Cyber Incident Response for NFPs

Many smaller not-for-profits do not need a complex incident-response manual to begin with. They do need a practical plan for what happens in the first few hours if an account is compromised, a device is lost, files are encrypted, suspicious sharing is discovered, or a supplier reports a breach.

That is why incident readiness is part of the NFP Technology Health Check NSW. An organisation is in a much stronger position when it can answer basic response questions before an incident occurs.

Why incident response matters

During an incident, stress rises quickly. People want to act fast, but without clear roles the response can become chaotic. Important evidence may be lost, suppliers may receive mixed instructions, leadership may be updated too late, and the board may hear about the event before management has a clear view.

A practical incident response approach should reduce noise and create clarity.

First questions to answer now

• Who is the internal decision-maker during a cyber incident?
• Who contacts the MSP or key provider?
• What systems or accounts are most critical?
• What evidence should be preserved?
• Who needs to be informed internally and externally?
• What would the CEO tell the board in the first update?

If these questions are unclear today, they will be much harder to answer during the event itself.

Common NFP incident scenarios

For smaller not-for-profits, common scenarios include:

• compromised Microsoft 365 accounts
• suspicious inbox forwarding or login activity
• lost or stolen laptops and phones
• accidental oversharing of client information
• ransomware or suspicious file encryption
• vendor notifications of exposure
• staff using the wrong channel for sensitive information

These are practical response issues, not just technical ones.

What should happen first

A strong initial response usually includes:

1. confirm the issue and its likely scope
2. contain immediate exposure where safe to do so
3. preserve useful evidence
4. assign one internal coordinator
5. contact the relevant provider or specialist
6. brief leadership using plain language

The aim is not to solve everything in the first hour. It is to avoid making the situation worse while creating a controlled response path.

Evidence preservation matters

In a stressful moment, people sometimes delete, reset, or overwrite information too quickly. That can make investigation harder later. A simple principle helps: contain first where necessary, but preserve logs, emails, screenshots, timelines, and provider updates wherever possible.

Roles smaller not-for-profits should define

Even a lean organisation should know who fills these roles:

• incident coordinator
• executive decision-maker
• provider contact
• communications owner
• board liaison

One person may fill more than one role. What matters is that the responsibility is clear.

What boards should expect to hear

Boards do not need technical theatre during an incident. They usually need:

• what happened or is suspected
• what is being contained
• what is still unknown
• what support has been engaged
• what the next update timing will be

This is one reason incident response links closely with board cyber governance.

Supplier accountability during incidents

If the organisation relies on an MSP or provider, leadership should still know:

• who is making the internal calls
• what the provider is responsible for
• how updates are escalated
• what evidence the provider can give you

A provider response is helpful, but it does not replace internal leadership ownership.

A practical incident checklist

Smaller not-for-profits can start with a short checklist covering:

• critical contacts
• top systems and accounts
• containment actions that may be needed
• evidence to preserve
• leadership and board update path
• external communications approval path
• post-incident review owner

What good looks like

You do not need a perfect incident-response program before you can improve. Good often looks like:

• named roles
• contact details ready
• a short response checklist
• clearer Microsoft 365 evidence and access visibility
• leadership confidence in the escalation path

Next step

If your organisation would struggle to coordinate calmly during a cyber event, book the NFP Technology Health Check NSW. The review can identify response gaps, supplier-accountability issues, and the practical incident steps leadership should have ready before pressure arrives.