A NonProfit board does not need to understand every firewall, security product, software update, or technical configuration protecting the organization. It does, however, need enough visibility to understand whether significant cybersecurity risks are being identified and managed.
For a 20–100 employee NonProfit, we believe board-level cybersecurity oversight can begin with five questions: What are our biggest risks? How are we protecting against them? Can we recover from a serious incident? Who is responsible? And what decisions or investments will we need to make next?
Those questions create a straightforward framework:
Risk → Protection → Recovery → Responsibility → Investment
The purpose is not to turn board members into cybersecurity professionals. Board members should not be deciding how a firewall is configured or which security alert needs investigation.
Their role is different.
The board needs enough information to understand how technology risk could affect the organization, whether appropriate people are managing that risk, and whether leadership needs to make additional decisions.
In other words, cybersecurity oversight is not the same thing as cybersecurity management.
Question #1: What Are Our Three Biggest Cybersecurity Risks Right Now?
One of the easiest ways to make a board cybersecurity discussion unproductive is to overwhelm directors with information.
A long report filled with technical terminology, charts, security alerts, product names, and industry acronyms may demonstrate that a lot of activity is occurring. It doesn't necessarily help a board understand whether the organization is appropriately managing risk.
A better place to begin is surprisingly simple:
What are our three biggest cybersecurity risks right now?
The answer will be different for every organization.
For a health or social-services NonProfit, one risk might involve employees falling victim to phishing and having their accounts compromised. Another might involve sensitive client information accessed through mobile devices. A third might involve the organization's ability to recover if ransomware or another incident makes critical systems unavailable.
The specific risks matter, but so does the way they are communicated.
For each significant risk, leadership should be able to explain:
What could happen → Why it matters → What we're doing about it
Consider the difference between telling a board, “We implemented endpoint protection,” and telling it, “One of our concerns is a compromised employee device providing access to organizational information. We have controls in place to reduce that risk, and here is what we're doing next.”
The second conversation is about the organization.
The first is about a technology product.
Board members generally need the second.
A useful cybersecurity report should therefore help directors see through the technical complexity and understand the handful of risks that deserve their attention most.
Question #2: How Are We Protecting the Organization—and How Do We Know It's Working?
Once the board understands the major risks, the next question is how those risks are being managed.
This is another area where organizations can easily become distracted by technology products.
A NonProfit may have multi-factor authentication, endpoint protection, email filtering, backups, security training, mobile-device management, and several other security tools. Those safeguards may be important, but simply owning them doesn't tell leadership whether the overall security environment is being effectively managed.
Instead, it can be helpful to think about protection across four areas:
People → Devices → Data → Systems
People matter because employees interact with technology and information every day. They receive emails, create passwords, access cloud applications, work remotely, and sometimes make mistakes. Appropriate security therefore needs to account for human behavior as well as technology.
Devices include the computers, laptops, phones, tablets, and other equipment employees use to access organizational systems and information. Leadership doesn't need to understand the technical configuration of every device, but someone should.
Data is ultimately what many security controls are trying to protect. For a social-services organization, that could include sensitive information about clients, employees, donors, programs, or financial operations.
Finally, systems include the applications, cloud platforms, networks, and infrastructure the organization depends on to operate.
The board doesn't need a technical briefing on every safeguard across these four areas. It does need confidence that somebody is looking at the environment as a whole.
A useful follow-up question is:
“How do we know these protections are working?”
That's where cybersecurity moves from installation to management.
Security tools need to be maintained. Employees need ongoing awareness. Devices change. New accounts are created. Old accounts need to be removed. Software needs updating. Backups need attention. Risks evolve.
For organizations that need outside cybersecurity expertise, I-M Technology's SecureIT Managed Cyber Security services are designed around managing cybersecurity as an ongoing responsibility rather than treating security as a collection of one-time purchases.
Question #3: If We Were Attacked Tomorrow, Could We Recover?
No responsible technology provider can promise that an organization will never experience a cybersecurity incident.
That's why one of the most valuable questions a board can ask isn't:
“Are we completely secure?”
It's:
“If something gets through our defenses, can we recover?”
Imagine that employees arrive at 8:00 Monday morning and cannot access one or more systems they need to work on.
What happens next?
Who is notified first? Who determines whether the problem is a normal technology outage or a security incident? Who takes responsibility for the technical response? Which systems need to be restored first, so critical services can continue?
And how confident is the organization that its backups can be used when needed?
There is an important difference between having backups and having recoverable data.
For board members, that distinction matters more than the name of the backup product.
A backup can exist and still fail to deliver the recovery the organization expects if nobody has adequately considered how information will be restored, how long recovery could take, which systems are important, and what employees will do while systems are unavailable.
For a NonProfit, the consequences of downtime also need to be considered in the context of the mission.
If a system is unavailable for several hours—or several days—does that simply create an inconvenience for employees, or does it interfere with the organization's ability to serve clients?
Those are board-level questions because they are ultimately questions about operational resilience, not merely IT.
Question #4: Who Is Responsible for Cybersecurity?
One of the most dangerous phrases after a cybersecurity problem is:
“I thought someone else was handling that.”
Cybersecurity responsibilities can become unclear quickly.
The board assumes leadership is managing it. Leadership assumes that the IT provider has everything covered. The IT provider assumes certain organizational decisions belong to leadership. Employees assume suspicious activity is someone else's problem.
Everyone may be acting reasonably from their own perspective while important responsibilities fall between the gaps.
A useful accountability model is:
Board → Leadership → IT/Security → Employees
The board provides oversight and asks whether significant organizational risks are being appropriately managed.
Leadership establishes priorities, assigns responsibility, makes organizational decisions, and ensures that cybersecurity receives appropriate attention.
IT and security professionals manage the technical environment, recommend safeguards, monitor systems, respond to problems, and help leadership understand technology-related risk.
Employees have their own responsibilities, such as following appropriate security practices and quickly reporting suspicious activity.
These roles overlap, but they are not interchangeable.
An Executive Director should not be personally investigating security alerts. At the same time, an IT provider shouldn't independently decide how much organizational risk leadership is willing to accept.
Clear accountability allows the right people to make the right decisions.
The board doesn't need to know who applies every software update. It should know who is accountable for making sure important security responsibilities aren't being missed.
Question #5: What Cybersecurity Decisions Will We Need to Make During the Next 12 Months?
Cybersecurity reporting shouldn't only describe what happened last month or last quarter.
It should also help leadership see what's coming.
Over the next 12 months, the organization may need to address aging technology, mobile-device management, employee training, backup and recovery, changes to cloud systems, new programs, cybersecurity insurance requirements, or risks created by organizational growth.
Some of those issues may require investment. Others may require policy decisions, employee time, changes in processes, or simply better documentation.
The board doesn't need every detail.
For significant recommendations, a useful structure is:
Problem → Risk → Recommendation → Priority
What problem are we addressing?
What risk does it create for the organization?
What does our technology or security team recommend?
How urgent is it compared with everything else competing for organizational resources?
That last question is especially important for NonProfits.
Cybersecurity isn't the organization's mission. It exists to protect the organization's ability to carry out that mission.
Good cybersecurity planning therefore shouldn't amount to buying every available security product. It should help leadership prioritize resources based on actual risk.
This is also where broader Managed IT Services and technology planning become relevant. Cybersecurity decisions shouldn't exist in isolation from the organization's overall technology roadmap.
A Real NonProfit Example: When 60+ Mobile Employees Created a Different Kind of Risk
United Cerebral Palsy of Eastern Connecticut (UCP-EC) provides residential services, day programs, employment support, and community inclusion for individuals with intellectual and developmental disabilities.
As the organization grew, technology became an important part of delivering those services. More than 60 Direct Support Professionals were using mobile iPads to document care in real time.
From an IT perspective, this created a device-management challenge.
From a leadership and governance perspective, however, the issue was larger.
Those mobile devices were being used as part of client service delivery, while IT oversight was being handled internally by non-technical staff. Device management and software updates were inconsistent, HIPAA compliance concerns were increasing, lost or stolen mobile devices presented additional risk, and leadership lacked confidence that sensitive client information was adequately protected.
That is exactly the distinction boards need to understand.
The organizational risk wasn't simply:
“Are our iPads being managed properly?”
It was:
“Are we appropriately protecting the sensitive information our employees rely on while serving clients?”
I-M Technology worked with UCP-EC to implement a managed IT strategy focused on security, compliance, and operational efficiency.
Staff iPads could be centrally managed, software and security updates could be deployed remotely, and lost or stolen devices could be remotely locked or fully wiped. The engagement also included structured HIPAA tools and training designed to reduce compliance complexity for leadership.
The documented outcomes included stronger protection of sensitive client data, improved confidence around HIPAA compliance, secure and efficient mobile documentation, less leadership time spent dealing with IT problems, and more attention available for programs and mission delivery.
This is a useful example because the technology itself wasn't the end goal.
The goal was to manage the risk created by technology without preventing employees from using that technology to serve people effectively.
That's the level at which a board should think about cybersecurity.
What Should a Cybersecurity Report to the Board Look Like?
Board cybersecurity reporting doesn't need to be dozens of pages long to be useful.
In many organizations, a concise executive summary can create a much better conversation than a large technical report.
One practical approach is to organize a board cybersecurity update around five areas:
Top 3 Current Risks
Major Changes Since the Last Meeting
Has the organization made a significant security improvement, introduced a new system, addressed an important vulnerability, or encountered a new risk?
Significant Incidents or Events
Did anything occur that leadership or the board should understand? This doesn't mean every spam email needs to become a board issue. The purpose is to surface events with meaningful organizational relevance.
Recovery Readiness
Is the organization confident that critical systems and information can be recovered when necessary? Have important recovery processes been reviewed or tested appropriately?
Decisions Needed
Does leadership need the board to approve an investment, understand a risk, support a policy change, or make another governance-level decision?
The exact format should reflect the organization's size, risks, governance structure, and applicable requirements. This isn't intended to be a regulatory reporting template.
It is simply a way to move the conversation away from technical activity and toward organizational risk and decisions.
The Goal Is Clarity, Not More Cybersecurity Anxiety
Cybersecurity discussions sometimes have the opposite effect of what leadership needs.
The more technical information executives receive, the less certain they become about whether the organization is secure.
A healthy cybersecurity relationship should create greater clarity.
Leadership should understand the major risks without needing to investigate them personally. The board should know who is accountable. Employees should understand their responsibilities. Technical professionals should have the authority and resources necessary to manage the environment.
The Coast Guard Foundation provides a useful example of what this can look like.
As the Foundation modernized its technology and expanded remote work, I-M Technology helped strengthen cybersecurity through layered email protection, employee training, and a broader modernization strategy. The resulting environment reduced cybersecurity risk while supporting a largely remote workforce.
Bradley Sisley, Senior Vice President of Development, described the leadership outcome particularly well. Cybersecurity is the Foundation's biggest risk, he explained, but because I-M Technology manages it, it occupies only a very small part of his attention.
That doesn't mean leadership has stopped caring about cybersecurity.
It means the organization has created enough responsibility, visibility, and confidence that leadership can focus on managing the organization rather than personally managing the technology.
Five Cybersecurity Questions to Bring to Your Next Board Meeting
If your board hasn't had a meaningful cybersecurity conversation recently, you don't need to begin with a lengthy technical presentation.
Begin with five questions:
1. What are our three biggest cybersecurity risks right now?
2. How are we protecting against those risks, and how do we know those protections are working?
3. If a serious cyber incident happened tomorrow, could we recover and continue delivering critical services?
4. Who is responsible for cybersecurity across the board, leadership, IT, and employees?
5. What cybersecurity decisions or investments are likely to require our attention during the next 12 months?
If leadership can answer those questions clearly, the board has a strong foundation for a productive discussion.
If the answers are vague, contradictory, or overly technical, that's useful information too.
It doesn't automatically mean the organization has a serious cybersecurity problem.
It may mean leadership needs better visibility into the risk it already has.
For NonProfit boards, that's ultimately the objective: not eliminating every possible cyber risk, but understanding the risks that matter, establishing accountability for managing them, preparing for what happens when something goes wrong, and making informed decisions about what deserves attention next.
If your board is asking harder cybersecurity questions and you're not confident in the answers, learn more about I-M Technology's SecureIT Managed Cyber Security services or schedule a Discovery Call. We'll help you understand the technology risks leadership should be seeing and the questions worth asking next.
