Non-profit cybersecurity checklist for teams of 5–50

A solid non-profit cybersecurity checklist covers email security, domain protection, automated backups and device patching. WILDCARD MSP’s CORE package covers these essentials for $23 per user + $26 per device = $49 per seat per month, before applicable taxes, with no minimums and no long-term contracts. WILDCARD MSP is an Edmonton-based managed IT and cybersecurity provider, founded in 2018, that makes protection clear, responsive and easy to understand for non-profits, associations and small organizations across Alberta and Canada.

Key takeaways

• Many non-profits assume they are too small to be a target. That's a costly mistake.
• A cybersecurity checklist turns abstract digital threats into a clear, concrete action plan for your team.
• Processing online donations, storing donor information and collecting supporter data all make a checklist essential.
• Assigning one person to own the process stops security tasks from falling between team members.

Why does your non-profit need a cybersecurity checklist?

A cybersecurity checklist turns abstract digital threats into a clear, concrete action plan. It helps your team find gaps before they become crises. Without a written checklist, your non-profit carries risks to donor data, your reputation and your daily operations that you may not even see.

Many non-profits assume they are too small to be a target. That assumption is costly. Organizations with tight budgets and no dedicated IT staff are especially exposed to phishing and other social engineering attacks. A checklist provides structure when budgets and IT time are limited.

What daily activities signal that our non-profit needs a checklist?

Three routine activities make a checklist urgent. First, processing online donations or event registrations exposes your website to payment fraud. Second, storing personal information about donors or employees creates legal and ethical obligations. Third, collecting data on supporter preferences makes your database a target. If any of these describe your day-to-day work, a nonprofit cybersecurity checklist moves from optional to essential.

How does a checklist protect our mission and our team?

A checklist protects what matters most. It safeguards donor trust by keeping sensitive information secure. It keeps your fundraising platforms running during critical campaign periods. And it gives your team confidence that basic defences are in place, from patching software to backing up data.

WILDCARD builds protection that is clear, responsive and easy to understand for non-profits, associations and small organizations across Alberta and Canada. We handle the technology so Executive Directors and their teams can focus on their people, members and mission. Most non-profits don't have a dedicated IT department, so a practical checklist turns cybersecurity basics for nonprofits into daily habits that reduce risk without overwhelming your staff.

What do you need before starting this checklist?

A practical checklist needs a few things in place before the first step. Gather these items so the process moves smoothly and nothing gets overlooked.

Who should lead the checklist review?

Assign one person to own the process. For most non-profits and associations, the Executive Director or an administrative lead takes this role. That person coordinates with staff, tracks progress and makes sure every item gets checked. A single point of accountability stops tasks from falling between team members.

How much time should we set aside?

Block off one to two hours with your team. Rushing through security steps leads to missed details. A focused session lets everyone check settings carefully and ask questions as they come up.

Before you begin, collect three things:

1. A current list of every device your organization uses, including desktops, laptops and any servers
2. Administrator access to your email and workspace platform, whether that's Microsoft 365 or Google Workspace
3. A quiet block of time when key staff can take part without interruption

With the device list and account access ready, the checklist itself becomes straightforward. Our technology foundation checklist covers the broader setup that supports this work.

How do you secure your email and domain first?

Email and domain security come first because attackers go after the inbox and the web address before anything else. A compromised email account can expose donor records, board communications and financial details.

Why does email need protection before other systems?

Email security stops spam, phishing and malicious attachments before they reach your inbox. Because filtering happens before delivery, your staff don't have to judge most dangerous messages themselves.

What does domain security actually cover?

Domain security includes DNS security, registration and administration to protect your web presence. Losing control of a domain means losing your website, your email and your online identity in one stroke. We monitor registration records and DNS settings so attackers can't redirect traffic or impersonate your organization.

Follow these steps to secure both layers:

1. Run a free Domain Security Scan to see your current email and website security in about two minutes.
2. Review the scan results for exposed records, missing authentication or suspicious activity.
3. Enable email authentication (SPF, DKIM and DMARC) to stop spoofing.
4. Lock down domain registration with proper administrative controls and renewal safeguards.
5. Schedule regular reviews so new problems don't go unnoticed.

A free scan shows gaps most organizations never see. Two minutes of checking can save months of recovery work.

How do you protect your devices and data?

Protecting devices and data comes down to three automated layers working together: endpoint defence, automatic backups and disciplined patching. Without them, a single missed update or undetected intrusion can expose donor records, financial data and your organization's reputation.

What stops advanced threats before they infect a computer?

Traditional antivirus scans for known threats and misses everything else. Workstation Defender is next-gen EDR (endpoint detection and response) antivirus built for business. It watches for suspicious behaviour on your computers as it happens, so it can catch ransomware and credential theft that signature-based tools let through.

How do we make sure critical files aren't lost?

Unified Backups cover email, workspace and drives automatically, plus device-level backups. Every donor spreadsheet, board report and financial record gets copied to a secure, off-site location without staff lifting a finger. Automated backups greatly reduce the risk of permanent data loss and make recovery much more manageable.

What keeps known vulnerabilities from piling up?

Software vendors release patches constantly, and most small teams don't have time to apply them. Patch Management makes sure every device is patched within 30 days, automatically closing known vulnerabilities. We handle the scheduling and deployment so your staff stay focused on the mission.

These three protections run quietly in the background. That's what we mean by Make IT Disappear: your team stays focused on your mission instead of day-to-day technology issues.

What should you do if something goes wrong?

A cybersecurity incident calls for quick, structured action. Here is a clear process to follow.

What steps stop the damage from spreading?

1. Disconnect affected devices from the network right away. This isolates the threat and stops it from reaching shared drives or donor databases.
2. Notify your IT provider or security contact right away.
3. Write down everything you noticed: unusual pop-ups, strange account activity or unexpected restarts. These details help whoever investigates.

How does WILDCARD help during a breach?

CORE's Identity Monitor watches your identity, website, domain and the dark web for threats 24/7, so it can flag exposed credentials early. For fully managed clients, we bring in our managed SOC (security operations centre) for incident response. For those clients, our security analysts investigate the root cause, remove the attacker's access and begin recovery, so your team can focus on communicating with stakeholders.

What if we're not fully protected yet?

Organizations without a current checklist tend to face longer, costlier recoveries. Our Fair Play™ pricing means no minimums, no long-term contracts and no hidden fees, so you can get the protection you need without a big commitment.

FAQ

What does WILDCARD MSP's CORE package include for my non-profit?

CORE includes Domain Security, Email Security, Unified Backups, Identity Monitor, Workstation Defender and Patch Management for $23 per user + $26 per device = $49 per seat per month, before applicable taxes, with no minimums and no long-term contracts.

How does a cybersecurity checklist protect donor data?

It makes sure the basics that keep sensitive information secure are actually in place, and it keeps fundraising platforms running during critical campaign periods.

Who should lead the cybersecurity checklist review at our non-profit?

Assign one person, usually the Executive Director or an administrative lead, to own the process so security tasks don't fall between team members.

Conclusion

A practical cybersecurity checklist for a team of 5–50 turns overwhelming risk into manageable, daily habits. Start with the free scan, then add email authentication, endpoint defence, automated backups and disciplined patching. Assign one person to own the review and schedule regular check-ins. These steps protect donor data, preserve your reputation and keep your mission moving forward.

The next step is simple: run the free Domain Security Scan today, or call us at 1-888-274-3530 to talk it through.