Data from Nonprofit Assessments Shows Weakness in Cybersecurity, Technology Planning

Digital maturity makes nonprofit organizations more resilient, adaptable, and effective. What can Tech Impact's data tell us about how prepared nonprofit organizations are to thrive in a digital world?
Gathering data on the state of digital maturity in nonprofits
From 2019 to 2022, Tech Impact gathered data from 355 respondents through an online technology assessment designed specifically for small to medium-sized nonprofit organizations. Of respondents, 59 percent had annual budgets under $1 million and another 26 percent had budgets in the $1-5 million range. The assessment asked 19 questions covering five dimensions of digital maturity: infrastructure and security, program delivery, digital marketing, outreach, and fundraising, data management, and technology governance.
Respondents chose from four descriptive answer choices to questions such as "Which of the following statements best describes your organization's data quality processes?" We assigned numeric values to the responses to make analysis easier, with a 1 representing failure to meet the most basic standards for technology in a nonprofit context, a 2 representing practices that are approaching but still below standards, a 3 representing operating at an acceptable level, and a 4 representing best practice.
Nonprofits struggling in every dimension of technology
When we looked at the distribution of responses, we found that respondents, on average, were below acceptable levels in every dimension.
Governance had the lowest overall scores, suggesting organizations desperately need help with things like their technology plan. But even in Infrastructure and Security, where we saw an average score of 2.9 out of 5, we were not seeing what we would expect in a thriving nonprofit.
Improving cybersecurity through identity management
A closer look at the data on identity management revealed a large gap between the best and worst performing respondents.
Over a third (37 percent) of respondents selected the answer choice "We don't have password policies - for example, we have not defined a minimum requirement for password strength, or multiple staff members share a single user ID for some of our core organizational systems (e.g. email, constituent databases, website)."
This is a gap we can close. Tech Impact educates nonprofit leaders about the need for identity management, then helps set up relatively simple, affordable tools to improve cybersecurity. Encouragingly, 28 percent of respondents were using multi-factor authentication and password vaults, demonstrating that these tools and practices are accessible even to small organizations with few resources.
A need for tech planning, budgeting, staff training, and culture
Perhaps the biggest opportunity for impact is in helping nonprofits establish better practices for technology governance and strategy. This can begin with something as simple as a technology plan, which most organizations did not have. Over two thirds of respondents (69 percent) either didn't have a plan at all, or only have a plan for upgrades and replacements that is not linked to a strategic plan.
Looking at other aspects of technology governance, we saw 63 percent provide no staff training on technology topics, and roughly half of those also lack any written tech policies or instructions. When asked to describe their technology budgeting practices, more than half (61 percent) of respondents said they either have no technology budget, or they have ad-hoc replacement funds not tied to a schedule or plan.
Culture was a small bright spot, with 50 percent of respondents choosing statements indicating staff excitement about technology, a belief that technology is key to the organization's success, and deliberate roll-out processes. These attitudes suggest that nonprofit leaders are receptive to improving their other practices and achieving a higher level of digital maturity.
Next steps
Nonprofits can improve their level of digital maturity by learning about technology practices, seeking expert help and advice, examining their strengths and weaknesses, and prioritizing areas where they are most deficient or at risk.
Funders can help by providing funding, training, and technical assistance to their grantees and educating themselves about technology trends and practices. Tech Impact partners with funders to strengthen grantees and communities through technology. Contact us to learn more.
Tech Impact's IT services, support, and educational resources help nonprofits improve their stability, effectiveness, and impact on the communities they serve. We are the place nonprofits can call to make sense of anything from large-scale technology projects, to technology maintenance and support. Learn more and take the Online Technology Assessment at techimpact.org.