Accounts and sign-in
- Multi-factor sign-in is on for every staff and volunteer account, starting with admins.
- Each person has their own account. No shared logins for email, finance or donor systems.
- Admins use a separate admin account for admin work, not their everyday mailbox.
- There are two emergency access admin accounts, stored safely, so one lost phone cannot lock you out.
- Staff use a password manager and unique passwords.
- When someone leaves, their access is removed the same day.
Sources: CISA Secure Our World; Microsoft Entra security defaults; Microsoft Entra: manage emergency access accounts; Google Workspace: protect your business with 2-Step Verification
Email and phishing
- Older sign-in methods such as basic IMAP, POP and SMTP sign-in are blocked. In Microsoft 365, security defaults do this.
- Staff know how to report a suspicious email, and someone reads those reports.
- SPF, DKIM and DMARC are set up for your email domain.
- Payment or bank detail changes are confirmed by phone with a known number, never by replying to the email.
Sources: CISA Secure Our World; Microsoft Entra security defaults; Microsoft: set up DMARC for Microsoft 365
Devices and updates
- Automatic updates are on for computers, phones and browsers.
- Devices that no longer get security updates are replaced or retired. Windows 10 reached end of support on October 14, 2025.
- Laptops are encrypted, and lost or stolen devices are reported right away.
Sources: CISA Secure Our World; Microsoft: Windows 10 end of support
Data and backups
- Important data is backed up, and someone has tested a restore.
- Donor, client and staff records are shared only with the people who need them.
- Files shared with "anyone with the link" are reviewed and closed when no longer needed.
Source: CISA Secure Our World
Plan for a bad day
- Sign-in and admin activity logs are turned on and kept.
- There is a one-page incident plan: who to call, how to reach staff if email is down, and where backups are.
- You know how to report an incident to CISA.
- You have looked at CISA's no-cost cyber hygiene services to see if they fit your organization.
Common questions
Where do these checks come from?
From CISA's Secure Our World guidance for individuals and organizations, and from Microsoft and Google's admin documentation on security defaults, emergency access accounts and 2-Step Verification. Each section links to the source.
We use Microsoft 365. What is the fastest single step?
Turn on security defaults if you do not use Conditional Access. Microsoft describes it as a free baseline that requires multi-factor sign-in registration for all users and blocks legacy authentication.
Is this a security audit?
No. It is a self-check. It does not replace a penetration test or a formal assessment, and it does not produce a score.