Charities · NGOs · Membership organisations
Cyber security for not-for-profits and NGOs
We help NFPs protect member and donor data, secure websites and donation platforms, and manage staff and volunteer access, on a realistic budget.
How can a not-for-profit improve its cyber security on a small budget?
Focus on the controls that stop most attacks: turn on multi-factor authentication for email and admin accounts, give every staff member and volunteer their own login, keep the website and plugins updated with tested backups, publish an enforced DMARC record, and have a simple process for removing access when people leave. Then assess against the Essential Eight as resources allow.
// The risks
Why NFPs need to take security seriously
Donor and member data
Names, contact details, donation history and sometimes health or welfare information that people trusted you with.
Volunteers and shared logins
High turnover and shared passwords mean former helpers often still have access.
Ageing websites and plugins
Sites built with a grant years ago and rarely updated are prime targets for automated attacks.
Donation and grant fraud
Spoofed emails asking supporters to donate to the wrong account, or redirecting grant payments.
How we help
- Secure, maintained websites, membership and donation platforms
- Individual logins, MFA and role-based access for staff and volunteers
- Enforced DMARC so supporters only see genuine emails
- Privacy Act and APP 11 guidance
- Simple onboarding and offboarding checklists
- Board-friendly reporting for governance and grant requirements
We know the sector
We have supported not-for-profits for over a decade, including MND NSW, Soroptimist International, Billings.LIFE and the Banjima Native Title Aboriginal Corporation. We understand tight budgets, volunteer teams and the trust your supporters place in you.
See NFP case studies// FAQ
Common questions
We are a small not-for-profit. Does the Privacy Act apply to us?
Many small not-for-profits under the $3 million turnover threshold are not covered, but some are, for example health service providers, and many choose to follow the Australian Privacy Principles anyway because donors and members expect it. We help you work out where you stand.
We rely on volunteers. How do we manage access safely?
Give each person their own login, use MFA, grant only the access each role needs, and have a simple process to remove access when someone leaves. Shared passwords are one of the most common problems we see in NFPs.
Our budget is tight. Where should we start?
Start with the basics that stop most attacks: MFA on email and admin accounts, an updated and backed-up website, an enforced DMARC record, and a short checklist for removing access when people leave. Our self-check and Starter assessment are designed for exactly this.
Can you secure our donation and membership platforms?
Yes. We have built and maintained membership, donation and event platforms for NFPs for many years, and we secure payment flows, member data and admin access as part of that.
// Keep going
Services for your sector
Website Security & Maintenance
Website security and maintenance plans for Perth businesses: hardening, daily monitoring, tested updates and off-server backups for WordPress, Joomla and more.
Cyber Security Consulting
Independent cyber security consulting in Perth: risk assessments, Essential Eight, Privacy Act, incident readiness and board reporting. From $1,500.
Email Security & DMARC
Stop email spoofing and invoice fraud. We set up SPF, DKIM and enforced DMARC, harden Microsoft 365 and fix email deliverability for Perth organisations.
// Next step
Talk to us about your organisation
A confidential, no-obligation conversation about what you hold, who asks about your security and where you think the gaps are.
- Happy to sign an NDA first
- Fixed scope and price before work starts
- Works alongside your IT provider
Written and reviewed by Noah Greenstone, Founder and Principal Consultant. Last reviewed 22 October 2026.
Tell us what is going on
We read every enquiry and reply within one business day. If it is urgent, call 1300 566 652.
Organisations Noah and the team have built, secured and supported
