Cybersecurity for Nonprofits, Churches, Schools and Special Districts

Who this page is for

The Census Bureau's County Business Patterns for 2023 counted about 177 religious organizations and 351 social-assistance organizations in Santa Barbara County, and about 132 religious organizations in San Luis Obispo County. Add private schools, community foundations, and the special districts that run water, cemeteries, parks and fire services across the Central Coast, and you have a lot of small organizations holding donor records, payroll, student information and public trust.

Most have one paid administrator, a part-time bookkeeper and a rotating cast of volunteers. Security advice written for corporations does not fit. This page tries to fit.

Donation and payroll fraud

The attacks that reach small organizations are rarely sophisticated. They are believable:

• An email that looks like the pastor or executive director asking the office to buy gift cards "for a surprise"
• A message from "an employee" asking to change their direct deposit account before payday
• A vendor email with new bank details right before a large payment
• A fake donation page or text campaign using your name

The defenses are mostly process. Never change payroll or vendor bank details based on email alone; confirm by phone using a number you already have. Require a second person to approve new payees. Tell staff and volunteers plainly that leadership will never ask for gift cards by email or text. The business email compromise guide explains these patterns in more depth.

Volunteers, shared logins and nonprofit accounts

The most common finding in small organizations is one shared password for the office email, the donor database or the church management software, known by everyone who has helped out over the past ten years.

Both Microsoft 365 and Google Workspace offer nonprofit editions to eligible organizations, and both support multi-factor authentication and individual accounts. The goal is simple:

1. Give each person who needs access their own named account.
2. Turn on multi-factor authentication for every account, starting with administrators and finance.
3. Use shared mailboxes or groups for shared inboxes like "office@" instead of a shared password.
4. Remove access the same week a volunteer or staff member steps away.
5. Keep at least two trusted people with administrator access, so the organization is not locked out if one leaves.

Keith Systems reviews your accounts against that list and writes down what to change. The Microsoft 365 security checklist covers many of the same points.

Free help that actually exists

Before paying anyone, look at what is free:

• CISA Cyber Hygiene services: CISA offers free vulnerability scanning of internet-facing systems to state and local governments and to public and private critical infrastructure organizations. Water and wastewater districts are a clear fit. Other organizations should ask CISA whether they qualify. Start at cisa.gov.
• EPA support for water systems: The EPA offers free cybersecurity assessment and technical assistance to drinking water and wastewater systems. Check EPA's water security resources for what is currently available.
• EDC SBDC: free counseling for small businesses and nonprofits in Santa Barbara and Ventura counties, including a free cybersecurity webinar series running October 1, 2026 to April 7, 2027.

One honest limit: the Cal OES State and Local Cybersecurity Grant is for local government entities and tribes. Private nonprofits and churches are not eligible, and Keith Systems found no direct cybersecurity grants for private small organizations through CalOSBA or the SBA. A special district should confirm its own eligibility with Cal OES. More in free cybersecurity help on the Central Coast.

Special districts and water systems

Districts have obligations that churches do not. Purchasing usually follows a board-adopted policy, sometimes with quotes or board approval above set amounts. Keith Systems fits that process: every engagement is scoped in writing with the fee stated before any work begins, so the document can go into your packet as-is. Keith Systems does not sell equipment and does not recommend products, brands or contractors, which keeps purchasing questions simple.

Larger community water systems also have federal risk and resilience assessment duties under America's Water Infrastructure Act. Whatever your size, the network-side questions are similar: is the office network separated from operational control systems; are cameras, door controllers, printers, thermostats and other connected devices kept off the segments that matter; who has remote access, and do they use multi-factor authentication; and what does the internet see when it looks at your address?

Keith Systems reviews firewall rules, segmentation and remote access on your existing network, and can perform an external exposure review with written authorization from the district. Keith Systems does not log into or change control system equipment. Findings come back in writing for your operator and board. See network security and security assessments.

A modest plan for a small organization

You do not need a large budget to make real progress. A reasonable first year:

• Individual accounts and multi-factor authentication for everyone with access to email, finance and donor or student data
• A written rule for payment and payroll changes, confirmed by phone
• Guest Wi-Fi separated from the office network, covered in small business network segmentation
• Backups that are tested by actually restoring a file, with one copy offline
• A one-page incident plan listing who to call, using the incident response plan guide
• A short annual training for staff and regular volunteers

Jacob Keith holds the CISSP, CompTIA CySA+ and CompTIA SecurityX, has about six years of security compliance work on government systems, and reports vulnerabilities through coordinated disclosure on HackerOne (@cratitoes) and through MSRC. To talk it through, book a free security consult or call (805) 800-8163.