Cybersecurity for nonprofits
Cybersecurity for nonprofits, sized to your budget
Attackers do not give nonprofits a discount. Fortunately, the protections that stop most attacks do not need a big budget. I close the gaps attackers actually use, on a plan that fits your size, and I stay to help when something goes wrong.
What I help with
Why one of you
I am not here to sell you a product. My US career began at a community energy agency in 2005. When I left for biotech, no replacement could do the job, so they brought me back as a consultant, and I have served them ever since. I fix problems at the root, give the full equipment list with no markup, and do not walk away when the budget does.
Real cases
One account, one gap
- Situation
- An agency I support had one employee account phished and taken over. No genius hacker, just one click and one account where MFA was not set up right. No control stops every click.
- What was done
- Contained it the same day, cleaned it up and closed the gap for every account. I knew their budget, so I did not charge.
- Result
- The account was secured, and the CEO heard it plainly: MFA is not optional anymore.
Agencies facing a statewide MFA requirement
- Situation
- Energy assistance agencies across California must use MFA for ServTraq and CALIHEAPApply starting in January.
- What was done
- Spoke at the ServTraq Innovation Summit on why security starts with MFA, and published a free readiness checklist for agencies.
- Result
- Agencies have a free, practical checklist to get their staff ready ahead of the deadline.
Fixed the same day, client ever since
- Situation
- After an early job for the agency, a firewall I had installed and configured developed an issue that their IT provider at the time could not resolve.
- What was done
- They called me back. I came out and fixed it the same day.
- Result
- They brought me on as their consulting Head of IT, and I have supported them ever since.
Free tools
MFA Readiness Checklist
Get every person ready for MFA, with the methods ranked strongest first.
Cyber Insurance Readiness Checklist
The 24 controls insurers ask about most, so you can answer with confidence.
Incident Response Plan
Who to call and what to do in the first hour of a cyber incident.
Stop. Check. Report. Scam poster
Eight red flags and three steps. Print it and post it near desks.
Questions people ask
Which MFA method is the strongest? Are text codes still OK?
Strongest first: a security key or passkey, then an authenticator app with number match, then an app code, then a text or call code. CISA recommends phishing-resistant MFA and advises moving away from text message codes where you can. Keep text codes as a backup, not the main method. The MFA checklist compares them.
We are a small organization. Are we really a target?
Yes. Most attacks are automated and look for weak passwords and missing MFA, not for big names. Small organizations often have fewer defenses, which makes them easier targets.
What do we do first if we think we have been hacked?
Disconnect the affected device from the network without shutting it down, disable the account, call your incident lead and then your insurer hotline. Do not pay or reply to the attacker. The incident response plan lays it out on one page.
Our cyber insurance renewal is coming up. Where do we start?
Insurers usually ask about MFA, endpoint protection, backups and an incident plan. The cyber insurance readiness checklist lists the common controls. Answer honestly, and note dates for anything still in progress.
Not sure where to start?
One conversation and a straight answer about where your organization stands. No cost, no commitment, no pitch.