Non-Profits & Cyber Risk: Ignorance is Not Bliss.

When it comes to the safe handling and storage of data, ignorance is not bliss. A board of directors has key responsibilities when it comes to this topic.?

Cybersecurity is not a new term, but it’s one that many people don’t truly understand. I get it; it’s a bunch of technical jargon that can be hard to contextualize. But just because you don’t understand the risk doesn’t mean it’s not present.?

This is especially true for non-profit organizations. Many non-profits don’t have the funding and resourcing to identify and mitigate cyber risks effectively. This means that many nonprofits and charities have low security environments and lack of awareness, making them easy targets for bad actors.?

Boards need to take a leadership role in ensuring that the organizations they govern have considered cyber security risks and put processes in place to manage these risks. To preserve the long term health of an organization, boards must oversee the implementation of cyber security strategies and response plans. This includes adoption of technical applications, training employees, and establishing a culture of cyber awareness.?

Security breaches lead to the theft and misuse of private information, which could include personal contact information, medical records, financial details, service delivery records, opinion data, and sensitive donor information. Additionally, a cyber breach can lead to disruption of key operating systems for extended periods of time. This can lead to financial loss and serious reputational damage.?

For example, the Toronto Library was hit with a cybersecurity attack in October 2023, disrupting systems and technology across more than 100 branches. Users were unable to place holds on books, access their accounts or use computers on site for months following the attack.?

The Salvation Army was hacked and fraudulent emails were sent to the City of Ottawa about changing bank account information for an upcoming payment. The hackers impersonated the Executive Director and the organization's web domains. This resulted in over $558,000 being transferred to a hackers account.?

Why do cyber attacks occur? It can be motivated by many factors from financial gain to pure malice.?

There are many steps that a Board of Directors can take to manage cyber security risks.?

• Understand the risk. Cyber risks should be part of a Board’s risk assessment process
• Require the organization to implement policies and emergency plans
• Incorporating robust incident response planning and a clear communication strategy is vital.?
• Protect data centers and equipment
• Train employees to recognize threats, irrespective of their work setup (remote, hybrid, or onsite)

Finally, considering cyber insurance as a part of the risk management strategy can provide a financial safety net against losses from cyber incidents. While not preventive, it offers financial protection, supporting business continuity and preserving reputation post-incident.?