Cybersecurity:
What is the issue?

Cybersecurity, also known as information technology (IT) security, is the practice of protecting critical internet-connected systems and sensitive information from digital attacks. 

Why do nonprofits care?

Is there legislation relating to cybersecurity?

Yes. Every state has its own regulations for legal responsibility in managing and securing data. It is important that nonprofit staff are aware of what is required. In some cases, but not all, the security regulations are rolled into the data privacy laws.

At this point, any national legislation on cybersecurity has been overshadowed by the push for data privacy. To read more, visit our Data Privacy page,

What next? What should we do?

An organization’s CEO needs to view cybersecurity in the same manner they think of a financial or tax audit — it needs to be part of the regular duties addressed each year. Cybersecurity should be a Board-level issue, with the Board responsible for signing off on the necessary steps to reduce the chance of a data breach, just as a board does with budgets and tax audits.

To guide nonprofits along the road to cybersecurity, TNPA created a few resources:

The first is “The Roadmap to Data Security for the Nonprofit CEO.” This document guides a CEO in asking the right questions, setting up effective procedures, and placing the proper emphasis on board involvement when dealing with cybersecurity.

The second is “Considerations for Nonprofits in their Partnership Agreements.” This document addresses the key questions facing nonprofits when putting together an agreement with a for-profit partner in the handling of data. The goal is to forge an effective partnership between the nonprofit and the for-profit entity for the secure handling of data.