Cybersecurity for Non-Profit Organizations
Security for Orange County and Los Angeles nonprofits that protects donor data, stops payment fraud, and holds up to funder and insurer questions.
Protect What Your Business Depends On
30+ years protecting OC businesses. Under 4-minute response. Flat-rate pricing.
- 24/7 monitoring & threat response
- Compliance-ready documentation
- Plain-English communication
What are the biggest cybersecurity threats facing non-profit organizations?
The biggest cyber threats to non-profit organizations are ransomware and donor-data theft. Nonprofits store sensitive donor and payment records but often run on limited budgets with rotating staff and volunteers, which makes them attractive, under-defended targets. Attackers typically exploit weak passwords, unpatched systems, and phishing emails aimed at part-time or volunteer staff to lock up files or steal contributor information.
How can a non-profit protect its donor data from being stolen?
A non-profit can protect donor data by encrypting records, requiring multi-factor authentication, and limiting access to only the staff who genuinely need it. Keeping backups offline blunts ransomware, since attackers cannot reach copies they cannot see. Because volunteers and staff rotate often, promptly closing old accounts and training everyone to spot phishing are equally vital defenses against donor-data theft.
What should a non-profit look for in a cybersecurity provider?
A non-profit should look for a cybersecurity provider experienced with limited-budget organizations that bills a predictable flat monthly fee per user rather than by the hour. Prioritize providers who deliver security-awareness training for rotating staff and volunteers, manage backups and patching, and monitor for ransomware continuously, so donor data stays protected without needing a full in-house IT team.
What do nonprofit cybersecurity services need to cover?
Last updated October 1, 2026 · HD Tech, serving Orange County since 1995
Nonprofit cybersecurity services need to cover four things: protecting donor and client personal information, stopping email-based payment fraud, securing online donations under PCI DSS, and meeting the security terms in grants. For most California nonprofits, the law that matters isn't the CCPA but the state's data security and breach statutes. HD Tech delivers this across Orange County and Los Angeles.
Funders are part of the picture. The federal Uniform Guidance at 2 CFR 200.303(e) requires recipients and subrecipients of federal awards to take reasonable cybersecurity and other measures to safeguard information, including protected personally identifiable information. Foundation and government contract applications may ask similar questions, and your answers should be backed by controls that are actually running.
HD Tech's thesis is simple: make it harder on the bad guys. Every package includes managed detection and response, email security, patch management, and security awareness training, overseen by cybersecurity lead Paul Morton, CISSP.
What Does Cybersecurity Cost for Non-Profit Organizations in Orange County?
HD Tech publishes its rates. Security is built into all four flat-rate packages rather than sold as an add-on, so the price below is the whole cost — monitoring, detection and response, and email security included from the entry tier up. Every package is month-to-month.
24/7 monitoring and SOC access, managed detection and response, conditional access management, email security, patch management, security awareness training.
Everything in Lifeline plus unlimited help desk, dark web monitoring, immutable backup, vulnerability scanning.
Watch Tower coverage plus managed on-premise servers, cybersecurity consulting, and server backup and disaster recovery. Help desk not included.
Everything in HQ Essentials plus unlimited help desk, server management, IT roadmap and budgeting, quarterly business reviews.
Rates are per user, per month. Monthly account minimums of $1,000–$2,000 apply, so a very small office pays the minimum rather than the per-seat rate — the price calculator gives your exact monthly cost. Rates last verified .
The HD Tech Difference
We're not just your IT provider — we're your Cyber Lifeguard, always on duty to protect what matters most.
Right-of-Boom Preparedness
Not just prevention — detailed incident playbooks and rapid response for when something gets through. Because in cybersecurity, it's not "if" — it's "when."
24/7 Monitoring & Threat Detection
Round-the-clock SOC designed for Orange County businesses. We detect threats before they become disasters.
Managed IT + Cybersecurity in One
Single flat-rate package combining infrastructure management, help desk, security monitoring, and compliance.
Plain-English Communication
No jargon, no tech-speak. We explain risks and solutions in language your team can understand and act on.
Which privacy and security laws apply to California nonprofits?
Fewer than many vendors claim, but more than most nonprofits assume:
The CCPA generally does not apply. It defines a covered "business" as an entity organized or operated for the profit or financial benefit of its owners. A nonprofit can be pulled in if it controls or is controlled by a covered business and shares its branding.
Civil Code § 1798.81.5 does apply. The definition of "business" in Civil Code § 1798.80 expressly includes organizations whether or not they operate at a profit, and § 1798.81.5 requires reasonable security for Californians' personal information.
Civil Code § 1798.82 requires notice to affected California residents within 30 calendar days of discovering a breach of unencrypted personal information, such as a name with a Social Security number, a card number with its security code, or an email address with its password.
PCI DSS applies whenever you store, process, or transmit cardholder data, including donation pages and event payment terminals.
2 CFR 200.303(e) applies to recipients and subrecipients of federal awards, including federal money passed through the state or county.
HIPAA can apply if your nonprofit provides health care and conducts standard electronic transactions such as insurance billing. Check with counsel if you run clinical programs.
How do attackers actually go after nonprofits?
The most expensive attacks on nonprofits are usually quiet fraud, not headline ransomware:
Business email compromise. The FBI's 2025 IC3 report logged 24,768 BEC complaints with more than $3 billion in reported losses. At a nonprofit it looks like a spoofed email from the executive director asking finance to change a vendor's bank details or rush a payment.
Gift card and urgent-request scams aimed at new staff and volunteers, who are least likely to question a message that appears to come from leadership.
Vendor breaches. When fundraising software provider Blackbaud was breached in early 2020, the FTC found the intrusion went undetected for three months and unencrypted data, including Social Security and bank account numbers, was taken. Your donor data is only as safe as the vendors holding it.
Account takeover of email and cloud storage, often through former staff accounts that were never closed.
Which security controls will satisfy funders, insurers, and your board?
Nobody can honestly promise a nonprofit will never be breached. What you can show is a documented set of controls that are running:
Multi-factor authentication on email, the donor CRM, accounting, banking, and payment platforms.
A written callback rule: any change to bank details or payment instructions is confirmed by phone to a number already on file.
Endpoint detection and response on every device, monitored by a 24/7 SOC.
Immutable, off-site backups with scheduled restore tests.
Security awareness training and phishing simulations for staff and regular volunteers.
A vendor list showing which platforms hold donor data and how each protects it.
A one-page incident response plan naming who calls your insurer, attorney, and IT provider.
HD Tech's cybersecurity consulting can turn these controls into the written answers a funder questionnaire or insurance application asks for.
Frequently Asked Questions
Does the CCPA apply to our nonprofit?+
Usually not. The CCPA's definition of a business covers entities organized or operated for the profit or financial benefit of their owners, so most 501(c)(3) organizations fall outside it. The exception is a nonprofit that controls or is controlled by a covered business and shares common branding with it. California's separate data security and breach notification laws apply either way.
Do we have to notify donors after a data breach?+
If unencrypted personal information of California residents was, or is reasonably believed to have been, acquired, Civil Code § 1798.82 requires notice within 30 calendar days of discovery, using the headings the statute prescribes. If more than 500 residents are affected, a sample notice also goes to the Attorney General. Under that statute, a name and email alone don't trigger notice, but a login or card number can.
Do federal grants require cybersecurity?+
Yes, in general terms. The Uniform Guidance at 2 CFR 200.303(e) requires recipients and subrecipients of federal awards to take reasonable cybersecurity and other measures to safeguard information, including protected personally identifiable information and information the agency or pass-through entity designates as sensitive. Individual awards can add specific terms, so read the security clauses in each agreement.
Does PCI DSS apply to online donations?+
Yes, if your organization stores, processes, or transmits cardholder data. A hosted donation page from a reputable processor keeps most card data off your systems and shrinks your PCI scope, but it doesn't remove your responsibility entirely. Never collect card numbers by email, spreadsheet, or paper pledge forms, and use PCI-listed P2PE terminals at events.
Are free nonprofit software grants enough for security?+
Not by themselves. Microsoft's free nonprofit offer is now Business Basic, which turns on multi-factor authentication through security defaults but doesn't include Intune, Defender for Business, Conditional Access, or Defender for Office 365. Business Premium adds those and is available at a nonprofit discount of up to 75%. Free Google Workspace for Nonprofits still needs to be configured and monitored.
What security does HD Tech include for a nonprofit?+
Every package includes 24/7 monitoring, managed detection and response, email security, patch management, and security awareness training. The Watch Tower and higher tiers add a 24/7 SOC, dark web monitoring, immutable backup, and vulnerability scanning. Pricing starts at $85 per user per month, month-to-month with no long-term contract, and monthly minimums apply.
Ready to Protect Your Orange County Business?
Book a free consultation. We'll walk through your current IT setup, identify gaps, and show you exactly how we can help.
More Orange County Resources
- Nonprofit IT services in Orange County and Los Angeles
- Managed cybersecurity services in Orange County
- Compliance support for security questionnaires
- Cybersecurity guide for small organizations
- Meet Paul Morton, CISSP, cybersecurity lead
This page is part of HD Tech's Orange County cybersecurity practice. Our security programs include 24/7 SOC monitoring, threat detection, and rapid incident response — always paired with immutable backup and disaster recovery so a breach never becomes a business-ending event. For organizations that also need day-to-day infrastructure management, our managed IT services bundle everything — monitoring, patching, help desk, and security — into one flat monthly rate.
HD Tech builds compliance-ready environments for HIPAA, PCI, CMMC, CCPA, and more. Compare tiers on our service packages page or start with a no-obligation IT health check.
We serve Orange County industries including accounting and CPA firms, law firms, construction companies, healthcare providers, manufacturers, professional services firms, and defense contractors. For city-specific coverage, see our Anaheim managed IT, Santa Ana IT services, Orange County IT support, or the Orange County hub page. Decision-makers can also explore our guide to outsourcing IT and cybersecurity essentials for small businesses.