A nonprofit rarely has the budget, time, or staff to address every cybersecurity recommendation at once.
That does not mean leadership has to choose between protecting the organization and funding the mission.
A better approach is to prioritize cyber risk using five practical questions:
- What does the evidence show?
- What could happen to the mission if we do nothing?
- How significant is the potential impact?
- What protection already exists?
- What happens if we wait?
The goal is not to buy everything.
The goal is to understand which risks matter most, which can reasonably wait, and which risks leadership is consciously choosing to carry.
For a nonprofit, that is responsible stewardship.
Cybersecurity Is Competing With the Mission for the Same Dollars
Every nonprofit leader understands competing priorities.
A dollar spent in one place cannot be spent somewhere else.
Leadership may be deciding whether available funds should support:
- Programs
- Employees
- Fundraising
- Facilities
- Technology
- Cybersecurity
- Insurance
- Training
- Compliance
- New services
- Community needs
That reality should be acknowledged rather than ignored.
Telling a nonprofit to “fix everything” is not a useful strategy.
Neither is telling leadership that every cybersecurity recommendation is urgent.
Good risk management requires choices.
The important question is:
How can leadership make those choices responsibly?
Start With Evidence, Not Fear
Cybersecurity conversations sometimes begin with frightening headlines.
A major organization was breached.
A nearby business experienced ransomware.
A new threat is making the news.
Those events may be important.
But another organization’s incident does not automatically tell you what your nonprofit should fund next.
Your priorities should begin with your own environment.
Leadership needs evidence about:
- The systems you depend on
- The information you protect
- The vulnerabilities that currently exist
- The safeguards already in place
- The people and vendors with access
- The potential impact if something goes wrong
Fear asks:
“What terrible thing could happen?”
Evidence asks:
“What does our current environment tell us we should pay attention to?”
That second question leads to better decisions.
Not Every Cyber Risk Is Equal
Imagine that a nonprofit receives a cybersecurity assessment with 25 findings.
The natural reaction may be:
“We have 25 problems.”
That is not necessarily the most useful interpretation.
Some findings may involve routine maintenance.
Some may represent meaningful operational risk.
Some may matter because of regulatory obligations.
Some may already have safeguards that reduce the likelihood or impact.
A few may deserve immediate leadership attention.
The job is not simply to count findings.
The job is to understand them.
A list becomes useful when leadership can distinguish between:
- Important and routine
- Urgent and planned
- Known and uncertain
- Affordable now and budgeted later
- Risk reduced and risk accepted
A Five-Question Framework for Prioritizing Cyber Risk
Nonprofit leaders can use a simple framework to evaluate recommendations without becoming cybersecurity experts.
1. What Does the Evidence Show?
Before deciding what to do, make sure the issue is clearly understood.
Ask:
- What was actually observed?
- How was the finding identified?
- Has it been independently verified?
- Is this a confirmed weakness or a possibility that needs more investigation?
- Is the recommendation based on our environment or on a general best practice?
This matters because money should be spent on actual problems whenever possible, not assumptions.
2. What Could Happen to the Mission?
A technical issue becomes more meaningful when leadership understands its potential effect on the organization.
Ask:
- Could programs stop?
- Could employees be unable to work?
- Could fundraising be interrupted?
- Could donor or constituent information be exposed?
- Could a critical vendor become unavailable?
- Could the organization lose access to important records?
- Could leadership be unable to recover operations quickly?
The same technical finding can have very different consequences depending on the organization.
A vulnerability on a rarely used internal system may deserve a different priority from a recovery problem affecting the system used to deliver daily services.
The mission provides context.
3. How Significant Could the Impact Be?
Once the potential consequence is understood, leadership can look at the whole Cyber Liability picture.
Consider the four areas introduced earlier in this Knowledge Center.
Operational
Could this stop or seriously disrupt the organization’s work?
Reputational
Could this damage donor, constituent, employee, partner, or community trust?
Regulatory
Could this affect a requirement the organization is expected to meet or demonstrate?
Legal
Could this create contractual, notification, insurance, employment, privacy, or other legal responsibilities?
A risk that touches several areas may deserve more attention than one with limited consequences.
That does not automatically make it urgent.
It gives leadership better context.
4. What Protection Already Exists?
Risk should not be evaluated as if no safeguards exist.
Imagine that an assessment identifies phishing as a concern.
The organization may already have:
- Email filtering
- Multifactor authentication
- Endpoint protection
- Employee security training
- A reporting process
- Monitoring
Those controls may not eliminate the risk, but they can change the decision.
Leadership should ask:
“What are we already doing to reduce the likelihood or impact?”
That prevents the organization from treating every risk as if it were completely unprotected.
It can also help identify whether improving an existing safeguard is more practical than buying something new.
5. What Happens If We Wait?
This may be the most useful prioritization question.
Not every recommendation has to be completed today.
But leadership should understand the consequence of delay.
Ask:
- Does the risk remain about the same?
- Is it likely to become more serious over time?
- Is a system approaching end of support?
- Does a deadline exist?
- Is there an upcoming insurance renewal?
- Is another project dependent on this work?
- Could waiting increase the eventual cost?
- Is there a practical temporary safeguard?
This turns “not now” into an informed decision.
Educational Example: Three Recommendations, One Budget
Imagine a 40-person nonprofit receives three cybersecurity recommendations.
Recommendation 1
Replace several aging laptops during the next hardware cycle.
Recommendation 2
Test recovery of the organization’s mission-critical backup systems.
Recommendation 3
Improve security awareness training for employees.
Leadership has funding to address only one immediately.
A responsible discussion could look like this.
Aging Laptops
The devices are still supported and functioning, but replacement is approaching.
Possible decision:
Include them in the next planned technology budget.
Backup Recovery
Backups exist, but recent successful recovery testing cannot be confirmed.
If the organization cannot restore its systems, programs could be interrupted for an unknown period.
Possible decision:
Validate recovery sooner because leadership does not yet understand the operational impact.
Security Awareness
Training exists, but participation needs improvement.
Possible decision:
Improve the existing program through scheduling, accountability, and follow-up rather than purchasing an entirely new platform immediately.
Notice what happened.
Leadership did not ignore two of the recommendations.
It made three different decisions based on evidence, impact, existing safeguards, and timing.
Prioritization Is Not the Same as Saying “No”
A recommendation generally has more than two possible outcomes.
Leadership does not have to choose only between:
Approve it
or
Reject it
A more useful set of options is:
Address Now
The risk is significant enough, and the organization has a practical opportunity to reduce it.
Schedule
The recommendation matters, but it fits better into an upcoming budget, project, or technology cycle.
Investigate
Leadership needs more evidence before committing resources.
Monitor
The issue should remain visible, but immediate action is not currently justified.
Accept the Risk
Leadership understands the issue and deliberately decides to carry the risk for now.
This creates room for responsible judgment.
It also respects the reality that nonprofits have limited resources.
What Does It Mean to Accept Cyber Risk?
Risk acceptance can sound uncomfortable.
It should.
Accepting risk does not mean ignoring it.
It means leadership understands:
- What the issue is
- What evidence supports it
- What could happen
- Why the organization is not addressing it now
- Who made the decision
- When the issue should be reviewed again
For example:
A nonprofit may have an older application that should eventually be replaced.
Replacing it this year might cost $30,000 and disrupt a major program.
The existing application is still supported, compensating safeguards are in place, and leadership plans to replace it during the following budget year.
That may be a reasonable risk decision.
The important point is that leadership understands the tradeoff.
A Deferred Risk Should Not Disappear
One of the biggest weaknesses in technology planning is that recommendations can disappear when leadership says:
“Not this year.”
Six months later, no one remembers the conversation.
A year later, the same problem still exists.
A better approach is to keep deferred risks visible.
For each significant deferred recommendation, document:
- The finding
- The potential impact
- The decision
- Who made the decision
- Why it was deferred
- Any temporary safeguards
- When it should be reviewed again
This does not require a complicated governance system.
A simple decision log can be enough.
The important thing is continuity.
Leadership should not have to rediscover the same risk repeatedly.
Do Not Prioritize Only by Technical Severity
Technical severity matters.
But it does not always tell the whole story.
Suppose a technical tool labels two vulnerabilities as “high severity.”
One affects a system used occasionally by a few employees.
The other affects the platform responsible for processing donations during the nonprofit’s largest annual campaign.
Technically, both may be high.
From a mission perspective, they may not be equal.
This is why leadership needs business context.
A useful priority considers at least:
- Technical severity
- Mission impact
- Likelihood
- Existing safeguards
- Regulatory complexity
- Legal implications
- Cost
- Timing
- Consequences of waiting
No single number should replace judgment.
Compliance Can Change Priority
Some cybersecurity work is optional risk reduction.
Other work may be connected to regulatory, contractual, insurance, or funding expectations.
That changes the conversation.
For example, leadership might otherwise choose to defer a security improvement.
If the same control is required by a contract, cyber insurance condition, or applicable regulation, waiting may carry additional consequences.
This does not mean compliance automatically becomes the highest priority in every situation.
It means regulatory complexity should be included in the decision.
Ask:
“Is this simply a recommended improvement, or do we have an obligation connected to it?”
That distinction can significantly affect timing and budget.
Educational Example: When Regulatory Complexity Changes the Decision
Imagine two nonprofits identify the same access-control weakness.
Nonprofit A
The affected system contains routine internal information and has no identified regulatory requirement tied to the specific control.
Nonprofit B
The affected system contains sensitive information governed by contractual or regulatory requirements that leadership is expected to demonstrate.
The technical weakness may look similar.
The organizational risk is not necessarily the same.
Nonprofit B may need to prioritize the issue sooner because regulatory complexity adds another layer of responsibility.
Prioritize the Decision, Not the Product
Another useful discipline is separating the risk decision from the technology purchase.
Suppose leadership learns that recovery capability is inadequate.
The first question should not be:
“Which backup product should we buy?”
The first questions should be:
- What recovery capability do we need?
- Which systems matter most?
- How much downtime can we tolerate?
- How much data loss can we tolerate?
- What is currently possible?
- Where is the gap?
- What options could close it?
Only then should products or services enter the conversation.
This prevents technology purchasing from becoming the strategy.
The decision comes first.
The technology supports the decision.
A Simple Priority Matrix for Nonprofit Leaders
You do not need a complicated scoring system to begin.
One practical method is to place recommendations into four categories.
High Impact, High Urgency
Examples might include:
- A mission-critical system cannot be reliably recovered
- A significant known vulnerability is actively exposed
- An important regulatory deadline is approaching
- Administrative access is clearly inappropriate and easily corrected
These issues usually deserve immediate leadership attention.
High Impact, Lower Urgency
Examples might include:
- A major infrastructure replacement that can be planned
- A governance improvement that requires board involvement
- A system migration needed within the next budget cycle
These belong on the roadmap.
Lower Impact, High Urgency
Some items may be easy to fix and time-sensitive even if their overall impact is modest.
These can become practical quick wins.
Lower Impact, Lower Urgency
These issues should remain visible, but they should not distract leadership from higher priorities.
The purpose is not to create a perfect mathematical score.
It is to help leaders see where attention and resources can create the most value.
When a Low-Cost Improvement Should Move Up the List
Cost matters too.
Sometimes a moderate risk can be reduced quickly with little expense.
For example, leadership may identify:
- Old employee accounts that should be removed
- Unnecessary administrator access
- Missing policy ownership
- Incomplete training participation
- A vendor account that no longer needs access
- A documented process that needs clarification
If an improvement is inexpensive, low-disruption, and meaningfully reduces risk, it may make sense to address it sooner even if it is not the organization’s highest-risk issue.
Prioritization is about using resources intelligently.
That includes money, staff time, and leadership attention.
A Realistic Nonprofit Risk Conversation
Consider an established nonprofit with a mixture of technology modernization, cybersecurity improvements, staff education, governance needs, and ongoing vulnerability findings.
Leadership could easily be presented with a long list.
A more useful discussion would focus on a smaller number of priorities.
For example:
Priority 1:
A recovery capability affecting mission continuity.
Priority 2:
A security control tied to sensitive information or regulatory responsibility.
Priority 3:
An access issue that can be corrected quickly.
Roadmap Item:
A technology replacement that matters but can be funded during the next budget cycle.
Accepted Risk:
A lower-impact issue leadership understands and chooses to defer.
That conversation is much easier to manage than a report containing dozens of disconnected findings.
How Many Cyber Risks Should Leadership Focus on at One Time?
There is no universal number.
But leadership meetings become less useful when they try to discuss every open technical issue.
A practical approach is to focus executive attention on a small number of meaningful priorities.
A good starting point to use is 3 to 5 priority findings as a normal executive discussion range.
That is a useful benchmark.
It does not mean an organization has only five cybersecurity issues.
It means leaders are more likely to make meaningful decisions when the most important issues are clear.
The technical team can still manage the larger list.
Executive attention should stay focused on the issues that require leadership judgment, funding, risk acceptance, or governance.
A Five-Step Budget Conversation
When a cybersecurity recommendation requires funding, nonprofit leaders can use a straightforward process.
Step 1: Define the Risk
What exactly are we trying to reduce?
Step 2: Define the Mission Impact
What could happen if the risk becomes a real event?
Step 3: Understand the Current Protection
What safeguards already reduce the risk?
Step 4: Compare the Options
Could we:
- Fix it now?
- Reduce part of the risk?
- Schedule it?
- Find another approach?
- Gather more evidence?
Accept the risk temporarily?
Step 5: Document the Decision
Record:
- What was decided
- Why
- Who decided
- What risk remains
- When it will be reviewed again
This turns cybersecurity budgeting into a leadership process rather than a technology shopping exercise.
How Should the Board Be Involved?
Boards usually do not need to approve every firewall change, security update, or employee permission.
They do need enough visibility to fulfill their governance responsibilities.
A board-level cyber risk conversation can stay focused on questions such as:
- What are the most significant current Cyber Liability risks?
- How could they affect the mission?
- What is leadership doing about them?
- Which important risks are being deferred?
- Why are they being deferred?
- Has management consciously accepted any meaningful risk?
- Are regulatory, legal, insurance, or contractual requirements influencing priorities?
- Does the organization have a plan for funding larger improvements?
- When will these decisions be reviewed again?
This keeps the board focused on risk and stewardship rather than technical detail.
The Goal Is Not the Lowest Cybersecurity Budget
Nonprofits should be careful with resources.
That does not always mean spending the least possible amount.
The cheapest option may create more cost later.
The most expensive option is not automatically the best either.
Responsible stewardship asks:
“What level of investment is appropriate for the risk we actually carry?”
That number will be different for different organizations.
A small nonprofit with a simple environment may need less.
An organization with sensitive information, complicated systems, demanding recovery requirements, or significant regulatory exposure may need more.
Budget should follow risk.
Risk should follow evidence.
What Should a Nonprofit Leader Take Away From This Chapter?
You do not need unlimited resources to manage Cyber Liability responsibly.
You need a way to make informed choices.
Start with five questions:
- What does the evidence show?
- What could happen to the mission?
- How significant could the impact be?
- What protection already exists?
- What happens if we wait?
Then choose an appropriate response:
- Address now.
- Schedule it.
- Investigate further.
- Monitor it.
- Accept the risk.
The goal is not to eliminate every risk.
The goal is to know which risks you are carrying, why you are carrying them, and when the decision should be reviewed again.
That is responsible Cyber Liability management.
And for a nonprofit, it is also responsible stewardship.
Applying the Education: How MTS Helps Leadership Prioritize Cyber Risk
MTS uses the same basic principle throughout its Cyber Liability process:
Evidence before opinion.
The goal is not to present leadership with a long list of technology products.
The goal is to help leaders understand the risks in front of them and make informed decisions.
Strategic Security Briefings are designed around a small number of priority findings rather than every open technical issue. We review current evidence, progress, remaining Cyber Liability gaps, 3 to 5 priority findings, business impact, recommendations, and risk acceptance for items leadership chooses to defer.
For each meaningful recommendation, MTS helps leadership understand:
- What the evidence shows
- Why the issue matters
- How it could affect Cyber Liability
- How it should be prioritized
- What choices are available
- What happens if leadership waits
- Whether deferred risk should be formally documented
MTS’s role is to educate, interpret, guide, and help organize the decision.
The client remains the decision-maker.
That reflects the larger MTS educational process:
Understand where you stand.
Build an informed plan.
Stay prepared together.
The goal is not to spend more.
It is to spend with greater clarity.
A Practical Next Step
If your organization has already completed a cyber assessment or received a long list of technology recommendations, you do not necessarily need another list.
You may need a better prioritization conversation.
Start by taking the five most significant findings and asking:
What does the evidence show?
What could this do to our mission?
What Cyber Liability does it create?
What protection already exists?
What happens if we wait?
Those questions can turn a technical report into an informed leadership discussion.
Continue Learning
Previous Chapter
Next Chapter
Chapter 6: What Should a Nonprofit Board Ask About Cyber Liability Each Quarter?
Chapter 6 will take the prioritization process into the boardroom.
We will look at the questions board members should ask without expecting them to become cybersecurity experts, including:
- Mission continuity
- Current risk
- Progress since the last review
- Deferred recommendations
- Risk acceptance
- Regulatory and legal considerations
- Leadership accountability
- What the board actually needs to know
