If you have read where the cyber risk sits for a community services organisation, you know the hard combination your sector lives with: some of the most sensitive personal data of any industry, on the tightest budgets and the most stretched teams. Knowing that is one thing. Turning it into a plan you can actually run, without money you do not have, is another.
This is the practical follow-up. A 90-day baseline built for an NFP reality, sequenced so you get the biggest protection for vulnerable-client data first, and leaning on the discounted or donated security licensing your organisation is likely entitled to. Most of what follows costs attention and discipline rather than dollars.
The First 30 Days: Protect the People in Your Records
Your highest stakes are the data you hold about the people you support: health information, family circumstances, financial hardship, sometimes safety concerns. So the first month is about who can reach it. Control access so staff and volunteers only see what their role requires, and keep that data in proper systems rather than scattered across personal inboxes and spreadsheets.
At the same time, turn on multi-factor authentication across every account. If a password leaks, MFA means a stolen password alone gets nobody in. This is the single highest-value control you can deploy, and on the licensing most NFPs already hold it costs nothing but the time to switch it on.
Before you buy anything, check what you already have. Many software vendors and Microsoft offer discounted or donated licensing for registered not-for-profits, and it often includes the exact security features in this plan. Part of doing more with less is using the protections you are already entitled to instead of paying for new ones.
Days 30 to 60: Tidy Access and Tighten Payments
The sector runs on volunteers, casuals, and program staff who come and go, and every departure should remove access. In busy organisations that step is the one that slips, leaving accounts belonging to people who left months ago, each a quiet way into systems holding sensitive data. The second month is the time to fix it: grant access by role, keep it to what the role needs, and switch it off promptly when someone moves on. A simple shared process beats relying on one person to remember.
This is also the month to protect the money. Grants, donations, and supplier payments often run through a small finance team or a single person wearing several hats, which is fertile ground for the most common attack: an email asking to change bank details or approve a payment. With MFA already in place from month one, add one firm habit. Verify any payment change by phone, to a number you already hold, never by replying to the email. Those two together stop most donation and grant fraud.
It is worth writing the rule down rather than holding it in one person’s head, because in this sector the person who knows the process is often the person on leave when the dodgy email arrives. A single line in your finance procedure, that no bank detail changes without a phone confirmation, gives a relief worker or a volunteer the same protection as your most experienced staff member. The control that survives staff turnover is the one written into how you work, not the one that lives in someone’s memory.
Days 60 to 90: Make Recovery a Certainty
The final month is about the day something goes wrong anyway, because the goal is to significantly reduce risk, not to pretend it disappears. Two cheap controls decide whether an incident is a setback or a catastrophe.
The first is patching. Keeping systems updated closes the known flaws that ransomware relies on, and on ageing equipment with limited IT support it matters more, not less. It costs nothing but a managed process that actually happens rather than a green tick you assume is working.
The second is backups. With irreplaceable client records at stake, a tested backup is not optional. Keep at least one copy an attacker cannot delete or encrypt, and test a restore so you know it works. A backup nobody has restored from is a guess, and a guess is not a safety net for the people who depend on your organisation.
Where This Plan Comes From
This 90-day baseline lines up with Essential Eight, the standard controls published by the Australian Cyber Security Centre. MFA, restricting access, patching, backups. You do not need to learn the framework. You need the controls behind it working in your organisation.
For most NFPs, getting there is not about spending money you do not have. It is about switching on protections you may already be entitled to and putting a few simple processes in place, in an order that protects the people you serve first. The work is real but bounded, and once the baseline is in place the job becomes keeping it in place, which is where ongoing managed IT earns its keep: someone is watching that MFA stayed on, that patching kept pace, and that access was removed when people moved on, rather than discovering a gap the hard way. The starting point is an honest read of where you stand today.
Take the free IT Maturity Assessment to map your current position, then close the gaps in priority order.
