The short answer
Start with the services people depend on and the information needed to deliver them. Identify a few plausible disruptions, examine existing protections, and choose actions with clear owners and observable results. Include staff time and ongoing maintenance in the cost. A short, maintained improvement list is more useful than a large plan that nobody can operate.
Illustrated guide
Read the diagram as text
- Service and exposure: What could interrupt the work?
- Evidence and uncertainty: What is known, and what is missing?
- Owner and next step: Who decides, and how is progress checked?
Begin with the mission and its dependencies
Ask program leaders what must continue when an application, staff account, or provider becomes unavailable. Map the essential workflow in ordinary language: receive a request, schedule a service, communicate with participants, or process a payment. Identify the information, people, applications, and suppliers each step needs. This discussion helps leadership compare security work with other operational priorities using the same service context.
NIST offers a small-business quick-start guide for organizations with modest or undeveloped cybersecurity programs. A nonprofit can use the resource as a discussion aid while adapting the work to its mission. The starting point does not need to be an elaborate maturity score. A clear list of important services and known dependencies can reveal where one missing contact or unclear ownership creates avoidable uncertainty.
Choose a few concrete disruption scenarios
Use scenarios that staff can discuss without specialized vocabulary. What happens if a staff mailbox is taken over? Can the team schedule services without its main application? Who notices an unexpected change to payment instructions? Where could participant information be exposed through an old sharing link? Explain the consequence to the mission, then identify what the organization already does to limit the problem.
CISA describes its cybersecurity performance goals as a way to prioritize a limited set of important security actions. Use that prioritization principle without assuming every action has equal value in your environment. The most useful first step may be verifying account protection, checking a recovery process, or clarifying who can approve access. Establish what is currently working before proposing another product.
Account for people and ongoing effort
Estimate the work needed to introduce a change and the effort needed to keep it working. A new tool may require someone to review alerts, maintain account lists, train volunteers, and handle exceptions. A low purchase price does not answer those questions. Ask who will operate the process during staff turnover, busy programs, and absences. Include the provider’s role if the organization depends on outside IT support.
Keep each action small enough to finish and verify. Instead of writing “improve access security,” identify the application, the population, the owner, and the intended result. If staff need help using a new authentication method, include training and recovery arrangements in the same task. A change that repeatedly prevents legitimate work may prompt informal workarounds unless somebody addresses the underlying difficulty.
Make tradeoffs visible to leadership
Illustrative example: a nonprofit has limited time to improve security before a busy service period. Staff identify incomplete account departure records and an untested alternate scheduling process. Leadership chooses to confirm current access for the scheduling system and walk through the alternate process first. The decision includes owners and follow-up evidence. This is an example of prioritization, not a claim about an actual organization’s results.
Keep deferred work visible with a reason and a date to revisit it. A temporary exception should identify the affected service and the person responsible for the decision. Avoid labeling a risk accepted merely because a task has remained unfinished. Leadership needs enough information to understand the consequence, possible alternatives, and uncertainty before deciding what can wait.
Review outcomes in a short recurring conversation
Ask what changed, what evidence supports the change, what remains uncertain, and which decision needs leadership attention. A departure process improvement might be checked through a recent authorized departure record. A recovery improvement might be checked through a documented restoration exercise. Select evidence appropriate to the action rather than using the number of completed meetings as a measure of protection.
Update priorities when programs, suppliers, staffing, or information handling change. Outside coordination through Fractional CISO may help when ownership and leadership follow-through remain difficult. A defined assessment may help when the baseline is unclear. Keep the plan understandable to program leaders so security work remains connected to the services the organization exists to provide.
Sources and further reading
- NIST: cybersecurity framework resources for small organizations
- CISA: cybersecurity performance goals frequently asked questions
This field note is general educational guidance. Your organization’s requirements, scope, and service arrangements determine the work that applies.