Michael Bannach
The award letter came with an attachment. The executive director of a forty-person human services nonprofit had been working toward this state contract for a year and a half, and the attachment was a vendor security questionnaire: twelve pages, due back in thirty days, with a signature line certifying that the answers were true. Question four asked whether multi-factor authentication was enforced on all accounts with access to client data. Question nine asked for the date of the organization’s most recent backup restore test. Question eleven asked for a copy of the written information security policy.
She forwarded it to the office manager, who forwarded it to the volunteer who set up the laptops, who wrote back that he was not really sure what most of it meant.
This is now a normal week at a lot of nonprofits. The questionnaire comes from a state agency, a foundation, a hospital system that refers clients, or the cyber insurance carrier at renewal. The organization has done nothing wrong. It simply has never been asked to prove anything before, and the people asking have stopped accepting “we take security seriously” as an answer.
Why funders started asking
Nonprofits hold exactly the data that is expensive to lose. Case files on people in crisis, health information for programs that touch care, donor records with payment details, payroll, and grant documentation that proves how public money was spent. A breach at a small nonprofit is a breach of the funder’s clients and the funder’s reputation, so the funder now asks the same questions a bank would ask a vendor. Cyber insurance carriers learned the same lesson from their own claims and rewrote their applications to match.
The frustrating part for an executive director is that the questionnaire does not care how small the organization is or how thin the budget is. It asks whether the control exists and whether there is evidence. A forty-person agency and a four-hundred-person hospital get the same question four.
What the twelve pages actually ask, in plain language
Questionnaires differ in wording and agree on substance. Stripped of the vocabulary, they want to know about eight things, and most of them are not expensive. Several are free. What they require is somebody who owns them, and at many nonprofits nobody does, because the office manager owns the building, the program director owns the clients, and the volunteer owns the laptops until he gets a job.
1. A second factor on every account. Every account that can reach client or donor data, including the shared front-desk login and the treasurer’s login for the finance reports, requires a second factor to sign in.
2. Encryption on every laptop that leaves the building. So a device left in a car is a lost laptop and not a reportable breach, with a record showing it was encrypted before it went missing.
3. Somebody watching the computers. Monitoring and managed protection on every device, so the organization hears about a problem from its provider rather than from a screen that turned red.
4. A backup that has been restored. Where the copy lives, how often it runs, and the date someone last restored from it to prove it works.
5. Training with a record. Staff and volunteers trained on phishing, with a list of who completed it and when.
6. A written policy that matches the office. How the organization handles passwords, devices, access and incidents, written so it describes what the staff really does.
7. An access list, reviewed. Who can reach what, with a dated note showing someone looked recently and removed the people who left.
8. A plan for the bad day. What happens when something goes wrong, who gets called, and a phone number on the page.
The answer that gets the contract
The executive director in the scenario has two choices. She can answer the questionnaire as it stands, which means a lot of “no” and “unknown,” and hope the agency accepts a remediation plan. Or she can spend the thirty days getting to “yes” on the items that matter most and documenting the rest with dates.
The second path is more achievable than it sounds, because the first four items on the list are the ones carriers now make conditions of coverage and funders put at the top of the form, and none of the four is a long project at a forty-person organization. Multi-factor authentication is a setting in Microsoft 365 or Google Workspace, plus a couple of weeks of walking forty people through enrolling their phones. Laptop encryption is built into the operating system on business-grade machines and needs only to be turned on and recorded. Monitoring and managed endpoint protection are a service. A backup with a copy outside the building is a service. What takes longer is the paperwork: the policy, the access list, the training records. Those are what turn “we did it” into evidence a funder will sign off on.
One thing worth knowing before you start: nonprofit pricing exists for much of the licensing behind this. Microsoft and Google both run nonprofit programs, and TechSoup validation unlocks discounts on security tooling that a commercial business pays full price for. An organization that has never enrolled is usually paying more than it needs to for less than it needs.
Three questions for whoever runs your IT
- If a funder’s questionnaire arrived today, which of the eight items above could you answer with a date and a document, and which would be a guess?
- Are we enrolled in TechSoup and the Microsoft or Google nonprofit program, and when were our licenses last re-checked against them?
- Who at this organization owns the security policy, the access list and the training records, by name?
If the third answer is “nobody,” that is the first thing to fix. Everything else on the questionnaire depends on it.
How we handle it for nonprofits
We built Stealth Impact for organizations of ten to one hundred fifty staff that need to answer questionnaires like this one without hiring an IT department. The security baseline of multi-factor authentication, managed endpoint protection, patching, encrypted backup and monitoring is sized to what insurers and funders actually ask for. Nonprofit licensing through TechSoup and the Microsoft and Google programs is managed as part of the service and re-checked at every renewal. Annual security awareness training is part of the package, and so is the evidence funders and auditors ask for. The quarterly review with the executive director is where the open items from a questionnaire like this one get tracked until they are closed. And once a quarter we look for grants that fund technology and security projects, with a scoped project plan for each one worth applying for, because the questionnaire that arrives next year may ask for things the budget cannot cover this year.
Lisa Herold, the office manager at Center for Community Alternatives, put the day-to-day of it this way: “For me the biggest benefit of Stealth Tech is having a place to call or email.” That is what the questionnaire is really asking for.
If you would like a plain read on where your organization stands, the three-minute IT and security scorecard turns your answers into a written roadmap, and the conversation after it is free. You can also read about what Stealth Impact includes.
