Risk Management

Marshall Whittey, Regional Sales Director, First Nonprofit

"Ransomware" refers to any virus or malware that maliciously encrypts your computer, data, or network to hold it hostage and bring your organization to a standstill until a ransom is paid. During these attacks, your systems display messages prompting users to pay or take other actions that further compromise your organization's security, while promising to allegedly allow you to regain control over your systems or retrieve your data.

The Cyber Readiness Institute (CRI) reports "more than 60% of data breaches are a result of weak or stolen passwords, 91% of all attacks start with a phishing email, 27% of malware infections are introduced via a corrupted USB, and 77% of attacks in 2017 could have been prevented if software was up-to-date." Luckily, an ounce of prevention is worth a pound of cure, and CRI offers a series of short guides below, free webinars,

Ransomware attacks block access to your IT infrastructure or your constituent/donor data unless you pay the attacker to release your property.

The Workforce Re-Entry Toolkit (UST) provides helpful checklists, letter templates, sample policies, and response plans designed to help nonprofit leaders prepare to re-enter the workplace. It also includes an on-demand webinar with tips for welcoming employees back to the office while maintaining compliance with state and federal COVID-19 regulations.

Workforce Re-Entry Toolkit:

Nonprofit organizations must set clear rules and guidelines to ensure the safety and health of volunteers, employees, clients, and minors, as well as to protect company property. Depending on the nature of your nonprofit's work or mission area, you may need policies and procedure documents that vary on the scale of complexity. Below are example policies ranging from a few pages to full manuals.

CAPLP, a nonprofit in Minnesota, has a thorough Volunteer Handbook on which other nonprofits may wish to model their own guidelines and policies for volunteers. Appendices include sample forms for incidents such as standards of conduct for volunteers or reporting an injury, as well as sample exit interview questions.

Topics covered include:

Mergers and acquisitions are much more common in the nonprofit sector than most would think. Nonprofit mergers often come about through default – due to financial distress or leadership vacuums. At the same time, relatively few nonprofits are using it strategically – as a way to strengthen organizations' effectiveness, spread best practices, expand reach, and to do all of this more cost-effectively.

Cybersecurity for Nonprofits by the National Council for Nonprofits provides guidance on first steps to take when introducing your organization's risk assessment practices to examining risks from online crime.

Data Privacy and Cyber Liability: What You Don't Know Puts Your Mission at Risk makes the case that "nonprofits may be at greater risk for reputational and financial damage in the wake of data breaches" and raises concerns that nonprofit leaders may be unaware of the increasingly common breaches of nonprofits' data on donors and constituents. (Nonprofit Risk Management Center)

This article explores: