Cybersecurity for Nonprofits on a Budget: Donor Data, Grants, and What Actually Matters

Nonprofits get hit by the same attacks as any business — phishing, ransomware, donor-data theft — usually on the leanest IT budgets on the map. The reassuring part: there's no nonprofit-specific cybersecurity law to decode. The part that surprises people: several real obligations still apply, and grantmakers increasingly expect a security posture before they write the check. This guide covers what actually applies and the controls that matter most per dollar.

What actually obligates a nonprofit

There's no statute written specifically for nonprofit cybersecurity, but four real pressures apply depending on what your organization does:

• PCI DSS, if you take card donations. The payment-card standard applies to every entity that stores, processes, or transmits cardholder data — there is no nonprofit carve-out (PCI Security Standards Council). Online and event donations put you in scope.
• Grant security requirements. Federal grant recipients must take reasonable measures to safeguard protected personally identifiable information under the federal Uniform Guidance (2 CFR 200.303), and private and institutional funders increasingly ask about data protection during due diligence. A documented program is becoming part of being grant-ready.
• State breach-notification laws. Donor, member, and beneficiary personal information is covered by the same state breach-notification laws that apply to any business that holds residents' data.
• HIPAA or GLBA, if your mission touches that data. A free clinic handles PHI under HIPAA; a credit-counseling nonprofit can fall under the GLBA Safeguards Rule. The mission determines whether these stack on top.

The honest framing: the driver for most nonprofits isn't a single regulator — it's donor trust, grant eligibility, and the same ransomware risk everyone faces.

Why nonprofits are targeted

Two reasons. First, the data: donor and member records — names, contact details, giving history, sometimes payment and bank information — are valuable and often concentrated in a CRM. Second, the gap: most nonprofits run on a stretched, part-time, or volunteer IT setup, which attackers read as a soft target. Ransomware is the blunt end of it — Verizon's 2026 DBIR found it in 48% of breaches (Verizon DBIR) — and a small team without backups can be crippled by a single incident.

The controls that move the most per dollar

Carriers and grantmakers don't grade nonprofits on a curve, so the smart move is to lead with the controls that cost the least and prevent the most:

• MFA on every account. The single cheapest control that closes the most common door — phished or reused passwords.
• Immutable or MFA-protected backups with a tested restore. So a ransomware hit is a bad day, not an existential event. Backups that have never been restored don't count.
• Recurring phishing simulation. Short, role-relevant drills for staff and volunteers — the people who click under pressure.
• Managed detection and response, without an IT hire. A 24/7 SOC watching every endpoint so a lean or volunteer-run team isn't the only thing between a phish and a donor-data breach.

These four are the high-leverage set, and none of them require enterprise money.

Pricing that fits the mission

Cost is the real constraint, so it's worth being concrete: Foundation EDR has no minimum — you can start with a single device. The fuller tiers (Protected adds identity and training; Complete adds SIEM) are built for organizations with at least five staff and are billed per seat. A small nonprofit can run enterprise-grade detection without an enterprise budget — see pricing.

What to do next

The fastest path is to start with the high-leverage controls and produce the documentation grantmakers and cyber carriers increasingly ask for — as a byproduct of the service, not a separate project. The Cyber Insurance Readiness Sprint maps your current state and produces that evidence package in a fixed-scope, seven-business-day engagement. See the Nonprofits & Associations security page for how the program runs on a nonprofit budget.

The bottom line

No single law governs nonprofit cybersecurity, but PCI (on card donations), grant terms, and state breach laws all apply — and donor trust is the asset you can't afford to lose. Lead with MFA, tested backups, and phishing training; get managed detection without hiring; and document it once for grantmakers and carriers. The controls that cost the least move the most.

Protecting donors and grants on a tight budget? Book a nonprofit security assessment.