Nonprofit security checklist
Who else has your donors' data?
A checklist for the vendors that hold your donor data, the logins that still reach it, and what you'd do if a vendor were breached. About ten minutes, no form to fill in.
By continuing, you agree to our cookie policy.
See all 14 questions
Vendors that hold donor data
- Do you have a list of every tool that holds donor data?
- Do you know which of those vendors enforce multi-factor authentication on your account?
- Have you asked each vendor how quickly they'd tell you about a breach?
- Do you know what donor data each vendor holds?
- Do you only keep the donor data you actually need?
Logins and access
- Does everyone who uses the donor database have their own login?
- Is access removed the same day someone leaves, including volunteers?
- Do you review who has access on a schedule?
- Is multi-factor authentication on for email?
If a vendor is breached
- Is there a written plan for what happens if donor data is exposed?
- Is one person responsible for deciding what to tell donors?
- Do you know how quickly you'd need to notify donors?
- Do you have a donor notice drafted and ready to adapt?
- Does your board know the plan exists?