Home / Commons / Security basics

Field guide

Security basics for small organizations.

The measures that protect a small organization most, in roughly the order to do them, from the people who run security operations for banks, hospitals and agencies. Free to print and adapt.

Moraph Global Resilience OperationsPublished October 2026

Turn on multi-factor authentication for email first

Email is the master key: almost every other account’s password can be reset through it.

  • Switch on multi-factor authentication (a second step after the password) for every email account, starting with whoever handles money and whoever administers your systems.
  • Prefer an authenticator app or a physical security key over text messages, which can be intercepted or redirected.
  • Then do the same for banking, payroll, donor or client databases, and your domain registrar.

Keep administrator accounts separate

An attacker who tricks an administrator gets everything the administrator can touch.

  • People who manage systems should have an everyday account for email and browsing, and a separate account used only for administration.
  • Keep the number of administrators as small as you can, and write down who they are.

Keep a backup ransomware can’t reach

Ransomware looks for backups first. A backup on a drive that is always connected is not a backup.

  • Keep at least one copy of important data offline, or in a service that prevents deletion for a set period.
  • Restore something from it regularly. A backup you have never restored is a hope, not a plan.
  • Make sure the backup includes the things you would actually need to reopen: files, finance records, and the configuration of key systems.

Know what you have

You cannot protect, update or recover what you have forgotten exists.

  • Keep a one-page list of devices, online accounts and services, who has administrator access to each, and where sensitive records live.
  • Include the services volunteers or former staff signed up for on the organization’s behalf.

Let updates install themselves

Most attacks on small organizations use weaknesses that were fixed months or years earlier.

  • Turn on automatic updates for operating systems, browsers and office software.
  • Replace devices and software that no longer receive security updates, even if they still work.

Remove access the day someone leaves

Old accounts are a door nobody is watching.

  • When staff or volunteers leave, close or hand over their accounts the same day, and change any shared passwords they knew.
  • Review who has access to what a few times a year. It is always more people than you expect.

Make payment changes a two-person, two-channel rule

Fake “we’ve changed our bank details” emails cost organizations more than most ransomware.

  • Never change a supplier’s or employee’s bank details on the strength of an email alone.
  • Call back on a number you already had, not one in the message, and have a second person approve the change.

Use the protections you already have

Many productivity and email platforms include security features that are switched off by default.

  • Check that the platform’s recommended security settings are on, including protection against malicious attachments and links, and alerts for suspicious sign-ins.
  • Many technology vendors run nonprofit programs. Ask yours what is included before you buy anything extra.

Ask your vendors the hard questions

Your data is only as safe as the weakest company holding it.

  • Before signing, ask where your data is stored, who at the vendor can see it, how quickly they will tell you about a breach, and how you get your data back if you leave.
  • Get the answers in writing. A reputable vendor will not mind.

Read your cyber insurance before you need it

Some policies require you to call the insurer before you hire anyone to help.

  • If you have cyber insurance, find out now what it covers, what you must do first, and the number to call. Put that number in your first-hour plan.

Write down the first hour

In an incident, the systems that hold your plan may be the ones that are down.

  • Write a one-page plan: who decides, who to call, what to disconnect, where the backups are, and how you will reach staff without email.
  • Print it. Keep a copy somewhere other than your office network.

If it happens

The first hour of an incident.

Print this page and keep it somewhere other than your network.

  1. Disconnect, don’t switch off.Unplug affected devices from the network or turn off Wi-Fi. Leave them powered on: switching off can destroy evidence of what happened.

  2. Move to a safe channel.Assume email and chat may be compromised. Use phone calls or personal devices to coordinate.

  3. Call your insurer, then your national agency.If you have cyber insurance, call them first: many policies require it. Then report to your national cyber security agency.

  4. Write everything down.Keep a timeline: what you noticed, when, and what you did. Responders, insurers and regulators will all ask for it.

  5. Don’t pay, delete or negotiate alone.Paying a ransom does not guarantee recovery, and may be illegal in some cases. Take advice first.

  6. Think about who you must tell.If personal, health or financial records may be involved, you may have legal duties to notify the people affected or a regulator, often within a set time. Get advice early.

National agencies that take incident reports:

Elsewhere, contact your national computer emergency response team (CERT) or the police.

Want someone to check your setup?

Shield gives eligible organizations a security review from Moraph’s security operations people, and help making the fixes.

Apply for Shield