Nonprofits and Foundations
Security for nonprofits that hold donor and client data
Federal awards require reasonable cybersecurity, card donations bring PCI DSS, and health or social services can bring HIPAA. We help nonprofits meet those obligations with protection sized to their budget and staff.
- Federal awards
- Reasonable cybersecurity under 2 CFR 200.303(e)
- Card donations
- PCI DSS
- Health services
- HIPAA Security Rule where it applies
- Where to start
- Accounts, email and backups
At a glance
Nonprofits that receive federal awards must take reasonable cybersecurity measures to protect personal information under 2 CFR 200.303, and those that accept card donations must meet PCI DSS. CyberAccord helps nonprofits protect staff accounts and devices, document their safeguards for funders and auditors, and prioritize spending where the risk is highest.
2 CFR 200.303(e), Uniform Guidance
The obligations you face
Each point below rests on a primary source. Follow the link to read the rule itself.
Federal awards carry a cybersecurity condition
The Uniform Guidance requires recipients and subrecipients of federal awards to take reasonable cybersecurity and other measures to safeguard information, including protected personally identifiable information and anything the agency designates as sensitive. Single audits and agency monitoring can ask how you meet it.
Source2 CFR 200.303(e), Internal controls (opens in a new tab)
Card donations bring PCI DSS into scope
PCI DSS applies to every entity that stores, processes or transmits cardholder data, and to those that can affect the security of that environment. Using a hosted payment page reduces your scope, but you still have to validate compliance in the way your payment processor requires.
SourcePCI Security Standards Council: PCI DSS (opens in a new tab)
Health and counseling services may be covered by HIPAA
Nonprofit clinics and other health care providers that bill electronically are covered entities under HIPAA. The Security Rule then requires a risk analysis, administrative and technical safeguards, and business associate agreements with vendors that handle patient data.
Source45 CFR Part 164, Subpart C (HIPAA Security Rule) (opens in a new tab)
Sources last reviewed . This page explains obligations in general terms and is not legal advice.
Recommended services
What we recommend
Three services, most relevant first, chosen for the obligations above.
- 1 · Managed Security ServicesManaged SecurityManaged endpoint, email, and cloud security, with a team that monitors alerts and responds to incidents for you.
- 2 · Virtual CISOvCISOA part-time, U.S.-based security executive who leads your security program, manages risk, and reports to leadership.
- 3 · Cloud SecurityCloud SecurityAWS and Azure security assessments and architecture reviews that find misconfigurations and give you a prioritized plan to fix them.
FAQ
Sector questions, answered
We are small and rely on volunteers. Where should we start?
Turn on multi-factor authentication for every account, remove access when volunteers leave, protect email against phishing, and keep tested backups of donor and program data. Those steps address the most common causes of incidents at small organizations.
Do nonprofit technology discounts change what we need?
They can lower the cost of good tools, such as business editions of Microsoft 365 that include stronger security features. The tools still need to be configured and watched, which is the part most nonprofits are missing.
What will a funder or auditor ask about security?
Usually whether you have written policies, who can access sensitive data, how you protect it, how you would respond to an incident, and how you oversee vendors. We help you document those answers and back them with evidence.
Talk to a security practitioner
Tell us what is driving the need: an audit, a client questionnaire, a contract clause or an insurance renewal. We'll recommend a scoped next step with a fixed quote.