A nonprofit does not need to fix every cybersecurity risk in the first 90 days.
It needs to know where it stands, decide what matters most, address reasonable priorities, and create a process for managing the risks that remain.
A practical 90-day Cyber Liability plan can be divided into three stages:
- Days 1 to 30: Understand where you stand
- Days 31 to 60: Build and begin the plan
- Days 61 to 90: Verify progress and create an ongoing rhythm
The goal is not perfect security at Day 90.
The goal is much more useful:
Leadership should know the organization’s most important risks, what it has decided to do about them, what it has chosen to defer, and when those decisions will be reviewed again.
That is progress a nonprofit can actually manage.
Start With the Right Expectation
Cyber Liability is not a 90-day project.
People change.
Technology changes.
Vendors change.
Threats change.
Programs change.
Regulatory requirements may change.
Your nonprofit may begin using a new cloud platform, hire employees, launch a new program, start using AI, change payment processors, or receive a new insurance requirement.
So why create a 90-day plan?
Because 90 days is long enough to create meaningful progress and short enough to maintain leadership attention.
A good first 90 days can help an organization move from:
- Assumptions to evidence
- A long list of concerns to clear priorities
- Unclear responsibility to ownership
- Recommendations to decisions
- One-time projects to an ongoing management process
That is a much better objective than trying to declare the organization “secure.”
What Should Be True by Day 90?
Before building the plan, define what success should look like.
By the end of 90 days, leadership should ideally be able to answer:
- What are our most important Cyber Liability risks?
- What evidence supports that conclusion?
- Which risks could most seriously affect our mission?
- What protections are already working?
- What have we improved?
- What have we decided to postpone?
- What risk have we consciously accepted?
- Who owns important next steps?
- What should leadership or the board continue watching?
- When will we review this again?
Notice what is not on the list:
“We eliminated all cyber risk.”
That is not a realistic goal.
A mature organization does not eliminate uncertainty.
It manages uncertainty more deliberately.
Days 1 to 30: Understand Where You Stand
The first 30 days should focus primarily on visibility.
Before buying technology or launching major projects, leadership needs a clearer picture of the current environment.
This stage should answer:
- What do we know?
- What are we assuming?
- Where do we need evidence?
Step 1: Assign a Cyber Liability Owner
Someone inside the organization should be responsible for making sure the Cyber Liability conversation continues.
That does not mean this person must personally manage:
- firewalls
- backups
- cybersecurity tools
- vulnerability scanning
- compliance
- insurance
- legal issues
The owner coordinates responsibility.
Depending on the nonprofit, this could be:
- the Executive Director
- CEO
- CFO
- COO
- senior administrator
- board-designated leader
- another executive responsible for organizational risk
Technology professionals can advise.
Cybersecurity professionals can provide evidence.
Legal and insurance professionals can contribute where needed.
The organization still needs someone who owns the leadership conversation.
Without ownership, important risks can easily become everyone's responsibility and therefore no one's responsibility.
Step 2: Identify What the Mission Depends On
Do not begin with a list of security products.
Begin with the mission.
Ask:
“What activities could we not afford to lose for an extended period?”
Examples might include:
- serving constituents
- accepting donations
- running payroll
- communicating with employees
- maintaining program records
- managing volunteers
- processing financial activity
- fulfilling orders
- maintaining donor relationships
- communicating with funders
For each major activity, identify the people, technology, data, and vendors that support it.
This creates a simple dependency map.
You begin to see that:
- Payroll depends on a provider.
- Fundraising depends on donor and payment platforms.
- Programs depend on employees, devices, applications, and information.
- Communication depends on email, phones, internet, and cloud services.
Cyber Liability becomes easier to understand when leadership can connect technology to the mission.
Step 3: Establish an Evidence-Based Baseline
Leadership should then develop an objective picture of the current environment.
This may include reviewing areas such as:
- identity and access
- MFA
- vulnerability exposure
- endpoint protection
- patching
- backup and recovery
- security monitoring
- email security
- security awareness
- policies
- vendor access
- incident response
- data protection
- AI governance
- cyber insurance requirements
The purpose is not to create the longest possible list.
It is to identify meaningful gaps and validate protections that are already working.
This is the difference between:
“We think we're protected.”
and
“Here is the evidence showing where we are protected and where questions remain.”
Step 4: Identify the 3 to 5 Risks That Matter Most
An assessment or review may identify many findings.
Do not bring all of them into the executive conversation at once.
Focus first on 3 to 5 meaningful risks.
These should be issues that may significantly affect:
- mission continuity
- sensitive information
- donor or constituent trust
- regulatory responsibilities
- legal responsibilities
- insurance
- significant financial decisions
- governance
A smaller set creates focus.
Technical teams can still manage the larger list.
Leadership attention should be directed toward the findings that require judgment, funding, risk acceptance, or organizational decisions.
Educational Example: 28 Findings Do Not Mean 28 Emergencies
Imagine a 55-person nonprofit completes an independent assessment.
The assessment identifies 28 findings.
Leadership could interpret that as:
“We have 28 emergencies.”
That would probably create confusion.
Instead, the findings are reviewed in context.
Leadership identifies four priorities:
- Backup recovery for two mission-critical systems has not recently been tested.
- Several administrative accounts have more access than necessary.
- A critical vendor relationship needs clearer access and data ownership documentation.
- Employees are using AI tools, but no organizational guidance exists.
Other findings remain important, but they can be managed through normal technical maintenance or future planning.
The assessment did not make the other 24 findings disappear.
It helped leadership decide where executive attention should begin.
What Should the First 30 Days Produce?
By Day 30, leadership should ideally have:
A Named Owner
Someone is responsible for keeping the Cyber Liability process moving.
A Mission Dependency View
Leadership understands which activities, systems, information, and vendors matter most.
A Baseline
There is evidence showing where important risks and protections exist.
A Short Priority List
The organization has identified approximately 3 to 5 issues that deserve leadership attention.
Some Immediate Actions
Simple improvements may already be underway.
Examples could include:
- removing unnecessary accounts
- enabling MFA where it is missing
- correcting obvious administrative access
- scheduling a recovery test
- removing former vendor access
- giving employees interim AI guidance
These are not automatically the right priorities for every nonprofit.
The evidence should determine what comes first.
Days 31 to 60: Build an Informed Plan
The second 30 days shift from understanding to decision-making.
Leadership now has a better picture of the environment.
The question becomes:
“What are we going to do about what we learned?”
Not every finding requires the same response.
Give Each Priority a Decision
For every significant issue, choose an appropriate path.
Address Now
The risk matters enough, and there is a practical opportunity to reduce it.
Schedule
The improvement belongs in an upcoming budget, project, or technology cycle.
Investigate
Leadership needs more evidence before deciding.
Monitor
The issue should remain visible, but current conditions do not justify immediate action.
Accept the Risk
Leadership understands the potential impact and consciously decides to carry the risk for now.
This prevents recommendations from sitting indefinitely in a report.
A finding should eventually become a decision.
Build a Roadmap the Organization Can Afford
A nonprofit plan should reflect reality.
Cybersecurity competes with:
- programs
- staff
- fundraising
- facilities
- technology replacement
- insurance
- training
- community needs
A roadmap that requires the organization to fund everything immediately is unlikely to remain useful for long.
Instead, divide improvements into practical time horizons.
Now
What should be addressed because the risk is significant, the improvement is relatively easy, or the timing matters?
Next
What belongs in the next several months or budget cycle?
Later
What is strategically important but does not justify immediate action?
The purpose is not to lower the cybersecurity standard.
It is to create a plan leadership can actually execute.
Use the Mission to Determine Priority
When two recommendations compete for funding, ask:
Which one creates the greater mission consequence if we do nothing?
Then consider:
- evidence
- potential impact
- current safeguards
- regulatory complexity
- legal implications
- cost
- effort
- timing
- consequences of waiting
This keeps technology from becoming the strategy.
The mission determines the need.
Technology supports the response.
Educational Example: A Budget Forces a Choice
Imagine the same nonprofit has funding available for one major improvement this quarter.
Leadership is considering:
Option A
Replace several aging but currently supported laptops.
Option B
Improve recovery capability for the system used to deliver a mission-critical program.
Option C
Purchase a new security product recommended during the assessment.
Leadership should not choose based only on which proposal sounds most technical.
It should ask:
- What does the evidence show?
- What is already protected?
- What could interrupt the mission?
- What can wait?
- What happens if we delay?
Leadership may determine that recovery deserves immediate attention, the laptop replacements can be scheduled into the upcoming lifecycle, and more evidence is needed before purchasing the additional security product.
That is not doing less.
It is prioritizing.
Do Not Forget People During Days 31 to 60
Cyber Liability cannot be reduced only by changing technology.
This is also the right period to strengthen employee understanding.
Education might include:
- recognizing suspicious email
- reporting potential incidents quickly
- handling sensitive information
- password and MFA expectations
- vendor access
- AI use
- what employees should do when uncertain
The goal is not to turn employees into cybersecurity professionals.
It is to make the safe decision easier.
A good employee should know:
“If I'm not sure, here is where I go for help.”
This Is Also a Good Time to Review AI Use
By Day 60, leadership should have a basic understanding of:
- which AI tools employees are using
- what they are using them for
- whether sensitive information is involved
- which tools are approved
- which information should be restricted
- who owns AI governance
The organization does not necessarily need a 30-page AI policy.
It does need enough clarity that employees are not left guessing.
Review Your Most Important Vendors
Do not attempt to fully audit every vendor during the first 60 days.
Start with the relationships that matter most.
Choose perhaps five critical providers and ask:
- What do we depend on them for?
- What systems or information can they access?
- How long could we operate without them?
- What responsibility remains with us?
- Do we have current access and ownership information?
- What happens when the relationship ends?
This creates a much clearer view of third-party Cyber Liability.
What Should Be True by Day 60?
Leadership should now have:
Decisions for the Top Risks
The most important findings have an owner and a response.
A Practical Roadmap
Some issues are being addressed now, some scheduled, some investigated, and some accepted.
Employee Guidance
People understand important security expectations.
Greater Vendor Visibility
Leadership has reviewed the most meaningful third-party dependencies.
AI Visibility
The organization has basic rules and ownership for AI use.
Documented Deferred Risk
Important issues that are not being addressed have not disappeared.
That last point is especially important.
A deferred risk should stay visible.
Days 61 to 90: Verify, Document, and Build the Ongoing Rhythm
The third stage is where many cybersecurity projects lose momentum.
A few things get fixed.
Everyone gets busy.
The report goes into a folder.
Six months later, leadership has little idea what happened.
Days 61 to 90 should prevent that.
The goal is to turn the initial work into a repeatable management process.
Verify That Changes Actually Worked
Completing a project is not the same as proving the risk was reduced.
If leadership approved MFA improvements, verify coverage.
If unnecessary accounts were removed, confirm access.
If backup improvements were made, test recovery.
If a vulnerability was remediated, confirm the finding is closed.
If AI guidance was implemented, confirm employees received it.
If a vendor's access was changed, verify the permissions.
This closes the loop.
The process becomes:
- Evidence
- Decision
- Action
- Verification
That final step creates confidence that the improvement accomplished what leadership intended.
Educational Example: Installed Does Not Mean Verified
Imagine leadership approves MFA for all employees after learning that several accounts were not protected.
The technology team completes the project.
The status report says:
“MFA deployment complete.”
That sounds good.
But before leadership considers the risk closed, someone verifies the environment.
The review finds that nearly all users are protected, but two older service accounts were excluded.
Now leadership can determine whether those exceptions are appropriate or require another control.
The project was not a failure.
Verification simply made the result clearer.
Test Recovery Instead of Assuming Recovery
If backup and recovery were identified as important, the first 90 days should ideally include some level of recovery validation for mission-critical systems.
This does not necessarily mean testing every system.
Start with the ones that matter most.
Ask:
- Can we restore it?
- How long does restoration take?
- Is the information usable?
- Does the result match leadership expectations?
- What happens to the mission during recovery?
This turns backup confidence into recovery evidence.
Create a Risk Decision Record
By Day 90, leadership should have a simple record showing important decisions.
For each priority, capture:
- the risk
- the evidence
- the potential impact
- the decision
- the owner
- the status
- what remains
- the next review date
This creates organizational memory.
It also prevents a deferred issue from disappearing simply because the person who originally discussed it is no longer involved.
Prepare a Leadership or Board-Level Review
The 90-day point is a natural time to step back.
Do not bring the board every technical finding.
Summarize the story.
A useful review might answer:
Where Did We Start?
What did the baseline show?
What Did We Prioritize?
What 3 to 5 risks received the greatest attention?
What Did We Improve?
What was completed or reduced?
What Remains?
Which meaningful risks are still open?
What Did We Defer or Accept?
What is leadership knowingly choosing to carry?
What Comes Next?
What should remain on the roadmap?
That gives leadership and the board a much clearer picture than a technical status report.
A 90-Day Cyber Liability Dashboard
A simple dashboard could look like this:
| Area | Day 1 | Day 90 |
|---|---|---|
| Cyber Liability owner | Unclear | Named |
| Baseline evidence | Limited or fragmented | Documented |
| Top risks | Not prioritized | Top 3 to 5 identified |
| Risk decisions | Informal | Documented |
| Recovery readiness | Assumed or unknown | Key systems reviewed or tested |
| Important vendors | Fragmented visibility | Critical relationships identified |
| AI governance | Informal | Basic guidance and ownership |
| Deferred risks | Easy to lose | Documented with review dates |
| Leadership reporting | Technical or inconsistent | Risk and decision focused |
| Next review | Unclear | Scheduled |
The purpose is not to make every row perfect.
The purpose is to show that the organization has created a more intentional way to manage Cyber Liability.
A Real Nonprofit Lesson: Meaningful Improvement Happens in Stages
An established nonprofit improved its technology and Cyber Liability maturity over time.
Documented improvements included:
- eliminating Windows 7
- continuing migration toward Windows 11
- establishing a 3 to 5-year hardware lifecycle
- deploying more advanced endpoint protection
- improving password management
- using recurring vulnerability assessments
- increasing employee security awareness
- reviewing encryption
- reducing unnecessary administrative access
- strengthening governance
- improving resiliency planning
The organization did not arrive at a stronger environment through one large cybersecurity purchase.
Progress happened in stages.
That matters because it gives nonprofit leaders a more realistic model.
The objective is not:
“Fix everything this quarter.”
The objective is:
“Know what matters, improve what you reasonably can, document what remains, and keep moving.”
What This Example Teaches
A structured roadmap can turn cybersecurity from a series of disconnected purchases into an ongoing organizational improvement process.
This documented nonprofit experience shows phased modernization, technology lifecycle planning, security improvements, governance, and continued next steps rather than a one-time finish line.
What Should Not Happen During the First 90 Days?
A good plan is also defined by what it avoids.
Do Not Buy Before Understanding
A product should solve an identified problem.
Do not let the 90-day roadmap become a shopping list.
Do Not Make Every Finding Critical
If everything is urgent, leadership cannot prioritize.
Do Not Hide Good News
If protections are working, document that too.
Cybersecurity review should validate strengths as well as identify weaknesses.
Do Not Expect Employees to Become Experts
Give them clear rules, examples, and somewhere to ask questions.
Do Not Let Deferred Risks Disappear
If leadership decides to wait, document the decision and review date.
Do Not Treat Day 90 as the Finish Line
The most valuable result of the first 90 days is an ongoing process.
Five Questions to Ask at Day 90
Before declaring the first phase complete, leadership should answer five questions.
1. Do We Understand Our Cyber Liability Better Than We Did 90 Days Ago?
If not, more evidence or education may be needed.
2. Did We Address the Risks That Mattered Most?
Not the largest number of findings.
The risks that mattered most.
3. Did We Verify the Improvements?
Do we have evidence that the changes actually worked?
4. Do We Know What We Are Choosing to Carry?
Important deferred and accepted risks should be visible.
5. Is the Next Review Already Scheduled?
If not, the process can easily lose momentum.
That final question may be the most important.
What Happens After Day 90?
Cyber Liability management should settle into a rhythm.
That rhythm may include:
- ongoing technical monitoring
- periodic vulnerability review
- backup and recovery testing
- employee education
- vendor review
- AI governance
- insurance review
- policy updates
- risk decision documentation
- leadership or board reporting
- reassessment
The frequency should reflect the organization's complexity and risk.
A rapidly changing organization may need more frequent review.
A smaller, lower-complexity nonprofit may need less.
What matters is that the review happens often enough to keep decisions current.
The organization should not wait for an incident to rediscover the risks it already knew about.
The Goal Is a Management System, Not a Perfect Score
By Day 90, some risks will still exist.
That is normal.
A mature Cyber Liability program is not defined by having zero findings.
It is defined by knowing:
- what the risks are
- why they matter
- what is being done
- what has been deferred
- who owns the decisions
- when they will be reviewed again
That creates accountability.
It also makes budgeting easier.
Leadership is no longer reacting to whichever cybersecurity issue happens to be loudest.
It has a roadmap.
A Simple 30, 60, 90-Day Cyber Liability Plan
DAYS 1 TO 30: UNDERSTAND
Primary objective: Create visibility
- Name a Cyber Liability owner
- Identify mission-critical activities
- Map key technology and vendor dependencies
- Establish objective baseline evidence
- Identify the top 3 to 5 risks
- Address appropriate quick wins
- Schedule important validation work
Leadership question:
“Where are we really exposed?”
DAYS 31 TO 60: PRIORITIZE AND ACT
Primary objective: Turn evidence into decisions
- Give each significant risk a decision
- Build the Now, Next, Later roadmap
- Begin priority improvements
- Educate employees
- Review important vendors
- Establish basic AI guidance
- Document deferred and accepted risks
Leadership question:
“What should we do first, and what can reasonably wait?”
DAYS 61 TO 90: VERIFY AND PREPARE
Primary objective: Make progress repeatable
- Verify completed improvements
- Test important recovery capabilities
- Update the risk roadmap
- Document decisions
- Prepare leadership or board reporting
- Identify remaining priorities
- Schedule the next review
Leadership question:
“How do we know we improved, and how do we keep moving forward?”
What Should a Nonprofit Leader Take Away From This Chapter?
The first 90 days of reducing Cyber Liability should not be a race to buy technology.
It should create a better way of making decisions.
During the first 30 days:
Understand where you stand.
During the next 30:
Prioritize and begin acting.
During the final 30:
Verify the progress and establish what happens next.
At the end of 90 days, leadership should be able to say:
- We understand our most important risks.
- We know what the evidence shows.
- We have made decisions about what comes first.
- We know what we are postponing and why.
- We have verified key improvements.
- We know who owns the next steps.
- We know when we will review the risks again.
That is not perfect security.
It is something much more achievable and useful:
informed leadership.
Applying the Education: How MTS Helps a Nonprofit Build the Roadmap
MTS uses a simple three-part educational process with clients:
- Understand where you stand.
- Build an informed plan.
- Stay prepared together.
The starting point can include an Independent Cyber Risk Assessment performed by an unaffiliated third-party security company.
The independent company provides objective evidence of vulnerabilities and can evaluate protections already in place, including protections MTS may have implemented.
MTS does not perform or control that independent assessment.
Once the evidence exists, MTS helps leadership:
- understand what the findings mean
- connect technical findings to Cyber Liability
- identify the risks that matter most
- establish priorities
- understand available decisions
- document deferred risk
- create a roadmap
- continue reviewing the environment as conditions change
The roles stay distinct.
- The independent third party provides the evidence.
- MTS educates, interprets, guides, and helps organize the decisions.
- The nonprofit remains the decision-maker.
The objective is not to make the organization dependent on MTS.
It is to help leadership build enough visibility and structure to make responsible decisions about its mission, resources, data, and Cyber Liability.
A Practical Next Step
You do not need to build the entire 90-day plan today.
Start with Day 1.
Ask:
Who owns our Cyber Liability conversation?
Then ask:
What are the three mission activities we could least afford to lose?
Those two questions will begin revealing the people, technology, information, vendors, and risks that deserve your attention.
The path becomes clearer once you know where you are starting.
Continue Learning
Previous Chapter
Chapter 9: What Should Nonprofits Know About AI, Sensitive Data, and Cyber Liability?
Next Chapter
Chapter 11: How Much Should a Nonprofit Budget for Managed IT, Cybersecurity, and Cyber Liability Management?
Once leadership understands its risks and priorities, another practical question follows:
What should this actually cost?
Chapter 11 will explain why nonprofit technology costs can vary widely and how factors such as:
- employee count
- technology complexity
- cybersecurity requirements
- regulatory risk
- evidence-based operational risks
- vendor management
- recovery requirements
- strategic guidance
can affect the budget.
We will also explain why a useful budget discussion should begin with the organization's needs and risk, not simply a per-user price.
