Cyber Security Questions Every NSW Not-for-Profit Board Should Ask
Ten practical cyber questions for NSW not-for-profit boards, including what good answers look like, warning signs, and the evidence CEOs should be able to show.
Written and reviewed by The Technology Office ยท Independent technology advisory
Many board members do not need more cyber jargon. They need a clear view of whether the organisation is exposed, whether management knows it, and whether the current evidence is strong enough.
That is especially true in smaller NSW not-for-profits, where cyber risk often sits across Microsoft 365, staff devices, online forms, case information, outsourced IT providers, and manual reporting processes. If your board wants a practical way to get that view, the NFP Technology Health Check NSW is designed as a fixed-scope entry point.
Boards need clarity, not technical theatre
Good board cyber oversight does not mean directors need to become specialists. It means they ask a set of consistent questions that reveal whether management has control, whether suppliers are being challenged properly, and whether evidence exists beyond reassurance.
Below are ten questions worth asking.
1. What are our most important technology and cyber risks right now?
What good looks like: management can name the top few risks in plain English and explain why they matter.
Red flags: vague answers such as "cyber is always evolving" or a long undifferentiated list with no prioritisation.
Evidence to ask for: a current risk summary, even if it is simple.
2. How are we protecting Microsoft 365 and email?
What good looks like: management can explain MFA, admin controls, external sharing, offboarding, and who checks them.
Red flags: nobody knows who the admins are or whether mail forwarding and sharing have been reviewed.
Evidence to ask for: a short Microsoft 365 control summary or review output.
3. What client or sensitive data do we hold, and where does it sit?
What good looks like: there is at least a basic data map covering systems, shared folders, email, forms, and devices.
Red flags: the organisation assumes sensitive data only sits in one system when in reality it also sits in inboxes, spreadsheets, Teams, SharePoint, and PDFs.
Evidence to ask for: a simple data-location register or handling map.
4. If we had an incident tomorrow, what would happen first?
What good looks like: there is a basic incident process, named responsibilities, and a current contact path to IT providers and leadership.
Red flags: management says the MSP would handle it, but there is no clear internal ownership or escalation plan.
Evidence to ask for: an incident-response summary or decision tree.
5. Are staff using AI tools, and do we have rules for what they can enter?
What good looks like: there is written guidance on acceptable and prohibited AI use, especially for client, HR, and board information.
Red flags: staff are already using AI informally but there is no policy or briefing.
Evidence to ask for: the current AI-use policy or draft guidance.
6. What are we asking our IT provider to own, and what sits with management?
What good looks like: responsibilities are clear across support, cyber controls, reporting, governance, and escalation.
Red flags: the board assumes the provider owns strategy, governance, and risk without that being explicit.
Evidence to ask for: a responsibility matrix or supplier-accountability summary.
7. How do we know user access is removed when people leave?
What good looks like: offboarding is documented and consistently followed for staff, contractors, and volunteers where relevant.
Red flags: access removal depends on informal emails or memory.
Evidence to ask for: the offboarding checklist and a recent example.
8. What evidence do we have that backups, recovery, and resilience are good enough?
What good looks like: management knows what is backed up, what is not, how restore works, and what the realistic recovery expectations are.
Red flags: statements such as "the cloud handles that" without any verification.
Evidence to ask for: a backup and recovery summary.
9. What is on the cyber risk register, and when was it last reviewed?
What good looks like: the register is short, current, and connected to named actions and owners.
Red flags: no cyber-specific risks are documented or the register is stale and generic.
Evidence to ask for: the latest version of the risk register.
10. What are the next three cyber actions management wants the board to support?
What good looks like: there is a realistic short list with ownership, cost, and expected risk reduction.
Red flags: management cannot translate cyber concern into practical priorities.
Evidence to ask for: a 90-day action plan.
What to ask your IT provider directly
Boards and CEOs can also ask providers a few direct questions:
- What do you believe are the biggest unresolved risks in our environment?
- What Microsoft 365 settings or evidence would you show the board today?
- Where do you believe responsibilities sit with us rather than with you?
- What would you want fixed first if you were accountable for board-level reporting?
These questions help separate operational support from real leadership visibility.
How to build a simple cyber risk register
A smaller not-for-profit does not need a complex framework before starting. A usable cyber risk register can begin with five columns:
- risk statement
- why it matters
- current controls
- gaps or weaknesses
- owner and next action
Examples might include weak Microsoft 365 admin control, unclear AI use policy, uncontrolled client-data sharing, poor offboarding, or limited evidence of backup and recovery.
What good board reporting sounds like
The best board reporting on cyber is calm, specific, and evidence-based. It explains:
- where the main risks are
- what is already controlled
- what remains open
- what management recommends doing next
- what support or funding is required
It does not hide behind technical wording or imply that all responsibility sits with a supplier.
Common warning signs in smaller NFPs
These signs often show that the board is not getting the full picture yet:
- cyber updates are infrequent and mostly verbal
- the board only hears about technology risk when something goes wrong
- no one can show a current evidence pack
- Microsoft 365, AI, client data, and supplier risk are discussed separately, if at all
- the organisation confuses ticket-based support with technology leadership
Next step
If your board is starting to ask harder questions and management needs a practical response, book the NFP Technology Health Check NSW. It is designed to turn broad cyber concern into a clear risk view, evidence gaps, and a board-ready action plan.
Mentioned services
These service and regional NSW pages expand on the topics covered in this article.
Need help applying this?
Bring in senior technology leadership without the full-time overhead.
The Technology Office works with Sydney and regional NSW businesses on embedded CIO support, Head of IT leadership, governance, vendor management, cost optimisation, crisis stabilisation, and no-cost technology reviews as a lighter first step.