Our staff work from home, from program sites and from their cars. How do we protect that?

A nonprofit workforce is frequently the most distributed of any organization its size. Case managers at program sites, outreach staff in the field, part time people working from home, volunteers coming and going. The traditional idea of an office network to protect does not really apply.

Three things carry most of the weight:

• Keep the data where you control it, not on the laptop. If files live in Microsoft 365 or Google and people work from there, a lost laptop is a lost laptop rather than a data breach. This single change matters more than any security product you could buy, and it also solves the problem of the only copy of something living on a device that goes home every night.
• Multi-factor authentication on everything, with no exceptions for senior people. Free, an afternoon of work, and it stops the overwhelming majority of account compromises. The exceptions are what get exploited, and the exception is usually granted to the executive director, who is the most targeted person in the organization.
• Device management so you can wipe it remotely. Modest per device cost. Lets you require encryption and a screen lock, and lets you erase a machine that is stolen from a car at a program site, which is the specific thing that happens.

For a nonprofit specifically, three more:

Client and participant data is the sensitive part, more than donor data. If you serve vulnerable populations, the case notes are the records that would do real harm if exposed, and they are often the least protected because they live in a spreadsheet or a shared folder that grew organically. Worth looking at deliberately.

Personal devices need a decision. Many nonprofit staff and most volunteers use their own equipment because there is no budget for otherwise. That is workable if the data stays in the browser and multi-factor is required. It is not workable if files are being downloaded to personal machines, and that distinction should be a written expectation rather than an assumption.

Offboarding has to actually happen. With part time staff, seasonal program workers and volunteers, accounts accumulate. A quarterly review of who still has access takes twenty minutes and consistently finds people who left months ago.