Utah has a strong culture of service. From Cache Valley to the Wasatch Front, nonprofits run youth programs, food pantries, arts organizations, health services, and community centers. Many started small and grew steadily, adding staff, volunteers, and locations along the way.

That growth is exciting. It also tends to outpace technology. The spreadsheet that worked for one program becomes a problem across five. The volunteer who managed the computers can't keep up anymore. Here's what growing Utah nonprofits should consider when deciding whether managed IT services make sense.

Signs Your Nonprofit Has Outgrown Informal IT

• A staff member spends hours each week on technology problems outside their real job.
• Nobody is sure who has access to the donor database or shared drives.
• You've added a second site and connecting it has been difficult.
• A funder or insurer has asked about cybersecurity and you weren't sure how to answer.
• Backups exist, but nobody has tested them.
• Your board has started asking about technology risk.

Consideration 1: Multi-Site Operations

Many Utah nonprofits operate program sites in several communities, such as a main office in Ogden with clubhouses in surrounding towns, or a Logan headquarters with outreach locations across Cache and Box Elder counties. Each site needs reliable internet, secure Wi-Fi, working devices, and consistent security settings.

A managed IT provider can standardize equipment and settings across locations, monitor every site from one place, and send someone when on-site help is needed.

Consideration 2: Youth and Family Data

Organizations that serve children and families often hold sensitive records: guardian contacts, attendance, medical notes, permissions, and sometimes income information for program eligibility. That data deserves strong protection and careful access controls, especially where volunteers are involved.

Organizations serving students may find related guidance on our IT services for education page.

Consideration 3: Making the Most of Nonprofit Licensing

Major technology companies offer donated or discounted licenses to eligible nonprofits. Many organizations either don't use these programs or aren't using the security features already included. A knowledgeable provider can help you take full advantage of what's available before recommending new spending.

Consideration 4: Seasonal Peaks

Utah nonprofits often see big seasonal swings: summer youth programs, back-to-school drives, holiday giving, and year-end campaigns. Technology needs rise during these periods with temporary staff, more volunteers, and heavier online donation traffic. Managed IT helps you prepare before the peak rather than scrambling during it.

Consideration 5: Board Oversight

Boards increasingly view technology and cybersecurity as part of their oversight responsibility. A managed IT partner can provide clear, nontechnical reports that help leadership understand risks and priorities without needing technical expertise.

Consideration 6: Local Support

Remote support solves most problems, but sometimes someone needs to be on site: a network closet that needs attention, a new location to set up, or equipment to replace before a big event. Working with a provider that has a local presence in Northern Utah can make those visits faster and easier to schedule.

What to Expect From Managed IT

• Help desk support for staff and approved volunteers.
• Proactive monitoring and maintenance.
• Cybersecurity protections, including multifactor authentication and endpoint protection.
• Backup and disaster recovery planning.
• Microsoft 365 or Google Workspace management.
• Onboarding and offboarding for staff and volunteers.
• Technology planning and budgeting support.

Thinking About Cost

Costs vary based on the number of staff and devices, locations, systems, and security requirements. Many nonprofits find that predictable monthly support costs less than the hidden costs of lost staff time, emergency repairs, and security incidents. A good provider will help you prioritize based on your budget and mission.

A Northern Utah Partner

Maise Technology is based in Brigham City and supports nonprofits across Northern Utah and beyond. Learn more about our approach on our IT services for nonprofit organizations page and our local presence through our Logan managed IT services page.

If your organization is growing and technology is starting to feel like a burden, Schedule A 15 Minute Discovery Call. We'll listen to your mission and your challenges, and help you think through what makes sense.

Choosing an IT provider is a big decision for a nonprofit. The organization is trusting someone with donor data, client information, staff productivity, and in many cases, the technology that makes programs possible. At the same time, every dollar spent on IT is a dollar not spent directly on the mission.

A clear evaluation process helps nonprofit leaders and boards make a confident decision. This scorecard breaks it down into six areas you can compare side by side.

How to Use This Scorecard

Rate each provider from 1 (weak) to 5 (strong) in each area based on your conversations, proposals, and references. Weight the areas that matter most to your organization. A youth services nonprofit with sensitive client data might weight security more heavily. A small advocacy group with few staff might weight responsiveness and cost predictability.

Area 1: Understanding of Nonprofits

Questions to ask:

• What other nonprofits do you support?
• Are you familiar with nonprofit technology discounts and donated licenses?
• How do you handle volunteers who need limited access?
• Do you understand grant reporting and funder security requirements?

Strong sign: The provider can explain how to use nonprofit licensing programs and works with organizations of similar size.

Area 2: Responsiveness and Support

Questions to ask:

• How do staff request help, and how quickly will you respond?
• What happens with urgent issues after hours or during events?
• Will we work with consistent technicians who know our organization?

Strong sign: Clear, written response commitments. Review our guide on what to look for in a managed IT SLA to compare agreements.

Area 3: Security and Data Protection

Questions to ask:

• How will you protect our donor database and client records?
• Do you include multifactor authentication, endpoint protection, and email security?
• How do you handle staff and volunteer offboarding?
• Do you provide security awareness training?

Strong sign: Specific answers, prioritized by risk, rather than a long list of products.

Area 4: Backup and Recovery

Questions to ask:

• What do you back up, including cloud services like Microsoft 365 or Google Workspace?
• How often do you test restores?
• How quickly could we recover from ransomware?

Strong sign: Tested backups with at least one copy protected from ransomware and realistic recovery timeframes.

Area 5: Planning and Board Communication

Questions to ask:

• Will you help us build a technology budget and replacement plan?
• Can you present to our board or finance committee when needed?
• How often will we review technology priorities together?

Strong sign: The provider speaks in terms of mission, risk, and budget, not just technical features.

Area 6: Cost Transparency

Questions to ask:

• What's included in the agreement, and what costs extra?
• How do costs change if we add staff or locations?
• Are there project fees, onboarding fees, or minimum terms?

Strong sign: A clear explanation of what drives cost, such as number of users, devices, locations, and compliance needs, with no surprises in the fine print.

Sample Scorecard

Adjust the weights to fit your organization. Multiply each score by its weight and compare totals.

Don't Skip References

Ask each finalist for references from nonprofits of similar size. Ask those references how the provider handled a real problem, how they communicate, and whether they'd choose them again.

Involve the Right People

Include the executive director, operations or finance lead, and someone who uses technology daily in the evaluation. A board member with technology experience can be a helpful advisor, but the people who will work with the provider every week should have a strong voice.

A Partner for Your Mission

The right IT provider helps your nonprofit spend less time on technology problems and more time on the people you serve. Maise Technology supports nonprofits with managed IT support built for mission-driven budgets. Learn more on our IT services for nonprofit organizations page.

We'd be glad to be one of the providers you evaluate. Schedule A 15 Minute Discovery Call.

Yes. Every nonprofit that depends on technology to serve people, raise money, or meet reporting requirements needs a disaster recovery plan. It doesn't have to be long or expensive. For most small and mid-sized nonprofits, a few pages that answer "what do we restore, how, and who does it?" will cover the essentials.

Below is a plain-language explanation of what a nonprofit disaster recovery plan includes and a starter checklist you can use this week.

Why Nonprofits Can't Skip This

Nonprofits often assume disaster recovery is for big corporations. In reality, nonprofits may have less room to absorb a disruption. Consider what would happen if you lost:

• Your donor database the week before a year-end giving campaign.
• Program attendance records needed for a grant report.
• Client case notes used to coordinate services.
• Access to email and files after a ransomware attack.

Disasters don't have to be dramatic. A failed hard drive, a deleted folder, or a compromised email account can do serious harm when there's no plan to recover.

Disaster Recovery vs. Business Continuity

These terms are often used together:

• Disaster recovery focuses on restoring technology and data.
• Business continuity focuses on keeping your mission and services going while technology is being restored.

A food pantry might keep serving families with paper sign-in sheets (continuity) while its database is restored from backup (recovery). Both matter.

Two Key Terms, Explained Simply

Recovery time objective (RTO): How long can a system be down before it seriously hurts your work? Your donation platform might need to be back within a day. Your archive of old newsletters could wait a week.

Recovery point objective (RPO): How much recent data could you afford to lose? If you back up nightly, you might lose up to a day's work. If that's too much for your case management system, it needs more frequent backups.

What a Nonprofit Disaster Recovery Plan Includes

1. A list of critical systems such as email, donor database, accounting, case management, and shared files.
2. Recovery priorities showing what gets restored first.
3. Backup details describing what's backed up, how often, and where.
4. Contact information for staff, board leaders, IT support, and key vendors.
5. Roles explaining who makes decisions and who does the work.
6. Manual workarounds for continuing programs without systems.
7. A testing schedule to confirm the plan works.

Starter Checklist

Use this list to get from "no plan" to "basic plan" quickly:

• ☐ List every system your organization depends on.
• ☐ Rank each one as critical, important, or can wait.
• ☐ Confirm each critical system is backed up.
• ☐ Confirm cloud services (like Microsoft 365 or Google Workspace) have a backup plan beyond the provider's own recycle bin.
• ☐ Store at least one backup copy where ransomware can't reach it.
• ☐ Restore one file or record to prove backups work.
• ☐ Write down who to call and who decides.
• ☐ Keep a printed copy of the plan and key contacts offsite.
• ☐ Share the plan with your executive director and board chair.
• ☐ Schedule a review once a year.

Frequently Asked Questions

Our files are in the cloud. Isn't that enough?

Not always. Cloud providers keep their systems running, but they may not protect you from accidental deletion, a compromised account, or ransomware that syncs encrypted files. A separate backup adds an important safety net.

How much does disaster recovery cost?

It depends on how many systems you have, how much data you store, and how fast you need things back. Many nonprofits can meet basic needs with modest investments, especially when they prioritize the most important systems first.

Do funders care about this?

Increasingly, yes. Some grant applications and insurance carriers now ask about data protection and continuity planning.

We serve youth or students. Does that change anything?

Organizations that work with young people often hold sensitive information such as attendance, guardian contacts, and permissions. Recovery planning should prioritize protecting and restoring that data. Our IT services for education page discusses related considerations.

Start Small, Start Now

A one-page plan you can actually follow beats a perfect plan that never gets written. Start with the checklist above, then build from there.

Maise Technology helps mission-driven organizations plan for disruptions through our disaster recovery services. Learn more about our work with nonprofits on our IT services for nonprofit organizations page.

Have a question about getting started? Get In Touch.

Volunteers are the heart of many nonprofits. They run programs, staff events, mentor kids, sort donations, and answer phones. Many of them also need access to technology to do that work.

That's where things get complicated. Volunteers come and go. Some help once a year. Others serve for a decade. Some need to see sensitive information, and most don't. Without a clear approach, volunteer access slowly becomes one of the biggest security gaps in the organization.

Here are the most common mistakes we see, and simple ways to fix each one.

Mistake 1: One Shared Login for Everyone

It's common to see a single account, such as "volunteer@" or "frontdesk," used by a rotating group of people. It's convenient. It's also risky.

Why it's a problem: When everyone shares one password, you can't tell who did what. The password spreads to people who no longer volunteer. And if it's stolen, you can't simply lock out one person.

Better approach: Give regular volunteers their own accounts. Many nonprofit software tools offer low-cost or free volunteer roles. For occasional helpers, consider check-in kiosks or limited-function tools that don't require a full login.

Mistake 2: Giving Volunteers Staff-Level Access

When setting up a new system, it's tempting to give every user the same permissions. That often means volunteers can see donor records, client details, or financial reports they don't need.

Better approach: Follow the principle of least privilege. That simply means each person gets the minimum access needed to do their role. A youth program volunteer might need attendance tracking, but not donation history. An event volunteer might need the guest list, but not the full donor database.

Mistake 3: Never Removing Access

Volunteers rarely send a formal resignation. They just stop coming. Their accounts often stay active for months or years.

Better approach: Create a simple offboarding habit:

• When a volunteer's role ends, disable their accounts that week.
• Change any shared passwords they knew.
• Collect keys, badges, or organization-owned devices.
• Remove them from shared drives and group chats that contain sensitive information.

If you're not sure who still has access, start with a quarterly access review. Pull a list of active accounts and ask program leaders to confirm each one.

Mistake 4: Letting Personal Devices Store Sensitive Data

Volunteers often use their own phones and laptops. That's understandable, but it means sensitive information can end up on devices you don't control.

Better approach: Keep data in organization-managed cloud tools rather than downloaded files. Ask volunteers not to save exports or photos of client information to personal devices. For roles that handle highly sensitive data, consider providing an organization-owned device.

Mistake 5: Skipping Security Basics in Volunteer Training

Volunteer orientation usually covers safety, procedures, and mission. Security rarely makes the list.

Better approach: Add five minutes on:

• How to recognize a phishing email or text.
• Why they shouldn't share their login.
• What information should never leave the organization's systems.
• Who to contact if something seems wrong.

Mistake 6: Treating Long-Time Volunteers as Exceptions

Long-serving volunteers are trusted, and for good reason. But trust isn't a security control. Rules about access and passwords should apply equally to everyone, regardless of tenure. This protects the volunteer too. If something goes wrong, clear access records protect them from suspicion.

Our article on insider threats explains why most internal risks come from honest mistakes rather than bad intentions.

A Simple Volunteer Access Policy

You don't need a lengthy policy. Start with five sentences:

1. Each regular volunteer receives an individual account.
2. Access is limited to what the role requires.
3. Accounts are disabled when a volunteer's service ends.
4. Access is reviewed by program leaders every quarter.
5. Volunteers complete brief security orientation before receiving access.

This approach fits well with zero trust security principles, which verify every user rather than assuming trust.

Protecting Your People and Your Mission

Good access management doesn't make volunteering harder. When done well, it makes onboarding smoother, offboarding cleaner, and sensitive information safer.

Maise Technology helps nonprofits set up practical access controls that work for staff and volunteers alike. Learn more on our IT services for nonprofit organizations page, or Get In Touch with your questions.

Donors give because they trust you. They trust you to use their gift well, and they trust you to protect the name, address, email, and payment details they handed over.

Most nonprofits take that trust seriously. The challenge is doing it on a budget that has to cover programs, staff, rent, and a dozen other priorities. The encouraging part is that the most effective protections for donor data are often low-cost. They depend more on smart choices than on expensive tools.

What Counts as Donor Data?

It's more than a list of names. Donor data usually includes:

• Contact details and mailing addresses.
• Giving history and gift amounts.
• Payment card or bank information for recurring gifts.
• Notes about relationships, interests, and family connections.
• Event registrations and volunteer records.

Some of this is sensitive because of identity theft risk. Some is sensitive because donors simply expect privacy. A major donor's giving history, for example, isn't something they'd want shared beyond your development team.

Where Nonprofits Most Often Leave Gaps

When we review nonprofit systems, the same issues come up again and again. None of them come from carelessness. They come from growing quickly with limited staff.

Exports that never get cleaned up

Someone pulls a donor list into a spreadsheet for a mailing or a gala. The file gets emailed to a volunteer, saved to a laptop, and forgotten. Months later, there are copies everywhere.

Too many people with full access

Donor databases often give every user administrator rights because it was easier during setup. A volunteer who only enters event registrations doesn't need to see every gift amount or export the entire database.

Passwords without a second check

If the donor database login is just a password, one successful phishing email can expose everything. Multifactor authentication adds a second step, such as a code on a phone, that stops most of these attacks.

Payment details stored where they shouldn't be

Card numbers written on paper pledge forms, saved in spreadsheets, or typed into email create real risk. Payment data should go through a reputable payment processor, not live in your own files.

A Prioritized Checklist for Limited Budgets

Rather than trying to do everything, start at the top of this list and work down. The first items deliver the most protection for the least cost.

Do this month

• Turn on multifactor authentication for your donor database, email, and payment platform.
• Review who has access to the donor database, and remove anyone who no longer needs it.
• Confirm card payments are processed through a payment provider, not stored by your organization.

Do this quarter

• Set user roles so people only see the data their job requires.
• Find and delete old donor exports on shared drives, laptops, and email.
• Create a simple rule for how donor lists are shared with volunteers and vendors.

Do this year

• Confirm your donor database is backed up and test restoring it.
• Provide short security awareness training for staff and key volunteers.
• Review the security practices of vendors who handle donor data, such as mailing houses or event platforms.

Not sure where your biggest gaps are? A cybersecurity risk assessment can help you rank priorities based on your actual systems.

Free and Low-Cost Resources Worth Knowing

Many technology vendors offer nonprofit discounts or donated licenses, including business-grade email and productivity tools with built-in security features. Before buying a new security product, check whether a tool you already pay for has a protection you haven't turned on yet. That happens more often than you'd think.

Talking to Your Board About Donor Data

Boards don't need technical detail. They need to understand risk and responsibility. A helpful way to frame it is:

• What donor information do we hold?
• Who can access it?
• What would happen to donor trust if it were exposed?
• What are we doing this year to reduce that risk?

Framing security as donor stewardship, rather than an IT expense, often helps leaders see why it matters.

A Realistic Example

A regional food bank's development coordinator received an email that appeared to come from its donor database provider, asking her to "re-verify" her login. She entered her password. Because the organization had turned on multifactor authentication three months earlier, the attacker couldn't get in without the code sent to her phone. The coordinator reported the email, reset her password, and the issue was closed in under an hour.

That outcome cost almost nothing to achieve. It simply required turning on a feature that was already available.

Protect the Trust You've Earned

Donor data security doesn't require a large budget. It requires clear priorities and steady follow-through. Maise Technology supports mission-driven organizations with practical cybersecurity services sized for real nonprofit budgets. Learn more on our IT services for nonprofit organizations page.

If you'd like help putting this checklist into action, Schedule A 15 Minute Discovery Call and we'll talk through your donor systems and where to start.