By Allen Norvell, CPA, MBA, Director at Blue & Co.

While certainly not a new risk for not-for-profit (NFP) organizations, cybersecurity risk is increasing in profile as an area of interest among members of governance. NFPs manage a significant volume of customer and donor data. We have previously provided thought leadership to help NFPs identify the cybersecurity risks they face related to that data and the steps NFPs can take to mitigate those risks.

Some of that guidance can be found at the following links:

• On-Demand Webinar: Cybersecurity & Data Management Best Practices for Nonprofit Organizations
• The Importance of Incident Response Plans – Recovery
• The Importance of Incident Response Plans – Containment & Eradication

In addition to the practices identified above, how has governance at your organization embraced the oversight of cybersecurity risks? Has oversight been assigned to a specific committee? Which committee is best equipped to exercise oversight over the organization’s cybersecurity risk management?

The answers to the above questions will vary depending upon the size and complexity of your organization.

In many organizations that have an Audit Committee, it is becoming increasingly common for that committee to take on the oversight responsibility for cybersecurity risk management. Once an appropriate committee is identified, the committee’s charter is likely to need to be amended and expanded to incorporate the additional responsibilities. It is also possible that the mix of skills and experience of the committee members will need to be revised and broadened.

If your organization has not yet formally assigned oversight responsibility for cybersecurity risk management, the above questions are a good starting point for that deliberation.

If your organization is currently deliberating these issues and you have questions how best to implement this oversight function or need assistance with developing related policies and best practices, please feel free to reach out to your Blue & Co., LLC advisor and we will be happy to assist.

Our Cybersecurity and Data Management team, led by Tom Skoog, has the experience and tools necessary to successfully guide your organization through this process.