Cybersecurity for non-profits and small businesses: the priorities that matter

A small association or a five-person business does not need a security operations centre running day and night. It needs to be able to answer much simpler questions: where are the backups, who has access, what must be brought back online first and who do you call when something goes wrong?

Cybersecurity becomes manageable when it is reduced to these concrete decisions. The aim is not to protect everything in the same way, but to prevent an ordinary incident from stopping the organisation for several weeks.

Start with what absolutely has to keep running

Take stock of a normal day. How do you receive requests? Where are the files? How do you pay suppliers? Who can publish on the website? Which data would be impossible to rebuild?

Then rank the services:

• essential within the first few hours;
• needed within two days;
• able to wait a week.

This list guides backups, permissions and the recovery plan. Without it, organisations sometimes spend a lot protecting a secondary tool and discover too late that nobody knows how to restore the accounts.

Backups: the one measure that repairs several failures

A backup helps after a breakdown, an accidental deletion, a theft or ransomware. It therefore deserves first place.

The `3-2-1` rule is a good benchmark:

• three copies of the data, including the original;
• two types of media or environments;
• one copy off site.

Add one essential safeguard: at least one copy must be offline or impossible to modify with everyday accounts. A backup that is permanently connected with the same permissions can be encrypted at the same time as the data.

A restore test matters more than the "backup successful" message. Twice a year, pick a folder, restore it to a separate location and check that it opens. Once a year, test an important service in full.

Note how long it actually takes. That tells you whether the recovery promise matches the needs of the organisation.

Named accounts, even in a team of three

A shared account seems practical: everyone knows the password and work carries on. Yet it creates three problems. Nobody knows who performed an action, the password gets passed around, and when someone leaves the secret has to be changed everywhere.

Each member must have their own account. Administrator rights are reserved for the tasks that require them. The account used every day to read email should not be able to modify the entire infrastructure.

Enable a second factor first and foremost on:

• email;
• banking;
• domain and hosting;
• accounting;
• shared storage;
• the organisation's social media accounts.

For the most sensitive accounts, a passkey or physical security key offers better protection against phishing.

Plan for arrivals, changes and departures

Access builds up over the years: a former volunteer, a contractor, an intern, a test account. Nobody removes them because nobody has a complete list.

A simple procedure fits in a spreadsheet:

• person;
• service;
• level of access;
• manager who authorised it;
• date of last review.

On arrival, access is granted according to the role. When a role changes, it is adjusted. On departure, a checklist removes the accounts, recovers the equipment, transfers the documents and changes any secrets that were genuinely shared.

Review this spreadsheet every six months. It is hardly spectacular and extremely effective.

Not all updates are equal

Enable automatic updates for computers, phones, browsers and everyday applications. For the website, router, NAS or business software, appoint a person and set a schedule.

Keep a short inventory:

• product name;
• version or model;
• person or provider responsible;
• end-of-support date;
• last verified update.

A device that no longer receives patches is not simply "old". It represents an accepted risk. That decision must be known, budgeted and limited in time.

Critical patches for internet-facing services should not wait for the next monthly meeting. Agree a timeframe with your provider and a way for them to alert you.

Protect email and payments with a procedure

Small organisations are frequently targeted by fake invoices and CEO fraud. Technology alone does not know your usual relationship with a supplier.

Write down two rules:

1. any change of bank details is confirmed by phone with a contact you already know;
2. any unusual or urgent payment gets a second approval.

The rule applies even when the email comes from the right address: the supplier's mailbox may have been compromised.

Also give people the right to slow down. A colleague should not be afraid of bothering management by checking a request.

Awareness training that does not humiliate

Sending a phishing presentation once a year does little to change behaviour. Use short scenarios tied to real work: a change of supplier account, an urgent request on WhatsApp, a fake document share.

Above all, explain what to do after a mistake. The reporting channel must be known and the no-blame policy explicit. Someone who raises the alarm within ten minutes gives the team a chance to revoke the account or block the payment.

After an exercise, do not publish the list of people who clicked. Look for why the scenario was believable and what the procedure should have prevented.

The crisis plan must fit on one page

Keep a printed or offline copy containing:

• the people in charge and their deputies;
• the contact details of your IT provider, bank and insurer;
• where the backups are;
• the three services to restore first;
• the first actions: isolate, preserve, call, communicate;
• the person authorised to decide on a shutdown.

The plan must not contain passwords. It should state where emergency access details are kept.

Test it with a thirty-minute scenario: "email and shared files are unavailable on Monday at 8 a.m." You will quickly discover missing phone numbers and invisible dependencies.

Website and cloud services

Hosting "in the cloud" does not mean everything is backed up according to your needs. Check who makes the backups, for how long, how to request a restore and whether previous versions are protected against deletion by a compromised administrator.

For the website, keep separately:

• the files;
• the database;
• DNS and domain settings;
• the necessary certificates and secrets;
• a list of versions and dependencies;
• a tested restore procedure.

Your provider must be able to export your data. If the only way to get your activity back is to remain a customer, you do not really own your continuity plan.

Personal data and obligations

When a breach involves personal data, the GDPR may require notification to the Data Protection Authority within 72 hours if the incident poses a risk to individuals. If the risk is high, the people concerned may also have to be informed.

Do not decide alone in the heat of the moment. Have the contact details of your data protection officer, legal adviser or competent provider ready. Keep a timeline of facts and decisions.

Organisations covered by NIS2 have additional security and notification obligations. Check your situation before an incident, especially if you operate in an essential sector or supply an organisation that is covered.

A realistic thirty-day programme

### Week 1

List the essential services and the people who have administrator access. Enable the second factor on email and hosting.

### Week 2

Check the backups and restore a folder. Create an offline or immutable copy.

### Week 3

Update internet-facing equipment, remove old accounts and confirm your provider's contact details.

### Week 4

Print the crisis page and run a thirty-minute exercise. Turn the problems you find into three actions, each with an owner and a date.

This programme does not solve everything. It does, however, reduce the most common causes of prolonged downtime, without any spectacular purchase.

Official resources

• Safeonweb@work — advice for organisations
• Centre for Cybersecurity Belgium
• Data Protection Authority
• European Commission — NIS2 directive