BLOG

By David Chernitzky, CEO, Armour Cybersecurity  ·  Serving Toronto and organizations across North America  ·  Last updated August 26, 2026

Key Takeaways

• The most impactful cybersecurity controls for nonprofits are procedural and configuration-based, not expensive technology purchases.
• A managed cybersecurity service sized for nonprofits covers endpoint protection, email security, and monitoring at a predictable monthly cost without enterprise overhead.
• A fractional vCISO provides the senior cybersecurity governance that boards and funders expect at a fraction of the cost of a full-time hire.
• Funder questionnaires, government grant conditions, and cyber insurance renewals are increasingly requiring documented cybersecurity controls that a right-sized programme produces.
• The cost of a nonprofit cybersecurity programme is almost always less than the cost of recovering from a single ransomware attack or BEC loss.

Why Do Nonprofits Underinvest in Cybersecurity?

The most common reason nonprofit leaders give for limited cybersecurity investment is budget constraint. Every dollar spent on cybersecurity is a dollar not spent on programme delivery. For organizations whose entire purpose is mission impact, the opportunity cost of administrative overhead, including security, feels acute and visible.

A second reason is the misconception that cybersecurity is inherently expensive and technically complex. The mental model of cybersecurity as something that requires a dedicated security team, a SOC, and enterprise-grade technology is accurate for large financial institutions and critical infrastructure operators. It is not accurate for a mid-size NGO or a community foundation. The controls that matter most for organizations at that scale are accessible, affordable, and implementable without specialized in-house expertise.

A third reason is that the consequences of inadequate cybersecurity have historically felt abstract until an incident makes them concrete. A nonprofit that has never experienced a ransomware attack or a BEC loss may not viscerally understand what those events cost. Once they do, the calculus changes immediately, but the investment that would have prevented the incident was available before the event at a fraction of the recovery cost.

What Are the Highest-Impact, Lowest-Cost Controls?

Multi-Factor Authentication

MFA on organizational email accounts and donor management platforms stops credential-based attacks from succeeding. A phished password cannot access an MFA-protected account. For nonprofits using Microsoft 365 or Google Workspace, MFA is included in the existing subscription and requires a management configuration change rather than additional spending. For other platforms, authenticator apps are free and compatible with most organizational software. The cost of MFA enforcement for most nonprofits is measured in hours of configuration time, not dollars.

Email Authentication

DKIM, SPF, and DMARC records prevent attackers from spoofing the organization’s domain in emails to donors, staff, and funders. Properly configured email authentication means that a fraudulent email pretending to come from your executive director will not reach donor inboxes claiming to be from your domain. The configuration requires access to DNS records and some technical setup, but the ongoing cost is zero and the protection is significant. Many nonprofits have partial email authentication without DMARC enforcement. Completing the configuration closes the gap.

Access Management and Offboarding

Role-based access that limits staff and volunteers to the systems and data they genuinely need for their roles, combined with prompt offboarding that revokes access when someone leaves, prevents the access accumulation problem that many nonprofits carry. A departing staff member who retains access to a donor database or email account represents a persistent vulnerability that grows with each unclosed transition. A clear offboarding checklist and a designated person responsible for executing it costs nothing except process discipline.

Incident Response Plan

A documented incident response plan that defines who to call, what to do, and how to communicate when a cybersecurity incident occurs prepares the organization for the decisions that must be made quickly under pressure. A plan does not need to be lengthy or technically complex to be useful. It needs to define the chain of notification, the immediate containment steps for the most likely scenarios, the contacts for the cybersecurity provider and cyber insurer, and the communication templates for board, donor, and regulator notification. The value of having this prepared in advance versus assembling it during a crisis is substantial.

What Does a Right-Sized Nonprofit Cybersecurity Programme Look Like?

For most nonprofits, an effective programme has three components: a managed cybersecurity service that covers the operational security layer, a fractional vCISO that provides governance and oversight, and project-based engagements for specific requirements as they arise.

Managed Cybersecurity Service

A managed cybersecurity service covers endpoint protection on staff devices, email security filtering and authentication, basic network monitoring, and incident response support. For a nonprofit, this means that the day-to-day security operations, the patching, the alert monitoring, the threat detection, are handled by a professional team without requiring an in-house security hire. Armour 360 is structured specifically for organizations that need comprehensive coverage at a budget that reflects their scale, not the scale of enterprise clients.

The predictable monthly cost model of a managed service is particularly appropriate for nonprofits that budget annually and cannot absorb unpredictable security costs. Knowing what cybersecurity costs as a line item in the operating budget is administratively simpler and financially more manageable than variable project spending.

Fractional vCISO

A fractional vCISO provides senior cybersecurity leadership at an engagement level measured in days per month rather than full-time employment. For a nonprofit, the vCISO covers board reporting on cyber risk in terms that a volunteer board can understand, governance of the cybersecurity programme, vendor risk assessment, incident response oversight, and responses to funder questionnaires that ask about cybersecurity governance. The cost is a fraction of a full-time CISO and provides capability that boards and major funders expect to see in an organization managing sensitive data.

Project-Based Engagements

Compliance audit to satisfy a specific funder questionnaire, penetration testing required by a government grant condition, or a privacy programme for GDPR compliance with EU donors are examples of project-based engagements that address specific requirements as they arise. These are scoped to the specific need rather than ongoing, which makes them manageable within annual budgets that have defined project allocations.

How Do Funder Questionnaires Drive the Business Case for Investment?

The business case for nonprofit cybersecurity investment has become easier to make as funders have added security requirements to their grant conditions. Government funders, community foundations, and institutional grant-makers increasingly ask nonprofits to demonstrate cybersecurity controls before awarding or renewing grants. A documented information security programme, evidence of MFA deployment, a tested incident response plan, and a cybersecurity contact who can respond to questionnaires are the minimum that most funder questionnaires expect.

A nonprofit that loses a grant because it cannot satisfy a funder questionnaire has paid the cost of inadequate cybersecurity in the most direct way possible: lost revenue. The grant that was not received because the organization could not demonstrate basic controls is typically larger than the cost of the programme that would have satisfied the questionnaire. Making this calculation explicit for boards and executive directors, with specific reference to funders who have already added security requirements, is often the most effective argument for investment.

How Does Cybersecurity Scale with Organizational Size?

Armour Cybersecurity structures nonprofit engagements on a sliding scale that reflects mission, risk, and budget rather than headcount alone, and delivers them as nonprofit cybersecurity services priced to how charities and NGOs operate. A solo executive director running a small foundation faces different requirements than a mid-size social services organization with fifty staff and a large beneficiary database. The programme elements are the same in principle but scaled in scope and cost.

A solo practitioner or small organization typically needs MFA enforcement, email authentication, a basic incident response plan, and access to a cybersecurity advisor who can respond to funder questionnaires. A mid-size organization adds managed endpoint and email security, formal access management procedures, and a fractional vCISO for governance and board reporting. A larger NGO with international operations adds threat intelligence, privacy programme management, and more formal compliance structures. The programme grows with the organization rather than starting at a scale that smaller organizations cannot afford.

Across the 260+ organizations Armour Cybersecurity protects in 52+ industries, the nonprofits that get security right on a tight budget are the ones who stopped waiting to afford an enterprise programme and instead bought the cheap things first. They turned on MFA that came free with the email they already pay for, finished the DMARC record that was half-configured, wrote a two-page incident response plan, and closed accounts the day people leave, and only then layered a right-sized managed service and a few days a month of vCISO on top, so the whole programme costs a low single-digit percentage of the budget and still answers every funder questionnaire and every insurer that asks.

Frequently Asked Questions

How much should a nonprofit expect to spend on cybersecurity?

A useful benchmark is one to three percent of operating budget for organizations managing sensitive donor or beneficiary data. For a $2 million operating budget organization, that is $20,000 to $60,000 annually, which covers a managed security service and a fractional vCISO with budget remaining for project engagements. This is significantly less than most nonprofit leaders assume, and significantly less than the cost of recovering from a ransomware attack or a BEC loss. Armour structures engagements to a specific budget envelope when that is helpful.

Can we use free or discounted tools to reduce costs?

Yes. Several cybersecurity tools offer nonprofit pricing or free tiers that are appropriate for small organizations. Microsoft 365 Nonprofit plans include security features that, properly configured, provide meaningful protection. Google Workspace for Nonprofits is similarly available at reduced cost with useful security capabilities. The challenge is not access to tools but knowing how to configure them correctly. A fractional vCISO or a managed service engagement that includes configuration of existing tools often produces more security value than purchasing additional tools without expert configuration.

What is the minimum we need to satisfy a government funder questionnaire?

Most government funder questionnaires ask about six to eight areas: access controls including MFA, encryption of sensitive data, incident response capability, staff security awareness, vendor management, backup and recovery, and a senior person responsible for cybersecurity. An organization that can demonstrate MFA on all accounts, encrypted storage for sensitive data, a documented incident response plan, annual staff training, basic vendor assessment practices, tested backups, and a vCISO or equivalent contact satisfies the majority of government funder questionnaires. Armour’s vCISO service produces a written programme document that addresses these areas and can be provided directly in response to questionnaires.

Should cybersecurity be a line item in grant budgets?

Yes, and increasingly funders are explicitly allowing or expecting it. Technology and data security costs are legitimate programme costs for any organization that depends on technology to deliver its mission and manage client data. Some government funders specifically allow cybersecurity costs as eligible expenses. Including cybersecurity as a named line item in grant budgets normalizes the investment and makes the cost visible to funders who are simultaneously asking for cybersecurity attestation. An organization cannot be expected to demonstrate cybersecurity controls that it has no budget to implement.

The Bottom Line

The reason so many nonprofits are underprotected is not that security is unaffordable. It is that the price is assumed to be enterprise-scale when the controls that stop most attacks are configuration and discipline: MFA that ships free with the email subscription, a finished DMARC record, role-based access with real offboarding, and a short incident response plan. On top of that, a right-sized managed service and a few days a month of vCISO cover operations and governance for a low single-digit percentage of the operating budget, less than one ransomware recovery or BEC loss, and produce exactly the documentation funders and insurers now ask for. Armour Cybersecurity builds budget-aware nonprofit cybersecurity services for charities and NGOs that protect donor data and mission operations and satisfy funder requirements, so cost stops being the reason a nonprofit stays exposed.