Mission-driven nonprofits
Protect the information behind your mission.
When a nonprofit handles sensitive information, security responsibilities need to be understandable and achievable. I help executive directors identify priorities, prepare policies, and respond to concrete questions from partners and funders.
Questions worth putting on the agenda
- Has a partner or funder asked for security policies or a SOC 2 report?
- Do staff and service providers know who owns security responsibilities?
- Is there a clear priority order for limited staff time and resources?
Experience and perspective
My engagement experience includes SOC 2 readiness for a California water-data nonprofit and ongoing website support for an animal rescue nonprofit. Website support is a supporting capability for existing clients.
Define the work that fits.
Start with the information your organization holds and the services it depends on. Discuss sensitive information at an appropriate level; an introductory email should never include donor records, passwords, or client data.
Choose a starting point
Security Assessment
A scoped review of systems, access, and risk, with a plain-language report and prioritized fixes.
Fractional CISO
Monthly security leadership for policy, vendor review, leadership reporting, and incident planning.
SOC 2 Readiness
Gap assessment, policies, controls, and evidence preparation for organizations preparing for a SOC 2 audit.
Before sharing information
Use the first conversation to explain the situation at a high level. The agreed engagement defines what information is needed and how it will be shared.
Start with a conversation
What security question is on your desk?
Tell me what prompted the question. A 20-minute call is a place to establish the next step.