Start with the systems that matter most

For many small organizations, the most consequential systems are the least glamorous: email, cloud file storage, online banking, fundraising platforms, volunteer rosters, websites, and shared documents. An attacker who controls a main email account may be able to reset passwords elsewhere. Lost access to shared files can interrupt services even if no information is stolen.

Before buying a tool, make a simple list of your important accounts, the person responsible for each, and what would happen if it became unavailable.

The 12-point checklist

  1. Identify your critical accounts. List your main email, website domain, file storage, financial platforms, and any systems containing information about people you serve.
  2. Assign an accountable owner. Name a person responsible for each critical service and ensure a second trusted person knows how to escalate a problem.
  3. Enable multifactor authentication. Prioritize email, administrator accounts, financial systems, and cloud services. Prefer strong, phishing-resistant methods where available.
  4. Use unique passwords and a reputable password manager. Do not share one login across a committee. Give each person an individual account when the service permits.
  5. Remove access when people leave. Review volunteers, contractors, employees, and former board members. Disable accounts and revoke access that is no longer necessary.
  6. Keep devices and applications updated. Turn on automatic security updates where appropriate. Replace unsupported software and devices as resources permit.
  7. Back up essential information. Keep protected copies of the information needed to continue operations and check that recovery actually works.
  8. Know which information is sensitive. Locate personal, financial, and confidential records. Limit access to people with a genuine need.
  9. Verify unusual requests. Train people to confirm unexpected payment changes, requests for records, or password-reset instructions through a trusted second channel.
  10. Secure administrator privileges. Use a small number of named admin accounts. Avoid day-to-day browsing or email work from highly privileged accounts.
  11. Write a one-page incident plan. Record who to contact, how to isolate affected systems, who decides on external help, and where critical recovery information is stored.
  12. Revisit the checklist regularly. Repeat the review after significant staff changes, new cloud systems, and any suspicious event. Keep written notes of what remains unresolved.

Three actions to complete this week

Priority actions for a small team

  1. Turn on multifactor authentication for the primary email administrator and the organization’s financial accounts.
  2. Make a current list of who can access shared drives and critical services. Remove access no longer required.
  3. Choose one important file set, create or verify a backup, and test that a file can be restored.

These actions do not eliminate risk. They create an initial foundation from which more deliberate cybersecurity work can grow.

What to do if something seems wrong

If an account is compromised or records may have been exposed, do not improvise destructive changes. Document what was observed, notify the designated owner, preserve relevant records where safe, and get qualified help promptly. Follow applicable reporting and privacy obligations. If financial fraud is suspected, contact the relevant financial institution using an independently verified number.

An incident plan should be usable without access to the compromised system. Keep a secure offline or independently accessible copy of emergency contacts and recovery instructions.

How this guidance was prepared

This is a practical educational synthesis based on published baseline guidance from the Canadian Centre for Cyber Security and NIST. The checklist is organized for small, resource-constrained community organizations and should be adapted to the systems and obligations of each organization. The sources below provide more detail and should be consulted for implementation decisions.

Primary references

  1. Canadian Centre for Cyber Security: Top measures to enhance cyber security for small and medium organizations.
  2. Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations.
  3. NIST: Cybersecurity Framework 2.0 Small Business Quick-Start Guide.

Editorial note: This educational guide summarizes published recommendations. It does not constitute a security assessment or an endorsement by the referenced organizations. Last reviewed: October 30, 2026. Recommendations may change over time.

Use and attribution

You may share a link to this guide within your organization. If you adapt its checklist, identify that it was adapted from Blackwood Foundation and retain the links to the primary source materials. This does not grant permission to reproduce third-party source material.