The Australian Not-For-Profit (NFP) sector, which supports vital community needs, is increasingly targeted in cyber warfare– often falling at the hands of human error. The OAIC’s Notifiable Data Breaches Report (2024) reveals that human error breaches accounted for 30% of all data breaches. These vulnerabilities can drain financial resources, disrupt services, and compromise donor trust, underscoring the importance of robust cyber security for NFPs.
This guide explores the most pressing cyber security risks facing the NFP sector. It offers practical solutions, from employee awareness and security controls to best practice frameworks, enabling NFPs to fulfil their mission safely and sustainably.
Source: OAIC
The True Costs of NFP Cyber Incidents
For Australian NFPs, cyber incidents present a substantial financial and operational threat. In particular, data breaches can result in recovery costs, legal fees, and reputational damage. In 2024, the OAIC reported 910 notifiable data breaches.
Establishing trust with donors and beneficiaries takes significant time and effort, as NFPs build a reputation for serving their communities with integrity and safeguarding sensitive information. However, that trust can be tarnished in a dash if data is mishandled or compromised. Clear communication about how data is stored and processed is essential for setting and maintaining community expectations. Without this transparency, organisations risk their reputation and with that, their mission.
NFPs are particularly attractive to criminals due to the sensitive data they handle, including donor and beneficiary details. Unfortunately, limited budgets often lead to underinvestment in cyber security, creating vulnerabilities that criminals exploit, enabling them to access confidential information, compromise systems, and disrupt services critical to community support.
Ensuring data security is not just about compliance—it’s about preserving the hard-earned trust that underpins every organisation’s ability to function effectively.
Current Cyber Threats for NFPs
According to the Australian Nonprofits State of the Sector 2023 report, only one in three NFPs surveyed complied with data privacy regulations. Plenty of today’s threats arise from internal error and a lack of training or awareness, which introduces vulnerabilities to the network. A lack of robust defences makes the sector an attractive target.
Several key threats currently dominate the landscape for NFPs:
- Ransomware Attacks: Often involve both encrypting and stealing data from victims, disrupting operations and leading to notifiable data breaches. NFPs are prime targets due to their services’ critical nature and reliance on continuous access to sensitive data.
- Account Takeover and Email Compromise: Cybercriminals gain unauthorised access to email accounts, often committing fraud or stealing sensitive data. This can lead to altered donor communications or unauthorised financial transactions, significantly damaging trust.
- Phishing and Social Engineering: Fraudulent emails or impersonation tactics trick staff and volunteers into revealing sensitive information, such as login credentials or donor data.
- Exploitation of Outdated Systems: Many NFPs rely on older software and systems that lack the necessary updates to defend against modern cyber threats.
- Human Error and Insider Threats: Unintentional actions, such as clicking on malicious links or mishandling sensitive information, can lead to significant breaches. Internal threats also include malicious actions by disgruntled staff or volunteers.
Critical Cyber Security Challenges Faced by NFPs
- Limited Resources: Many challenges stem from limited resources and a need for dedicated cyber security expertise.
- Lack of Awareness: Many NFP staff and volunteers need up-to-date training on cyber security concerns. Strong awareness and up-to-date training on basic cyber hygiene are necessary in business today.
- Compliance Requirements: Many NFPs are increasingly required to meet compliance requirements to be eligible for funding. These regulations mandate that organisations demonstrate a robust cyber security posture.
Proposed Changes and Future Outlook for NFPs
New legislation and frameworks designed to address increasing cyber threats have amended cyber security requirements for Australian NFPs. The Cyber Security Bill 2024 introduces stricter obligations for incident reporting, ransomware responses, and data protection, reflecting the growing need for resilience across all sectors. These changes are expected to significantly impact NFPs, particularly those handling sensitive donor and beneficiary information.
The key updates impacting NFPs:
- Mandatory Ransomware Reporting – NFPs must report any ransomware payments within 72 hours. This regulation aims to improve transparency and enable coordinated responses to cyber incidents.
- Cyber Incident Review Board – A newly established board will oversee investigations into major cyber incidents, providing support and insights to help organisations strengthen their defences and improve recovery processes.
- Centralised Incident Response Coordination – The Act creates a National Cyber Security Coordinator responsible for leading government responses to significant cyber events and offering expert guidance and resources to affected organisations.
The government has signalled that further reforms may follow, including updates to the Privacy Act 1988 to enhance data protection and enforce stricter penalties for non-compliance. NFPs must take proactive steps to safeguard their data, protect their reputation, and maintain the trust of donors and stakeholders. NFPs should align with frameworks such as the Essential Eight developed by the Australian Cyber Security Centre (ACSC).
How to Manage Cyber Security Risk for NFPs
With limited resources and increasing threats, NFPs can significantly reduce risks by adopting simple yet impactful strategies tailored to their needs. By leveraging proven frameworks and targeted resources, NFPs can build a resilient cyber security posture, maintain compliance, and strengthen stakeholder trust. Below are key strategies to help NFPs safeguard their operations:
Implement the Essential Eight Strategies
Developed by the ACSC, the Essential Eight is a baseline framework designed to mitigate cyber risks effectively. These measures are critical for NFPs to defend against threats:
- Patching Applications and Operating Systems: Regular updates address vulnerabilities. Use vulnerability scanning to identify and apply critical patches promptly.
- Enforcing MFA: Protect sensitive accounts by requiring additional authentication steps, with all events logged for incident response.
- Restricting Administrative Privileges: Minimise access to critical systems by enforcing least-privilege role-based access. Log privileged access events for forensic purposes.
- Application Control: Prevent unauthorised applications from executing to reduce malware risks.
- Restricting Microsoft Office Macros: Allow only trusted macros to execute, mitigating risks of embedded malicious activity.
- User Application Hardening: Block attackers from using applications to download or execute malicious code.
- Regular Backups: Maintain secure, regularly tested backups stored in isolated environments to ensure quick recovery from cyber incidents.
Leverage Tailored Guidance
NFPs should utilise specific resources to align with compliance requirements and establish best practices:
- Rodin’s Cyber Security Checklist: Offers actionable steps to enhance resilience.
- AICD’s Governance Principles: Provides leadership frameworks for cyber security integration.
- ACNC’s Privacy and Data Protection Updates: Reinforces responsible data handling to build trust and comply with evolving regulations.
Train Staff and Volunteers
Cyber security awareness is essential for equipping NFP teams to identify and respond to threats such as phishing and social engineering attacks. Regular training ensures staff and volunteers stay informed about emerging risks, fostering a proactive approach to security.
Build a Cyber Security Culture
A strong cyber security culture is vital for NFPs to manage risks effectively and starts with a leadership commitment to cyber security as a core governance priority with organisation-wide participation.
Boards should conduct regular risk assessments, integrate cyber security into governance frameworks, and establish clear accountability for monitoring and compliance.
Security Monitoring and Response
Proactive monitoring and response capabilities are essential for detecting and mitigating risks:
- Implement continuous monitoring through a Security Operations Centre to quickly identify unusual activity or threats.
- Outsource monitoring services if resources are limited to ensure access to specialised tools and expertise.
- Swift response mechanisms reduce potential damage and maintain operational continuity.
Conclusion
For NFPs, partnering with cyber security experts is a practical way to access specialised tools, insights, and strategies that strengthen defences against evolving threats. External providers offer tailored solutions, including advanced monitoring, incident response planning, and compliance support, enabling NFPs to manage risks effectively without overstretching resources. Engaging external expertise helps organisations stay secure, compliant, and focused on their mission.
Cyber security providers offer tailored solutions and guidance to strengthen defences and industry best practice standards from agencies like the ACNC and ACSC. By leveraging expert support and resources such as the AICD’s governance guidance and Rodin’s Cyber Security Checklist, NFPs can minimise risks, protect trust, and avoid costly breaches, enabling them to focus on their mission confidently.
Rodin Can Secure Networks For NFPs
With over 30 years of experience, Rodin offers the expertise and tools to build a secure, resilient cyber security framework tailored to the not-for-profit sector. Partnering with Rodin empowers your organisation to mitigate cyber risks effectively. Visit our IT Support Services for Not-for-Profits page to learn how we can protect your data and support your mission.
