Security basics: the slides.

Email is the master key: almost every other account’s password can be reset through it.

• Switch on multi-factor authentication (a second step after the password) for every email account, starting with whoever handles money and whoever administers your systems.
• Prefer an authenticator app or a physical security key over text messages, which can be intercepted or redirected.
• Then do the same for banking, payroll, donor or client databases, and your domain registrar.

An attacker who tricks an administrator gets everything the administrator can touch.

• People who manage systems should have an everyday account for email and browsing, and a separate account used only for administration.
• Keep the number of administrators as small as you can, and write down who they are.

Ransomware looks for backups first. A backup on a drive that is always connected is not a backup.

• Keep at least one copy of important data offline, or in a service that prevents deletion for a set period.
• Restore something from it regularly. A backup you have never restored is a hope, not a plan.
• Make sure the backup includes the things you would actually need to reopen: files, finance records, and the configuration of key systems.

You cannot protect, update or recover what you have forgotten exists.

• Keep a one-page list of devices, online accounts and services, who has administrator access to each, and where sensitive records live.
• Include the services volunteers or former staff signed up for on the organization’s behalf.

Most attacks on small organizations use weaknesses that were fixed months or years earlier.

• Turn on automatic updates for operating systems, browsers and office software.
• Replace devices and software that no longer receive security updates, even if they still work.

Old accounts are a door nobody is watching.

• When staff or volunteers leave, close or hand over their accounts the same day, and change any shared passwords they knew.
• Review who has access to what a few times a year. It is always more people than you expect.

Fake “we’ve changed our bank details” emails cost organizations more than most ransomware.

• Never change a supplier’s or employee’s bank details on the strength of an email alone.
• Call back on a number you already had, not one in the message, and have a second person approve the change.

Many productivity and email platforms include security features that are switched off by default.

• Check that the platform’s recommended security settings are on, including protection against malicious attachments and links, and alerts for suspicious sign-ins.
• Many technology vendors run nonprofit programs. Ask yours what is included before you buy anything extra.

Your data is only as safe as the weakest company holding it.

• Before signing, ask where your data is stored, who at the vendor can see it, how quickly they will tell you about a breach, and how you get your data back if you leave.
• Get the answers in writing. A reputable vendor will not mind.

Some policies require you to call the insurer before you hire anyone to help.

• If you have cyber insurance, find out now what it covers, what you must do first, and the number to call. Put that number in your first-hour plan.

In an incident, the systems that hold your plan may be the ones that are down.

• Write a one-page plan: who decides, who to call, what to disconnect, where the backups are, and how you will reach staff without email.
• Print it. Keep a copy somewhere other than your office network.