Free IT health check for nonprofits: what we look at and how to ask

• Accounts and sign-in: whether multi-factor sign-in is on, who has admin rights, and what happens when someone leaves.
• Email and phishing: how staff report suspicious mail, and whether SPF, DKIM and DMARC are set up for your domain.
• Devices and updates: which PCs still get security updates, and which are ready for Windows 11.
• Data and backups: where important files live, who can see them, and whether a restore has ever been tested.
• Nonprofit programs and licenses: whether you may be missing a Microsoft or Google nonprofit offer, or paying for something a program covers. Microsoft and Google decide who qualifies.
• People and plans: how volunteers get access, who owns IT decisions, and whether there is a one-page plan for a bad day.

It is not a penetration test, a formal audit or a compliance certification, and it does not produce a score. It works from what you tell us. You do not need to give us access to your accounts to ask, and if a closer look would help we will explain what we would need and you decide. Never send passwords by email or through the form.

• How many staff and volunteers use email and files, and which system you use: Microsoft 365, Google Workspace or something else.
• How many PCs you have, roughly how old they are, and which Windows versions they run.
• Your domain name, and who controls the registrar and DNS.
• Where important files and backups live.
• Anything that worries you, and any incident you have had.

• Multi-factor sign-in is on for every account, starting with admins.
• Each person has their own account, and access is removed the day someone leaves.
• There are two emergency access admin accounts, stored safely.
• Older sign-in methods such as basic IMAP, POP and SMTP are blocked. In Microsoft 365, security defaults do this.
• SPF, DKIM and DMARC are set up for your email domain.
• Every PC runs a version of Windows that still gets security updates. Windows 10 support ended on October 14, 2025.
• Important data is backed up, and someone has tested a restore.
• There is a one-page incident plan: who to call, how to reach staff if email is down, and where backups are.

• If you do not use Conditional Access in Microsoft 365, turn on security defaults. Microsoft describes it as a free baseline that requires multi-factor registration for all users and blocks legacy authentication.
• Replace or retire PCs that no longer get security updates, or decide how long you will pay for Extended Security Updates, and write the end date down.
• Look at CISA's no-cost cyber hygiene services to see whether they fit your organization.

TRUE.org Cloud is a 501(c)(3) nonprofit, and the health check is part of its free help for nonprofits. If you choose to buy licenses through TRUE.org, they are provided by TRUE.org's for-profit Microsoft Cloud Solution Provider, not by the nonprofit. You can always buy direct from Microsoft or from another partner instead.