Running an IT security department in a nonprofit or charitable agency is very different from what’s found in a typical for-profit corporation. I spoke to David Goodman, who has held CIO jobs in a variety of nonprofits and is now the CIO-in-residence for NetHope, a membership organization serving the needs of the CIOs from 43 of the largest international nongovernmental agencies, including World Vision, Save the Children, The Nature Conservancy and Oxfam. To his knowledge, only one has a dedicated CISO.

In his universe, Goodman rarely sees the kinds of regulatory and compliance structures and level of security that are commonplace in the average bank or even a local business.

The Importance of People

Goodman likes to talk about “people security” being the main concern in many of the organizations he works with. “Some of the staff are working in places that are literally dangerous, and they could be in harm’s way or arrested or abducted,” he said. “If certain information gets into the wrong hands, people could die.”

Goodman noted that most nonprofits run very lean and don’t have huge IT budgets. “We are probably decades behind the for-profit sector in our use of technology. Many organizations are just at the beginning of using technology and how it gets baked into their operations. This means that typical tech VPs have had 25 years under their belts at a profit-making company. But in the nonprofit world, a typical VP probably has never seen much in the way of deploying technology and in many cases is just beginning to use it. So the usual scenario is that most nonprofits are trying to figure their technology out, [and] in some cases starting from a clean slate.”

Two Steps Forward, One Step Back

That doesn’t mean that everyone is behind the times. When he worked at the International Rescue Committee, the organization registered some of its refugees with retinal scanners so it could track them and what services had already been provided to each individual. But it employed a third-party vendor for this service and relied heavily on its efforts to maintain overall operational security for this particular application.

Goodman has also seen that the typical nonprofit doesn’t have any global security strategy. They usually don’t even know where their critical data is stored or how it is cared for. “Sometimes we actually use paper files!” he remarked.

Nonprofits Struggle With the Budget

The hard part, as most of us know, is that being secure is quite expensive, both in terms of tools and training. “All of this costs a lot of money, and most nonprofits generally don’t have it to spend or want to spend it on their programming or mission,” Goodman said.

“Even something as common as a simple spreadsheet gets complicated if it is stored on someone’s local hard drive,” he says. “There is no backup, no central mechanism to identify where this file is located or even make a copy to the corporate network. Data is all over the place. Many organizations operate in very distributed environments in very austere places. They are in some small village or someplace where they can’t easily connect up with the corporate network with poor bandwidth. They have to develop their own solutions. While having a cloud-based solution helps, they need the training to use it effectively.”

Speaking of the cloud, the advantages usually cited by for-profit companies don’t usually work for nonprofits. “The problem is that a cloud solution like Box doesn’t replace anything that was used before. It isn’t like we can retire an old server and pay for it out of that savings. Instead, having a cloud solution means spending opex funds, which is a lot harder for nonprofits because they operate so leanly. With nonprofits, it is usually easier to pay for technology out of capex funds. In the end, you have to make tradeoffs, and security doesn’t always get the top of mind.”

Recruiting employees or volunteers who are adept at cybersecurity or IT techniques could be a huge boon for these nonprofits, but they’ll still face big challenges with regard to budgets, data storage and training. Still, these organizations cannot afford to fall even further behind.