Industry
Nonprofits
Nonprofits carry commercial grade risk on a fraction of the budget, and the most valuable early work is usually not a purchase. It is claiming licensing already available to you, removing accounts that should have gone years ago, and confirming the backup restores.
Start with the free controls
MFA, offboarding, restore test
none of which cost anything
These three close more risk per dollar than any product purchase available.
Six factors specific to the sector
| Factor | Nature |
|---|---|
| Microsoft nonprofit grantsFrequently unclaimed, or claimed and then underused | Donated and discounted licensing |
| Donated and discounted softwareWorth checking before any renewal | Sector programmes for common tools |
| Volunteer accountsThe most common source of dormant active accounts | High turnover, low oversight |
| Donor dataReputationally the most damaging thing you hold | Names, contact details, payment history |
| Grant reportingA missed deadline caused by an outage has direct financial cost | Deadlines with funding attached |
| Hybrid and remote staffDevice management matters more, budget for it is smaller | Common, often on personal devices |
Five places money is usually available
- Claiming the Microsoft nonprofit grant, which covers a meaningful number of donated licences for eligible organisations
- Moving from paid tiers to grant covered tiers where the feature set genuinely matches
- Removing licences assigned to departed staff and volunteers, which is nearly always a live saving
- Consolidating overlapping tools that arrived through different programmes or different staff
- Retiring an on premises server whose replacement cost is approaching, rather than buying another one
A licensing review is an afternoon of work and in this sector it regularly finds enough to fund a meaningful share of the first year. It is the first thing worth doing, before any conversation about buying anything.
The dormant account problem
Nonprofits accumulate active accounts belonging to people who are no longer involved more than any other sector, and the reason is structural rather than careless.
Volunteers drift away rather than resign. Board members rotate without a formal offboarding step. Programme staff arrive on short grant funded contracts and leave when the funding ends, often without a defined last day. Nobody is doing anything wrong, and the accounts simply stay.
Each one is a working credential into donor data. Time limited accounts with a renewal step, plus a quarterly review, fix it permanently and cost nothing but the habit.
Common questions
Answered before you ask.
How do the Microsoft nonprofit grants work?
Eligible organisations can receive a number of donated licences and discounted rates above that threshold, which for a small nonprofit frequently covers most or all of what they need. Eligibility is verified through a registration process. The two common failures are never applying, and applying successfully then continuing to pay for a commercial subscription alongside it because nobody consolidated the tenants.
Volunteers come and go constantly. How do we manage access?
With an expiry date on the account from the day it is created, rather than relying on someone to remember a departure that nobody formally announces. Volunteer turnover is rarely a clean process with a last day and an exit interview, which is exactly why dormant accounts accumulate here more than anywhere else. Time limited accounts with a renewal step solve it structurally instead of procedurally.
What is the biggest risk to a nonprofit specifically?
Donor data, because the damage is reputational as much as financial and the sector runs on trust. A breach involving donor names, contact details and giving history is materially worse for a nonprofit than a comparable breach at a commercial business of the same size, because the affected people chose to support you and may simply stop. That argues for treating the donor database as the most protected system you run.
We have almost no budget. What should we do first?
Three things, all cheap. Turn on multi factor authentication everywhere, which is free with licences you already hold. Remove accounts belonging to people who have left, which saves money rather than costing it. And confirm your backup can actually be restored. Those three close more risk per dollar than anything else available, and none of them requires a new purchase.
Related
What this sector usually needs first.
Microsoft 365 management
Tenant hardening, device management, licensing and the backup gap.
Backup and disaster recovery
Immutable backups with tested restores and a defined recovery window.
Cybersecurity services
Endpoint detection, email security, monitoring and user training.
What managed IT services cost in Tacoma
Per user pricing bands, what moves the number up, and how to read a quote.
Financial services
GLBA, member data, fraud monitoring
Check what licensing you are entitled to.
The assessment includes a licensing review against nonprofit programmes. It frequently finds a saving that covers a meaningful part of the first year.