Threat & Risk Assessment for Nonprofits

Nonprofits face a security challenge that doesn't fit standard risk frameworks: the data they hold is often among the most sensitive that exists — donor financial records, beneficiary personal information about people in crisis, and program participation records for vulnerable populations — while resources to protect it lag behind the sensitivity of the task. That gap is not organizational carelessness. It reflects the reality that security investment competes with program delivery in organizations where every dollar is accountable to a mission.

That constraint is well understood by threat actors who target nonprofits specifically because of it. Business email compromise attacks against executive directors and finance staff have resulted in significant fraudulent fund transfers at charitable organizations across Canada. The attacks are simple: a convincing impersonation of a board member or major donor requesting an urgent wire transfer, directed at staff with fewer fraud-verification processes than their commercial counterparts. Being a nonprofit is not a protection — in some cases the urgency framing fits the operational context perfectly.

Donor payment data is a concrete exposure. Organizations accepting donations by credit card are subject to PCI DSS requirements regardless of charitable status. A breach triggers the same notification obligations and potential fines that apply to commercial retailers — and the reputational damage is particularly acute because donor relationships rest on trust that is not easily rebuilt. PIPEDA and provincial equivalents apply to nonprofits collecting personal information in the course of commercial activities; breach notification obligations apply equally.

Privacy Horizon's TRA is designed to be proportionate. We focus asset and threat identification on the categories carrying the greatest risk — donor financial records, beneficiary personal information, and the communication channels most exploited in BEC attacks — and build a vulnerability analysis that produces a risk register and roadmap your organization can actually execute. The goal is a defensible set of controls addressing the risks most likely to cause real harm, in a form your team can maintain.

Our approach for Nonprofits

We begin by identifying the data assets that carry the greatest risk in nonprofit environments: donor payment records and the systems that process them, beneficiary personal information and the case management platforms that hold it, and the email and communication infrastructure most commonly exploited in BEC attacks. Threat analysis focuses on the vectors most active against the sector: social engineering targeting leadership and finance, payment card data theft, and opportunistic access to beneficiary records. Vulnerability analysis covers technical controls, email security configuration, payment system security, and the access management practices governing sensitive beneficiary data. The risk register and remediation roadmap are explicitly scoped to be executable by organizations without dedicated security staff — prioritized by impact, proportionate to resource reality.