NFP tech experts urge orgs to scale up cybersafety

The leader of Infoxchange’s NFP Digital Futures initiative, which aims to build the community sector’s digital capability, said leaders were hungry for practical advice about rolling out responsible tech, especially artificial intelligence.

Tish Tambakau, NFP Digital Futures’ strategic lead, said Infoxchange’s awareness of the need had been underscored by a series of workshops it had held across the country.

“One message has come through clearly: organisations don't necessarily need more information about technology. They need practical support to understand what good looks like, where to start and how to build confidence with the resources they have.”

Many of the conversations that emerged during those workshops centred on artificial intelligence, which Tambakau said had enormous potential for NFPs wanting to reduce administration, make better use of data, and free up time and resources to spend on communities. She said across the sector, technology was now essential for delivering services, managing information, supporting staff and volunteers, and communicating with stakeholders.

But Tambaku said organisations could not afford to “race towards transformative uses of AI while skipping the digital foundations underneath”.

Cybersecurity was one of those foundations, she said, alongside strong systems, good data and digital skills. And she said Cybersecurity Awareness Month, this month, was a great time to focus on it.

“If we want NFPs of every size to benefit from AI and emerging technology, we need to make sure organisations have the foundations to adopt it safely and confidently,” Tambakau said.

Most NFPs aren’t properly equipped for the challenge

Infoxchange’s most recent Digital Technology in the Not-for-Profit Sector report, published last year, showed an alarming capability gap, with just 23 per cent of NFPs ready with a cybersecurity plan, and just 14 per cent of NFPs with an AI policy or governance framework.

At the same time, Tambakau said, the Australian Signals Directorate was receiving 84,700 cybercrime reports a year, or one every six minutes. 

She said small NFPs suffering a cyber incident were at risk of not only taking a financial hit, but facing serious disruptions to services, losing sensitive information, and damaging their reputation.

What NFPs can do to ramp up cyber safety

One organisation receiving help from Infoxchange is Farm My School. The organisation turns underused school land into regenerative farms and learning spaces. 

Its CEO, James McLennan, faces a challenge that’s common among small NFPs.

“We’re a small organisation, meaning each role needs to wear multiple hats. I specialise in regenerative farming, but as we’ve scaled, I’ve realised that also means specialising in digital infrastructure, technology adoption and cybersecurity management.” 

Using Infoxchange’s “cyber mentoring” program, Farm My School found gaps in its approach and updated its defences, by securing staff devices and creating data backups, among othe measures.

McLennan said mentoring and training helped the organisation to focus on the big risks.

“It gave us a much clearer pathway forward without expecting our team to suddenly become cybersecurity experts,” he said.

Tambakau urged NFPs to “just get started” with better cybersecurity.

“You don’t need to become a cyber expert overnight, and you don’t need to solve everything at once. Work out where you are, tackle the biggest risks first and use the support that’s already available. There are tools, resources and people who can help. No NFP should feel like it has to figure this out alone.”

Tambakau said the Digital Futures project was there to help organisations to access resources, training, trusted advice and investment.

“We want NFPs of every size to have the foundations, skills and confidence to use technology safely and effectively and to make practical support easier to access, reuse and scale.”

She suggested early steps should include checking existing protections and assessing risks. 

For example, staff and volunteers may already be using ChatGPT, Copilot or other AI tools without the organisation realising it, she said, and this could be a risk.

Training to help staff and volunteers to recognise scams, protect information and know what to do when something goes wrong was also crucial, she said. 

Infoxchange’s checklist for better cybersecurity

• Review cybersecurity and information security policies
• Examine Infoxchange’s end user policy template 
• Enable multifactor authentication and use strong, unique passwords
• Keep software, devices and security tools up-to-date
• Maintain reliable backups, and test that they can be restored
• Create an AI asset register to understand which tools are being used and what information they're handling
• Provide accessible cybersecurity and scam awareness training for staff and volunteers
• Assess your biggest risks and prioritise the areas that need attention.
• Visit the Digital Transformation Hub for more cybersecurity help.

← Back to the newsletter

Improve digital access and security with our guidance

Community Directors hosts thousands of pages of free guidance, such as this help with your tech: Damned Good Advice on Cybersafety and Fraud Prevention | 10 questions every board member needs to ask about cybersecurity | Preparing a technology plan for your organisation | Cybersecurity policy | Data retention and destruction policy | More help with tech | More help with artificial intelligence

Find more resources under tools and resources on the Community Directors website.