Picture a 35-person social services nonprofit in the Bronx, running two state-funded programs. Its IT is a part-time consultant plus the program director who is "good with computers," and the finance director has a budget meeting in three weeks with a wish list of fourteen items and no way to rank them. If that sounds familiar, the good news is that nonprofit IT support doesn't have to be bought all at once. It has to be bought in the right order.
Key takeaways
- The first dollars should go to protections that cost little: multi-factor sign-in, prompt account shutoff when people leave, and backups you've actually tested.
- Check your Microsoft licensing before buying anything new. The free Business Premium grant for nonprofits has ended, and the replacement doesn't happen on its own. Confirm what each person is licensed for today.
- Decide who your staff call when something breaks. An unclear answer costs program hours every week.
- A short, written "can wait" list protects the budget as much as the purchases do.
Start with a list, not a purchase
Before anyone gets a quote, write down what you already have. It takes an afternoon.
You need four lists:
- People and accounts. Everyone with an email address or a login, including former staff, interns and shared mailboxes like intake@ or info@.
- Devices. Laptops, desktops and phones that touch organizational data, and who owns each one. Personal phones count if they get work email.
- Data. Where case files, participant records, finance and HR documents live, whether that's SharePoint, Google Drive, a program database or a desktop in the back office.
- Subscriptions. Every recurring software charge, who approved it and which program pays for it.
In our hypothetical Bronx nonprofit, the lists would likely turn up a few surprises: accounts for people who left last year, a shared password for the program database, and two tools doing the same job on two different credit cards. The point is to stop paying for what nobody uses and to see where the real exposure is.
First: the protections that cost the least
Most of what keeps a small nonprofit safe is inexpensive. It takes attention, a clear owner and a few hours of setup.
Turn on multi-factor sign-in for everyone
Multi-factor sign-in asks for a second proof of identity, usually a prompt on a phone, after the password. The Cybersecurity and Infrastructure Security Agency says plainly that users who enable it are "significantly less likely to get hacked," because a stolen password alone is no longer enough. Turn it on for every account, starting with the executive director, finance staff and anyone who can approve payments. On Microsoft 365 or Google Workspace, the main cost is the time to walk staff through it.
Close accounts the day someone leaves
People come and go often at many nonprofits, between grant-funded positions, seasonal program staff and volunteers. Every account left open after someone leaves is a door nobody is watching. Agree on one person who gets told about departures, and a same-day checklist: disable the login, forward or convert the mailbox, collect the laptop and change any shared passwords that person knew. This costs nothing but a habit.
Back up what you can't recreate, and test it
Cloud storage is not the same as a backup. If a file is deleted or encrypted in OneDrive or Google Drive, that change syncs everywhere. Identify the data you couldn't rebuild (case notes, billing records for program contracts, the finance system) and make sure a separate copy exists. Then test a restore. A backup nobody has ever restored from is a hope, not a plan.
If you'd rather not own this layer yourself, backup and recovery are part of our managed security service.
Second: fix licensing before you buy anything new
Licensing is where money quietly leaks and security gaps quietly open, often without anyone deciding either.
Here's the change worth knowing about. Microsoft has discontinued its Microsoft 365 Business Premium grant for nonprofits, with licenses expiring at each organization's next renewal on or after July 1, 2025. Microsoft still grants up to 300 free licenses of Business Basic and offers discounts of up to 75% on paid plans, including Business Premium.
That matters because the two plans aren't equivalent. According to Microsoft's nonprofit plan comparison, Business Basic includes business email, cloud storage and the web and mobile versions of the Office apps, while Business Premium adds the desktop apps plus device management and device protection tools. Moving from Premium to Basic is a choice someone has to make and carry out in the admin center, and if nobody did, licenses may have lapsed at renewal. It's worth checking which plan your staff are actually on and which protections came with it.
A few practical checks:
- Confirm what each person is actually licensed for. Not everyone needs the same plan.
- Match the license to the role. Microsoft's own terms say granted licenses are for paid staff and unpaid executive leadership, while discounted licenses can also cover volunteers.
- Remove licenses nobody uses. Microsoft requires at least 85% of assigned grant licenses to be in active use, and falling short can put future grants at risk.
- Compare platforms honestly. Google Workspace for Nonprofits is offered at no cost to eligible organizations. Switching platforms is a real project, though, so weigh the move against the disruption to staff.
None of this is glamorous, but it is often the fastest way to free up money for the next step.
Third: decide who staff call when something breaks
Every hour a caseworker spends fighting a printer or a locked account is an hour taken from the people your programs serve.
This is the part most people picture when they hear "nonprofit IT support," and there are four common models, each suited to a different stage:
- A volunteer or board member. Generous, but usually unavailable at 9 a.m. on a Tuesday and rarely accountable for security.
- One in-house IT person. Great context and loyalty, but one person can't cover vacations, after-hours problems and every specialty.
- Co-managed. Co-managed IT puts an outside team behind your internal person, taking the routine load or the specialist work while they keep direction.
- Fully managed. With managed IT services, an outside team handles day-to-day help and maintenance under one agreement.
The right model depends on your size and how much program work runs on technology. What matters most is that every staff member knows who to call, and someone owns the basics above.
What can wait a year
A written "not yet" list tells your board you considered these items and chose the order on purpose. Good candidates:
- Replacing hardware that still works. Retire devices that can no longer receive security updates. The rest can run another year.
- A new database or CRM. Unless the current one blocks program reporting, clean up the data you have first.
- AI tools for the whole staff. Worth exploring, but only after your accounts and data are in order. Set a simple rule on which tools staff may use with participant information.
Turn the list into a budget line
Boards and funders respond better to a plan than a plea. For each item, write one sentence on the program reason behind it: "Multi-factor sign-in on all accounts, so a stolen password alone is far less likely to expose participant records." Then spread the items across the next two or three budget cycles so costs stay predictable.
Whether a specific expense can be charged to a particular grant or contract is a question for your finance team and funder, not your IT provider. A good partner gives you clear scopes that make that conversation easier. If you'd like help building that phased plan, our IT consulting work includes this kind of roadmap.
Common questions
How much should a nonprofit spend on IT?
We'd be wary of any single percentage, because a 20-person advocacy group and a 200-person service provider have very different needs. Start from the inventory and the funding order above, and price the basics first. The number that results is easier to defend than a benchmark.
Is free software from tech companies enough?
Donated and discounted software helps a great deal, but someone still has to configure it, secure it and support the people using it. The license is the start of the work, not the end.
Do we need an outside IT provider at all?
Not always. A very small organization with simple needs can do well with one capable person and good habits. Outside support makes sense when the basics keep slipping or one person is carrying everything.
Where to go from here
Fund the cheap protections, fix licensing, settle who staff call, and write down what can wait. That order won't make IT exciting, but it will make it predictable, which is what most nonprofit budgets need. If you'd like a second set of eyes on your list, see how we approach IT for New York nonprofits.