Cyber Safety Checklist for Small Offices and Nonprofits

1. Accounts and passwords

Most break-ins start with a stolen or guessed password.

• Everyone uses multi-factor authentication (MFA) on email.A code or app prompt on top of the password stops most account takeovers. Turn it on for email first, then banking, payroll and cloud files.
• MFA is also on banking, payroll, donor and cloud accounts.These are the accounts criminals want most. Use an authenticator app rather than text messages where you can.
• Staff use a password manager, with a different password for every account.When one website leaks, a reused password unlocks everything else. A password manager makes long, unique passwords easy.
• When someone leaves, their accounts are shut off the same day.Keep a short offboarding list: email, file sharing, building access, shared passwords and any personal devices.

2. Email and scams

Phishing and fake invoices are the most common attacks on small organizations.

• Staff know the warning signs of a phishing email.Urgency, a strange sender, a link that does not match, or a request for gift cards, passwords or payments.
• Payment or bank-detail changes are confirmed by phone, using a number you already have.Never use the phone number in the email asking for the change. This one habit stops most invoice and wire fraud.
• There is one easy way to report a suspicious email.A "report phishing" button or a shared address. Thank people who report; never shame someone who clicked.
• Your email has spam and impersonation filtering turned on.Microsoft 365 and Google Workspace include protections, but they need to be configured, including SPF, DKIM and DMARC for your domain.

3. Devices and updates

Out-of-date software is an open door.

• Computers and phones install updates automatically.Operating systems, browsers and apps like Zoom and Adobe. Restart at least weekly so updates finish.
• Every computer has antivirus or endpoint protection that someone actually monitors.Protection that nobody watches can miss an attack for weeks.
• Laptops are encrypted and lock after a few minutes.BitLocker on Windows and FileVault on Mac, so a lost laptop is a hardware problem, not a data breach.
• You keep a simple list of every device and who has it.You cannot protect what you do not know about, including personal phones that get work email.

4. Backups and recovery

A good backup turns ransomware from a disaster into a bad day.

• Important files and email are backed up automatically.Cloud services like Microsoft 365 do not fully back up your data for you. Check what is covered.
• At least one backup copy is kept offline or locked so it cannot be changed.Ransomware tries to delete backups first. A copy it cannot reach is your safety net.
• You have tested restoring files in the last 6 months.A backup you have never restored is a guess, not a plan.
• You know who to call and what to do first if something goes wrong.Write down a one-page plan: who to call, how to disconnect, and how to reach staff if email is down.

5. People and policies

Technology only works if people know the rules.

• New staff get security basics in their first week.Passwords, MFA, phishing and how to report a problem, before they handle sensitive data.
• Everyone gets a short refresher at least once a year.Short, regular reminders beat a long annual lecture. Practice phishing tests help.
• Admin rights are limited to the few people who need them.Daily work happens on standard accounts, so one bad click cannot install malware across the network.
• Guest Wi-Fi is separate from the network your staff and files use.Visitors, volunteers and smart devices stay off the network that holds client and donor data.

What your score means

• ✓ 17 to 20: you are ahead of most small organizations. Keep testing backups and training new staff.
• ✓ 10 to 16: solid start with real gaps. Fix MFA, updates and backups first.
• ✓ Under 10: one phishing email could cause serious damage. A short free assessment will show you what to fix first.

Where these steps come from

Every item follows free, official U.S. government guidance, rewritten in plain language:

• CISA: Secure Our World
• CISA: Cyber Essentials
• FTC: Cybersecurity for Small Business
• NIST: Small Business Cybersecurity Corner

Been scammed or hacked? Report it to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov, then call your bank right away if money moved.