vCISO · Nonprofit
Virtual CISO for Charities & Foundations
A vCISO gives your charity a named, senior security lead without an executive salary the disbursement quota could never justify. Engagements typically begin when a cyber-insurance renewal demands MFA everywhere, when the board treasurer asks who is accountable for security, or when a Blackbaud-style vendor notice exposes how much rides on one CRM. Your vCISO assesses the environment your MSP and volunteers actually run, sets a roadmap the board can approve, and answers insurers and funders in their language.
Reviewed by the Privacy Horizon team · Last reviewed
What you're protecting
What a security leader must control in a charity's environment
Charity infrastructure is a patchwork of donated licences, vendor platforms and borrowed hardware. A vCISO starts by mapping controls onto that reality instead of a corporate template.
The M365 or Google nonprofit tenant
Donated tenants accumulate volunteer accounts, shared mailboxes and stale guest access for years. A vCISO sets conditional access, MFA enforcement and licence-tier decisions so forty volunteers cannot become forty unlocked doors.
The donation pipeline end to end
Money and data flow from web form to payment processor to CRM to receipting to accounting. Security leadership means knowing every hop in that chain, which vendor owns each one, and where a single credential could divert both funds and donor records.
Devices nobody procured
Volunteer-owned laptops, shared front-desk PCs, event tap terminals and thrift-store point-of-sale units all touch constituent or payment data. The roadmap has to govern them without a corporate device budget.
Backups and the payroll file
Ransomware recovery for a charity means restoring the CRM, the accounting system and payroll fast enough that receipting and program delivery continue. Tested restores are a leadership deliverable, not an MSP checkbox.
Access held by departed volunteers and board members
Turnover in unpaid roles rarely triggers an offboarding ticket. A vCISO institutes joiner-leaver routines that treat directors and volunteers with the same rigour as staff.
Regulatory map
The obligations a charity vCISO answers to
Few statutes name a security officer for charities, but insurers, funders and Quebec law increasingly expect one, and the gaps show up at renewal and audit time.
Cyber Centre baseline controls
The Canadian Centre for Cyber Security's baseline for small and medium organizations is the reference insurers and funders lean on: MFA, patching, backups, incident readiness and awareness training. A vCISO turns that list into a sequenced plan.
Law 25 security accountability
For organizations caught by Quebec's enterprise test, safeguards, incident logging and pre-transfer assessments need a technical owner working alongside the person in charge of personal information.
Safeguard duties where PIPA applies
BC-based charities carry statutory protection obligations across all their activities, and federally incorporated charities in Alberta carry them too. Your vCISO ties each control to the duty it satisfies.
Contribution-agreement security clauses
Funders write confidentiality and safeguard obligations into grant contracts, and the specific wording varies by agreement. A vCISO reads the clause in hand and maps existing controls to it before the funder asks.
PCI expectations from your acquirer
Card acceptance at galas, thrift stores and online forms brings contractual PCI DSS obligations through your processor agreements, which most charities discover only when a questionnaire arrives.
What goes wrong
Attacks a fractional CISO prepares a charity for
Charities are targeted for the same reasons small businesses are, with the added twist that donor trust is the asset that cannot be restored from backup.
Compromise of a fundraising platform
When Blackbaud's stolen backups exposed Canadian donor and wealth data in 2020, affected charities needed someone to assess exposure, direct vendors and brief boards. A vCISO is that person before the notice arrives.
Phishing into the finance mailbox
Alberta OIPC decisions involving a Calgary agency and an Edmonton society show how one credential or one attachment reaches donor and family records. Layered mail controls and MFA are the countermeasures a vCISO prioritizes first.
Payment redirection on gifts and grants
Attackers impersonate executive directors, grantees or suppliers to change banking details during busy campaign periods. Verification callbacks and dual approval on banking changes are inexpensive controls a security lead makes mandatory.
Ransomware timed for giving season
An outage in late November hits a charity harder than any other month. The roadmap sequences hardening and restore testing before the change freeze, not during it.
Our vciso for charities & foundations
What the vCISO engagement covers for your charity
The service adapts the four core vCISO functions to an organization whose workforce includes volunteers and whose systems are mostly rented.
Risk assessment across donor and program systems
A structured review of the CRM, receipting, email, endpoints and vendor connections that shows the board where the real exposures sit and what to fix first.
A roadmap the board can fund
Prioritized, costed steps sequenced around fiscal year-end and campaign calendars, written so a treasurer can defend the spend to fellow directors.
Insurer and funder questionnaire support
Accurate, evidence-backed answers at renewal and during grant due diligence, replacing the guesswork that leads to declined coverage or awkward funder calls.
Program execution with your MSP
Direction and quality control over the provider that operates your tenant, so improvements like MFA rollout and backup testing actually land.
Ongoing oversight and board reporting
A standing security agenda item with plain-language metrics, keeping governance engaged between incidents instead of only after them.
How the engagement runs
How fractional security leadership starts at a charity
The engagement respects your calendar: nothing disruptive lands between November and February, and quick wins come before structural work.
Step 1
Discovery with the people who really run IT
Interviews with the finance director, CRM administrator, MSP and key volunteers, plus a review of tenant settings, vendor list and insurance application.
Step 2
Baseline assessment and gap report
Current state measured against the Cyber Centre baseline and your specific obligations, delivered as a short board-ready document rather than a technical dump.
Step 3
Roadmap approval and early fixes
MFA enforcement, backup verification and access cleanup start immediately while the board approves the longer plan.
Step 4
Quarterly leadership rhythm
Recurring vCISO sessions steer the MSP, track progress, handle insurer and funder requests, and adjust for new systems or campaigns.
What it costs
What drives vCISO pricing for a charity
Fees scale with the size and messiness of the estate: how many systems hold constituent data, how many locations and thrift or program sites run their own devices, how much volunteer access exists, and whether an insurer or funder deadline compresses the timeline. A foundation with one office and three staff needs far fewer leadership hours than a multi-site service charity with seasonal volunteers.
Most charities engage a set number of hours per month, expanding briefly around renewals, migrations or incidents. Tell us your systems, sites and deadlines and we will quote a monthly arrangement your budget cycle can absorb.
Charities & Foundations: vCISO questions, answered
A fractional CISO gives the board a named individual who owns security strategy, reports on it in plain language, and directs your MSP's work. For a charity, that means an assessment of donor and program systems, a prioritized roadmap, insurer and funder answers, and quarterly oversight, all at a fraction of the hours a full-time executive would bill. Accountability stops being diffused across a volunteer, a vendor and a busy finance director.
That is one of the most common starting points. The vCISO becomes the named lead, verifies which controls genuinely exist, closes the gaps the questionnaire probes, and drafts accurate answers with supporting evidence. Where a control cannot be finished before the deadline, insurers generally respond better to a dated remediation plan signed by a security professional than to an optimistic checkbox.
Formally, your organization does; practically, a vCISO defines the standard and your MSP applies it. Key moves include enforcing MFA on every account including volunteers, separating volunteer roles from staff roles, expiring guest access on a schedule, restricting mail forwarding, and reviewing sign-in logs. Donated licences often include security features nobody has switched on, so improvement frequently costs configuration time rather than money.
An MSP operates infrastructure; it does not set strategy, weigh donor-trust risk, brief a board or sign off insurer answers. A vCISO decides what good looks like for your charity, gives the MSP clear direction, and independently verifies the work. The two roles complement each other, and separating direction from execution is itself a control your auditors and insurers recognize.
Less than most boards fear. After an initial assessment phase, many organizations settle into a modest monthly cadence covering oversight, MSP direction and board reporting, with short bursts around insurance renewal, a CRM migration or an incident. The right level depends on system count, sites and volunteer volume, which is why we scope it during discovery instead of selling a fixed package.
More for charities & foundations
Other services for this niche
About this service
What's Protecting Your Business from the Next Threat?
Don't wait for a breach to expose your vulnerabilities. Let Privacy Horizon secure your data, ensure compliance, and build lasting trust.