< Back to Thought Leadership

Strengthening Cybersecurity in Not-for-Profits: Assigning Oversight Responsibilities to Mitigate Risk

By Allen Norvell, CPA, MBA, Director at Blue & Co.

While certainly not a new risk for not-for-profit (NFP) organizations, cybersecurity risk is increasing in profile as an area of interest among members of governance. NFPs manage a significant volume of customer and donor data. We have previously provided thought leadership to help NFPs identify the cybersecurity risks they face related to that data and the steps NFPs can take to mitigate those risks.

Some of that guidance can be found at the following links:

In addition to the practices identified above, how has governance at your organization embraced the oversight of cybersecurity risks? Has oversight been assigned to a specific committee? Which committee is best equipped to exercise oversight over the organization’s cybersecurity risk management?

The answers to the above questions will vary depending upon the size and complexity of your organization.

In many organizations that have an Audit Committee, it is becoming increasingly common for that committee to take on the oversight responsibility for cybersecurity risk management. Once an appropriate committee is identified, the committee’s charter is likely to need to be amended and expanded to incorporate the additional responsibilities. It is also possible that the mix of skills and experience of the committee members will need to be revised and broadened.

If your organization has not yet formally assigned oversight responsibility for cybersecurity risk management, the above questions are a good starting point for that deliberation.

If your organization is currently deliberating these issues and you have questions how best to implement this oversight function or need assistance with developing related policies and best practices, please feel free to reach out to your Blue & Co., LLC advisor and we will be happy to assist.

Our Cybersecurity and Data Management team, led by Tom Skoog, has the experience and tools necessary to successfully guide your organization through this process.

not-for-profit cecl model

Decoding The New CECL Model for Not-For-Profits

By Priya Singleton, CPA, Director at Blue & Co. The Financial Accounting Standards Board (FASB) issued Accounting Standards Update (ASU) 2016-13 Financial Instruments – Credit Losses (Topic 326): Measurement of […]

Learn More

Final Hospital 340B Outpatient Prospective Payment System (“OPPS”) Remedy

On November 2, 2023, the Centers for Medicare & Medicaid Services (CMS) released a final rule outlining a plan to correct and reverse the 340B payment cuts from calendar years […]

Learn More
restricted fund tracking

Restricted Fund Tracking and Cash Management

By Andrew Brock, CPA, Senior Manager at Blue & Co. Earlier in June 2023, an article was published by our not-for-profit services team titled “Unveiling the Dynamics of Donor-Restricted Contributions”. […]

Learn More