10 IT basics every small Canadian non-profit should have in place
A practical checklist for organizations without an IT department, from multi-factor sign-in to making sure your .ca domain is not registered to a volunteer who moved to Australia.
You don’t need an IT department to run your technology well. You need a short list of basics that are done properly and checked once in a while. These are the ten we look at first when a new organization calls us.
1. Multi-factor authentication on everything
Most account takeovers start with a stolen or reused password. Turning on multi-factor authentication (a code from an app, or a security key) for email, banking, your donation platform and social media accounts blocks the large majority of these attacks. Start with email: whoever controls your email can reset everything else.
2. A password manager for the team
Sticky notes and a shared spreadsheet called “passwords” are not a strategy. A business password manager lets staff and volunteers share access to accounts without seeing or reusing the passwords, and lets you revoke access in one click when they leave.
3. Your domain is in your organization’s name
This is the most common problem we find. A board member or volunteer registered the domain years ago with their personal email and credit card. When they leave, or the card expires, your website and email go down.
Check who the registrant is, move it into the organization’s name with a role email address (such as it@yourcharity.ca), and turn on auto-renew. For a .ca domain, the registrant must meet CIRA’s Canadian Presence Requirements. Organizations incorporated in Canada, including registered charities and non-profit corporations, generally qualify.
4. Backups you have tested
Microsoft 365 and Google Workspace keep your data available, but that is not the same as a backup. If someone deletes a folder, or ransomware encrypts your files, you need your own copy. Follow the 3-2-1 rule: three copies, on two different types of storage, one of them off-site. Then test a restore at least twice a year.
5. Clean onboarding and offboarding
Write down what a new staff member or volunteer needs (accounts, groups, devices) and what must happen when they leave (disable sign-in, transfer files, change shared passwords). Do it the same way every time. Former volunteers with access to the donor database are a privacy incident waiting to happen.
6. Separate admin accounts
The person who reads email all day should not be signed in as a global administrator. Keep one or two admin accounts used only for administration, protected with the strongest multi-factor authentication you have.
7. Devices that update themselves
Turn on automatic updates for Windows, macOS, phones and browsers. Encrypt laptops (BitLocker on Windows, FileVault on Mac) so a laptop left on a bus is an inconvenience, not a breach. Retire devices that no longer receive security updates.
8. Email that proves it’s really you
Set up SPF, DKIM and DMARC for your domain. These records tell other mail servers which senders are allowed to use your domain. They improve deliverability and make it much harder for scammers to send fake “urgent gift card” emails from your executive director.
9. A little phishing training
A 20-minute session once a year, plus a simple rule (“if a message is urgent and involves money or passwords, call the person to check”), prevents a surprising number of incidents. Make it easy and blame-free to report a suspicious message.
10. A one-page incident plan
Who do you call if you click a bad link, a laptop is stolen, or the website is defaced? Write down the names and phone numbers of your IT help, your insurer, your bank and your privacy lead. Print it, because during an incident you may not be able to get into your email.
How did you score?
If you ticked eight or more, you are ahead of most organizations your size. If not, you are in good company, and every item on this list can be fixed. Send us a message and a real person will walk through it with you, in plain language.