We're small and donor-funded. Is this level of security really necessary?

It depends on the data you hold. If that includes sensitive client information, from homelessness, domestic violence, disability or health services, then yes. The obligations do not scale down with your headcount. If you hold only donor and financial records, the risk is different but still real. Business email compromise losses in the charity sector are not small, and donor trust is the asset the whole organisation runs on. We scope to the actual risk, not a template.

Our board wants to keep IT spend low. How do we argue for proper investment?

Boards respond to specifics. "We spend this much on IT" moves nobody. Name the missing control, the account it protects, and what happens when that account is taken over. We will come to a board meeting when you ask and put the risk in terms trustees recognise. We will also tell you what not to buy, which is usually the more useful half.

We run a mix of volunteers and paid staff. Can both access our systems?

Yes, as long as the two kinds of account are set up differently. Volunteer accounts should be time-limited, scoped to the role, and covered by multi-factor authentication. When someone stops volunteering, access ends that day, not six months later. Most of the account problems we find in NFPs trace back to one that outlived the volunteer.

What about donor data in our CRM (Salesforce NPSP, Raiser's Edge, DonorTec)?

Your customer relationship management (CRM) platform is connected to Microsoft 365 sign-in wherever it supports single sign-on (SSO). Access then follows the person rather than a separate password list. It also goes into the vendor register, so access reviews and offboarding actually happen. We don't rebuild your CRM. We secure the environment around it.

IT and cybersecurity for Australian not-for-profits.

Donors trust you with their data. Beneficiaries trust you with theirs. The board is watching every dollar, and grant funders are writing security conditions into the deed. Your budget is tighter than a private company's; the data you hold is not less sensitive. We scope to the risk in front of you, not to a template price.

What compliance asks of you See if we're a fit

What's actually different

What a data breach costs a charity.

Your donors and beneficiaries hand over information because they trust you with it, and that trust is the asset funders care about most. A breach does not stay an IT problem for long. It becomes a mass-donor notification letter, a board meeting, and a funder who stops returning calls. So the case for security spend here is different from the private-sector one. Less about the insurance premium, more about who still gives next year.

Most not-for-profit (NFP) environments we assess share the same problems. Software that is under-licensed. Dozens of dormant volunteer accounts. A backup arrangement set up years ago and never tested since. The donor database has usually grown to hold far more sensitive information than anyone in the office realises. None of that is hard to fix. The work is in sequencing it against a budget that is already committed.

Money comes up early with charities, and we would rather have it out before you spend time on us. If your budget does not reach our minimums, we will say so and point you at providers who fit. You keep the baseline documentation either way. Better you succeed with another provider than run underserved with us.

Live right now

The 2026 pressure points we're actively working on with clients.

The specific asks, deadlines and enforcement actions shaping 2026 conversations in your sector.

ACNC compliance focus now names cyber security

The Australian Charities and Not-for-profits Commission (ACNC) names cyber security and terrorism-financing misuse in its current compliance focus. Its Governance Toolkit on cyber security has stopped being optional reading. Treat it as the baseline your board is expected to meet, and if nobody can produce a written IT policy, start there.

Grant funders are writing security into the deed

Paul Ramsay, Minderoo, several state health departments and federal grant programs now put security conditions in the funding agreement. Multi-factor authentication (MFA), tested backups and a documented incident response plan are the usual three. Have the evidence ready before contracting, so a funded program does not stall while you go looking for it.

Privacy Act Tranche 2 has not passed yet

Tranche 1 reforms are live. Tranche 2 would remove the small-business exemption and bring roughly 100,000 organisations into full coverage of the Australian Privacy Principles (APPs). Many charities under $3M turnover are in that group. No bill has passed and no start date is set. If you hold sensitive client or beneficiary data, work as though the rules already apply rather than wait for a date that keeps moving.

External Conduct Standards cover your offshore software

If you operate internationally, the ACNC's External Conduct Standards require documented controls over funds, personnel and data sent offshore. Cloud and software-as-a-service (SaaS) platforms hosted or supported overseas are in scope. The register doesn't build itself.

Frameworks and regulators

Industry frameworks, regulations and audit standards for not-for-profit in Australia.

ACNC Governance Standards: Your obligations as a registered charity cover financial record-keeping, internal controls and responsible persons. IT is not named directly. What is expected is evidence of sensible governance, and your systems are part of it.
Privacy Act 1988 and the APPs: Hold personal information about donors, clients, beneficiaries or volunteers and the Australian Privacy Principles apply to you. The $3M-turnover threshold that exempts small businesses does not exempt a not-for-profit holding health, credit or tax-file-number information.
Grant and funding conditions: Grant agreements from state and federal programs increasingly include information-security clauses. Expect rules on how data is handled, how quickly a breach is reported, and sometimes a right to audit you. Terms vary by funder, and you inherit whatever is in the deed you sign.
Fundraising regulation, state by state: Each state has its own fundraising act and register. Most require records of donation transactions and donor details. In practice that becomes a question about how long your systems keep the data and who can see it.
ACSC Essential Eight: The Australian Cyber Security Centre (ACSC) Essential Eight now turns up in funding and partnership agreements from large philanthropic funders, corporate partners and insurers. See the Essential Eight maturity model and what each level asks for.

Where firms usually start

Compliance and IT starting points for not-for-profit in Australia.

Common questions

The things not-for-profit clients ask us first.

We're small and donor-funded. Is this level of security really necessary?: It depends on the data you hold. If that includes sensitive client information, from homelessness, domestic violence, disability or health services, then yes. The obligations do not scale down with your headcount. If you hold only donor and financial records, the risk is different but still real. Business email compromise losses in the charity sector are not small, and donor trust is the asset the whole organisation runs on. We scope to the actual risk, not a template.

Our board wants to keep IT spend low. How do we argue for proper investment?: Boards respond to specifics. "We spend this much on IT" moves nobody. Name the missing control, the account it protects, and what happens when that account is taken over. We will come to a board meeting when you ask and put the risk in terms trustees recognise. We will also tell you what not to buy, which is usually the more useful half.

We run a mix of volunteers and paid staff. Can both access our systems?: Yes, as long as the two kinds of account are set up differently. Volunteer accounts should be time-limited, scoped to the role, and covered by multi-factor authentication. When someone stops volunteering, access ends that day, not six months later. Most of the account problems we find in NFPs trace back to one that outlived the volunteer.

What about donor data in our CRM (Salesforce NPSP, Raiser's Edge, DonorTec)?: Your customer relationship management (CRM) platform is connected to Microsoft 365 sign-in wherever it supports single sign-on (SSO). Access then follows the person rather than a separate password list. It also goes into the vendor register, so access reviews and offboarding actually happen. We don't rebuild your CRM. We secure the environment around it.

The qualifier

Let's see if we're a fit.

Seven questions, one moment of your time. We'd rather tell you now than three months in.