What Maine Nonprofit Boards Should Ask About Cybersecurity

Nonprofit boards hold sensitive information: donor records, client details, staff data. Most do it with a small staff, a tight budget and no security specialist. Directors often assume cybersecurity is too technical to oversee.

It is not. Oversight does not mean running the controls. It means asking the right few questions and making sure someone answers them.

This card is sized for small organizations. It can be read at a board meeting in about ten minutes.

TLDR

• Nonprofits hold sensitive data and can oversee cyber risk without a security team.

• Oversight means asking a few clear questions, not running technical controls.

• Five questions cover ownership, sign-in protection, incidents, backups and training.

• Match expectations to the size of the organization.

• Ask for a short written answer each year.

Why this matters for small organizations

Small organizations are not too small to be targeted. Attackers often go after common weaknesses, such as weak sign-ins and unpatched software, rather than choosing a victim. The U.S. Cybersecurity and Infrastructure Security Agency has published cyber guidance for small businesses that starts with a point directors should note: security is about culture as much as technology, and it cannot be delegated away.

The question card

Ask staff or a trusted volunteer to answer these five questions in writing. The answers below show what to listen for and are illustrative.

Question (illustrative)	A good answer sounds like	A worrying answer sounds like
Who is responsible for cybersecurity here?	A named person who reports to the executive director	"Everyone" or "our IT volunteer"
Are sign-ins protected with a second step?	Yes, for email and financial systems	"We use strong passwords"
What would we do if we lost access to our data?	Backups tested in the last year	"We think we back up"
What is our plan if we have an incident?	A written plan and phone list	"We would call someone"
Do staff and volunteers get basic training?	Yearly, with new-hire coverage	"Not yet"

A worrying answer is not a failure. It is a place to start, and a small budget can fix many of them.

Proportionate, not perfect

A nonprofit with five staff should not have the program of a bank. Ask for the basics done well: a named owner, protected sign-ins, tested backups, a short incident plan and yearly training.

CISA's guidance also asks leaders to review and approve an incident response plan and to take part in tabletop exercises. A short, simple version of both is within reach for most small organizations.

Make it a yearly habit

Put the card on the agenda once a year and ask for a one-page written answer. Keep it with the minutes.

For a longer list that boards of any size can use, see what questions a board should ask about cybersecurity.

Frequently asked questions

Does a small nonprofit really need board-level cyber oversight?

Yes, in proportion. The board is responsible for protecting donors and clients, and a few clear questions once a year is a reasonable level of care.

Who can answer the questions if there is no IT staff?

A staff lead, an outside IT provider or a trusted volunteer. The goal is a named person and a written answer.

What is the single most useful protection?

A second sign-in step, known as multi-factor authentication, on email and financial accounts. CISA names it as one of the most important steps an organization can take.

How much should a small nonprofit spend?

There is no single figure. Start with the low-cost basics on the card, then decide with the board what more is justified by the data you hold.

A Defensible Next Step

Put the five questions on your next board agenda and ask for written answers within a month. Book a Decision-Clarity Call if your board would like help using them.