Not-for-profits (Not-for-profits)and SME's (Small-to-medium-enterprises) may have legal obligations for the way it collects and stores information. This will depend on the location and nature of your operations. You may consider receiving legal advice to fully understand what legal obligations there may be for your charity. 

Due to a lack of resources or time, NFPs and SME's may not have considered the full extent of their cybersecurity. Though understandable, this creates vulnerabilities. 

Cybersecurity applies to all electronic information. The level of protection you have will affect how security personal or sensitive information is stored and used. 

Cyberattacks are not only a risk for large companies and government agencies. Even Not-for-profits can be targeted. 

It is also noted that donors who fund NFPs and charities, want to make sure that their own personal data is protected and that their donations are not stolen. They would also be pleased to know that the NFP meets government cyber standards, as many charities have huge government contracts. 

Common cybersecurity risks include:1 

• unauthorised access to a device, network or system 

• viruses or other malicious software that can collect, change or delete information and spread throughout a network 

• fake emails or websites set up to trick someone into revealing personal or sensitive information. 

The consequences of an incident can be significant. They may include: 

• loss of crucial information 

• disruption to services 

• unauthorised changes to your charity’s information and systems 

• expensive costs to restore data and services 

• costs of notification and investigation (including legal costs) 

• costs arising from the attack itself (for example, extortion or ransomware) 

• regulatory action and penalties 

• loss of trust and reputation 

​