacts, with an offline copy in case email is unavailable.
Cover the full response cycle
- Identify: Define signs of compromise, such as an impossible login, encrypted files, suspicious payment instructions, or a lost device.
- Contain: Isolate affected devices or accounts without destroying evidence needed to understand what happened.
- Operate: Set out how essential services continue if email, payment systems, or case records are unavailable.
- Recover: Restore clean systems and data from protected backups, then change compromised credentials and verify access.
- Communicate: Tell staff, trustees, donors, clients, partners, and authorities what they need to know, using applicable local reporting and notification rules.
- Learn: Record what failed and update controls, contacts, and training.
Rehearse the plan with a short scenario at least periodically and correct gaps while they are inexpensive to fix. Do not promise that paying a ransom will restore access: the FTC warns that payment does not guarantee recovery.
Make the program manageable with ownership and evidence
Assign one accountable coordinator, even if implementation is shared with a board member, volunteer, or outside provider. Keep a short register showing which accounts have MFA, which devices receive updates, when backups were last restored successfully, who administers the domain, and when access reviews occurred. The register is not a substitute for controls; it gives the organization a way to see overdue work and demonstrate that protections operate in practice.
Review the arrangement after a major staffing change, a new fundraising or payment system, a merger, a move to remote work, or any incident. The goal is a repeatable cycle of prevention, detection, response, and recovery that fits the nonprofit’s actual people, systems, and budget.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
