10 Questions Every Non-Profit Organization Need To Have Their IT Provider Answer

A plain-language check for non profit leaders who want to stop guessing and start knowing.

Are you confident your practice would survive a cyber incident tomorrow? Most non-profits aren't and that's not a failure of effort. It's a gap in visibility. You've trusted your IT vendor, followed their guidance, and done your best to keep data safe. But security compliance isn't about effort, it's about evidence. This short guide gives you ten questions that reveal whether your IT provider has the foundations in place or where the gaps are hiding.

What Is a Security Risk Assessment and Why Do You Need One?

Imagine walking through your organization with a clear map of every place data lives, every way it could be accessed or exposed, and every gap between what you think is protected and what actually is. That's what a formal Security Risk Assessment delivers, and more and more donors, grantor or cyber-insurance companies demand it.

A fractional vCISO or independent security advisor isn't a consultant who hands you a thick binder and disappears. It's someone who knows your environment, gives you clear priorities, and stays alongside your practice to make sure the work actually gets done, without trying to sell you software or replace your IT vendor.

What we do: Independent risk assessement, governance design, vendor oversight, and ongoing security advisory for healthcare practices. What we don't do: Sell tools or insurance, manage your IT systems, or work for your IT provider.

What This Guide Helps You Do

Surface your 3–5 biggest gaps. These are the ones most likely to be a problem or insurance claim dispute.
Ask the right questions of your IT provider. Know what they should be doing and what their answers reveal about whether they actually are.
Avoid the most common security mistakes. Most organizations believe they're compliant. There's a difference between assumption and evidence and it matters when things go sideways.
Prepare for cyber insurance renewal. Know what insurers are actually asking and whether your current controls support your answers.
Take a defensible first step. Walk away knowing your starting point and the one action that matters most.

What "Defensible" Actually Looks Like and Why It Changes Everything

Imagine finishing a donor audit, an insurance renewal, or a grantor inquiry and being able to say: "Yes, we've done the review. Here's our risk register. Here's our remediation roadmap. Here's who owns what." That's not a fantasy for large organization: it's achievable for you. The difference between feeling exposed and feeling prepared isn't a huge IT budget. It's a clear process, an honest assessment, and a steady set of priorities. This guide is where that starts.

Ready to Know Where You Actually Stand?

Download this free guide, work through the ten questions, and you'll have a clearer picture of your security posture in under 30 minutes. If what you find gives you pause — or confirms you're ready for a deeper look — book a free call and we'll review your situation together.