# Security for nonprofits that hold donor and client data

> Nonprofits that receive federal awards must take reasonable cybersecurity measures to protect personal information under 2 CFR 200.303, and those that accept card donations must meet PCI DSS. CyberAccord helps nonprofits protect staff accounts and devices, document their safeguards for funders and auditors, and prioritize spending where the risk is highest.

Source: https://www.cyberaccord.com/industries/nonprofits · Last reviewed: 2026-10-22

Federal awards require reasonable cybersecurity, card donations bring PCI DSS, and health or social services can bring HIPAA. We help nonprofits meet those obligations with protection sized to their budget and staff.

## Key facts

- **Federal awards:** Reasonable cybersecurity under 2 CFR 200.303(e)
- **Card donations:** PCI DSS
- **Health services:** HIPAA Security Rule where it applies
- **Where to start:** Accounts, email and backups

## The obligations and risks you face

### Federal awards carry a cybersecurity condition

The Uniform Guidance requires recipients and subrecipients of federal awards to take reasonable cybersecurity and other measures to safeguard information, including protected personally identifiable information and anything the agency designates as sensitive. Single audits and agency monitoring can ask how you meet it.

Source: [2 CFR 200.303(e), Internal controls](https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-D)

### Card donations bring PCI DSS into scope

PCI DSS applies to every entity that stores, processes or transmits cardholder data, and to those that can affect the security of that environment. Using a hosted payment page reduces your scope, but you still have to validate compliance in the way your payment processor requires.

Source: [PCI Security Standards Council: PCI DSS](https://www.pcisecuritystandards.org/standards/pci-dss/)

### Health and counseling services may be covered by HIPAA

Nonprofit clinics and other health care providers that bill electronically are covered entities under HIPAA. The Security Rule then requires a risk analysis, administrative and technical safeguards, and business associate agreements with vendors that handle patient data.

Source: [45 CFR Part 164, Subpart C (HIPAA Security Rule)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C)

## What we recommend

- [Managed Security](https://www.cyberaccord.com/services/managed-security)
- [vCISO](https://www.cyberaccord.com/services/advisory/vciso)
- [Cloud Security](https://www.cyberaccord.com/services/cloud-security)

## Applicable frameworks

- [PCI DSS](https://www.cyberaccord.com/compliance/pci-dss)
- [HIPAA](https://www.cyberaccord.com/compliance/hipaa)
- [NIST](https://www.cyberaccord.com/compliance/nist)

## Frequently asked questions

### We are small and rely on volunteers. Where should we start?

Turn on multi-factor authentication for every account, remove access when volunteers leave, protect email against phishing, and keep tested backups of donor and program data. Those steps address the most common causes of incidents at small organizations.

### Do nonprofit technology discounts change what we need?

They can lower the cost of good tools, such as business editions of Microsoft 365 that include stronger security features. The tools still need to be configured and watched, which is the part most nonprofits are missing.

### What will a funder or auditor ask about security?

Usually whether you have written policies, who can access sensitive data, how you protect it, how you would respond to an incident, and how you oversee vendors. We help you document those answers and back them with evidence.

## Contact CyberAccord

- Book a free consultation: https://www.cyberaccord.com/contact
- Phone: +1 (832) 429-5665
- Email: info@cyberaccord.com