< Back to Thought Leadership

Strengthening Cybersecurity in Not-for-Profits: Assigning Oversight Responsibilities to Mitigate Risk

By Allen Norvell, CPA, MBA, Director at Blue & Co.

While certainly not a new risk for not-for-profit (NFP) organizations, cybersecurity risk is increasing in profile as an area of interest among members of governance. NFPs manage a significant volume of customer and donor data. We have previously provided thought leadership to help NFPs identify the cybersecurity risks they face related to that data and the steps NFPs can take to mitigate those risks.

Some of that guidance can be found at the following links:

In addition to the practices identified above, how has governance at your organization embraced the oversight of cybersecurity risks? Has oversight been assigned to a specific committee? Which committee is best equipped to exercise oversight over the organization’s cybersecurity risk management?

The answers to the above questions will vary depending upon the size and complexity of your organization.

In many organizations that have an Audit Committee, it is becoming increasingly common for that committee to take on the oversight responsibility for cybersecurity risk management. Once an appropriate committee is identified, the committee’s charter is likely to need to be amended and expanded to incorporate the additional responsibilities. It is also possible that the mix of skills and experience of the committee members will need to be revised and broadened.

If your organization has not yet formally assigned oversight responsibility for cybersecurity risk management, the above questions are a good starting point for that deliberation.

If your organization is currently deliberating these issues and you have questions how best to implement this oversight function or need assistance with developing related policies and best practices, please feel free to reach out to your Blue & Co., LLC advisor and we will be happy to assist.

Our Cybersecurity and Data Management team, led by Tom Skoog, has the experience and tools necessary to successfully guide your organization through this process.

IRS 501(r) Compliance: Financial Assistance Policy and Amounts Generally Billed Calculation

Non-profit hospital organizations as defined by Section 501(c)(3) must meet requirements imposed by Section 501(r) on a facility-by-facility basis to be treated as a tax-exempt organization. According to the Internal Revenue […]

Learn More

Hospital Price Transparency: What’s New in 2024 and Beyond

The Centers for Medicare & Medicaid Services (CMS) has introduced significant changes to the requirements for hospital price transparency. The aim is to enhance pricing transparency and ensure compliance with […]

Learn More
building and using insurance reserves

Building and Using Insurance Reserves for Sustainability

By Annmarie Novotney, CPA, Director at Blue & Co. Not-for-profit organizations have been dealing with changing circumstances on many fronts over the last five years. Part of this changing landscape […]

Learn More