Safeguarding NFPs & Charities: A Multi-Layered Cyber Strategy

Introduction

Australian Not-for-Profit (NFP) and charity organisations are increasingly prime targets for cybercriminals, facing a significant cybersecurity vulnerability. This exposure is often due to the sensitive data they manage combined with limited budgets for robust defences, making them attractive to hackers. Consequently, a cyber incident can lead to devastating outcomes, including financial loss, operational disruption, and a critical loss of trust from donors and the community they serve.

To counter these evolving threats, a proactive and multi-layered cyber strategy is essential for every Australian NFP. This guide offers a comprehensive framework to safeguard your organisation, integrating crucial legal obligations with practical governance policies and technical defences. By implementing these measures, your charity can build resilience, protect its mission, and maintain the vital trust of its stakeholders.

Understanding the Cybersecurity Vulnerability of Australian NFPs

Why Cybercriminals Target Your NFP Organisation

NFP organisations are targets for cybercriminals due to the sensitive data they handle, including personal details of donors and beneficiaries. This information is highly valuable, yet many NFPs face significant vulnerabilities for several reasons:

• Limited budgets often lead to underinvestment in robust cybersecurity measures
• Lack of dedicated IT expertise, especially in smaller charities
• Insufficient security awareness and training among staff and volunteers
• Inadequate consideration of cybersecurity needs and protocols

These vulnerabilities, which should be tracked in an ACNC risk register, make the NFP sector particularly attractive to criminals looking to access confidential information or disrupt critical community services. Smaller charities, in particular, tend to have weaker defences, creating an environment that cybercriminals are quick to exploit.

Common Cyber Threats Facing Your Charity

The Australian NFP sector faces several prevalent cyber threats that exploit these vulnerabilities. Understanding these common attack methods is the first step toward building an effective cyber strategy to safeguard your organisation.

Key threats include:

Threat	Description
Social Engineering	A manipulation tactic to trick people into revealing confidential information. Methods include phishing (fraudulent emails with malicious links) and pretexting (creating a fabricated scenario to obtain information).
Business Email Compromise (BEC)	A targeted form of phishing where a cybercriminal impersonates an organisation representative, often by hacking an email account or using a similar domain, to trick an employee into transferring funds or disclosing sensitive data.
Ransomware	Malicious software that encrypts files and systems, blocking access until a ransom is paid. Attackers may also threaten to publish or sell the stolen data if their demands are not met.

Your NFP’s Legal Obligations & Governance Responsibilities

Complying with Australian Privacy & Data Protection Laws

NFP organisations in Australia have legal obligations to protect the personal and sensitive information they handle under the Privacy Act 1988 (Cth), and navigating these government regulations can often require specialised advice from administrative lawyers. This legislation defines personal information as any detail or opinion that can identify a person. Sensitive information, a specific category of personal information, includes details about a person’s:

• Health
• Religious beliefs
• Sexual orientation

A key component of these legal obligations is the Notifiable Data Breaches (NDB) scheme, overseen by the Office of the Australian Information Commissioner (OAIC). If your NFP experiences a data breach that is likely to result in serious harm to individuals whose personal information is involved, you must notify both:

• The OAIC
• The affected individuals

This notification ensures transparency and allows people to take steps to protect themselves.

To manage a data breach effectively and comply with the NDB scheme, your charity should follow a clear response plan. The process generally involves four key steps:

Step	Action
Contain	Take immediate action to contain the breach and prevent any further unauthorised access or harm.
Assess	Evaluate the risks associated with the breach to understand its nature and the potential harm it could cause.
Notify	If the breach is deemed notifiable, inform the OAIC and the individuals whose data has been compromised.
Review	Investigate the cause of the incident and update your policies and procedures to prevent similar breaches in the future.

Understanding the Cybersecurity Act 2024

The Cybersecurity Act 2024 (Cth) introduces significant reforms that strengthen Australia’s approach to cybersecurity and directly impact the NFP sector. This legislation establishes new requirements for reporting cyber incidents and enhances the government’s ability to coordinate responses to major attacks.

One of the most critical changes is the mandatory requirement for certain organisations to report ransomware payments. From 30 May 2025, any NFP with an annual turnover exceeding $3 million must report any ransomware payment to the Australian government within 72 hours of the payment being made.

The Act also establishes the Cyber Incident Review Board (CIRB), which have operated since 30 May 2025. The board’s role is to conduct independent, no-fault reviews of significant cyber incidents. By analysing these events, the CIRB aims to identify lessons that can be shared with the government and industry to improve national cyber resilience and prevent future attacks.

Implementing Practical Cybersecurity Defences for Your Organisation

Adopting the Essential Eight Cyber Hygiene Strategies

The Australian Cybersecurity Centre (ACSC) developed the Essential Eight as a baseline framework of mitigation strategies to effectively protect against cyber threats. Adopting these measures is a critical step for Australian NFPs to build a resilient cyber defence and safeguard their operations.

Key strategies from this framework include:

Strategy	Description
Patching Applications and Operating Systems	Regularly update software and systems to fix known security vulnerabilities. Use vulnerability scanning to identify and apply critical patches promptly.
Enforcing Multi-Factor Authentication (MFA)	Add an extra layer of protection by requiring two or more proofs of identity for access, especially for systems with sensitive donor or financial information.
Restricting Administrative Privileges	Minimise potential damage from a compromised account by limiting high-level system access through a least-privilege, role-based model.
Application Control	Reduce the risk of malware execution by preventing unauthorised or unapproved applications from being installed or run on your devices.
Maintaining Regular Backups	Schedule automatic backups of important information, test them regularly, and store them securely in an isolated or off-site location for quick recovery.

Key Technical Controls to Safeguard Your NFP

Beyond foundational frameworks, specific technical controls provide a critical layer of defence against common cyberattacks. Implementing these tools and processes can significantly reduce your organisation’s vulnerability to threats like phishing and malware.

Consider implementing the following technical controls to enhance your NFP’s cybersecurity posture:

Technical Control	Function
Email Filtering and Spam Protection	Blocks malicious emails, such as phishing attempts and messages containing malware, before they reach staff and volunteers.
Antivirus Software	Provides real-time, up-to-date protection against viruses and other malicious software to defend against the latest threats.
Network Firewalls	Acts as a barrier between your internal network and the internet, preventing unauthorised access and blocking suspicious traffic.
Intrusion Detection Systems (IDS)	Monitors network traffic for suspicious activity or policy violations and sends alerts when a potential threat is discovered.

Managing Risks from Third-Party Service Providers

Your organisation’s cyber security is also dependent on the security practices of your third-party partners, such as software providers and charitable fundraising services. A data breach affecting one of your suppliers can directly impact your NFP, exposing sensitive donor information and creating legal liability. For instance, the breach at Pareto Phone affected up to 70 NFPs, highlighting the risks of supply chain vulnerability.

To manage these risks effectively:

Action	Description
Conduct Due Diligence	Thoroughly assess the privacy and security practices of any third-party provider before engagement to ensure they are responsible stewards of your data.
Establish Contractual Agreements	Ensure contracts include clear security requirements and define responsibilities for managing a data breach, including assessment and notification duties.
Include Data Retention Clauses	Add clauses on data retention and destruction to your agreements to ensure your information is handled securely after a contract ends.

Developing an Effective Cyber Incident Response Plan

Key Steps for Responding to a Cybersecurity Incident

A structured response plan is crucial for managing a cyber incident effectively, minimising harm, protecting your charity’s purpose & reputation, and ensuring a swift recovery. Your charity should have a clear plan that everyone can access and understand.

The response process typically involves several key stages to address the breach comprehensively:

Stage	Description
Identify and Contain	Understand what is happening and take immediate steps to contain the breach, preventing further unauthorised access and impact on other systems.
Investigate and Assess	Determine which systems are affected and what risks might arise. This involves assessing what harm has been done and what could go wrong as a result.
Act and Notify	Prioritise actions to protect individuals and the organisation. If the breach falls under the NDB scheme, inform the OAIC and any affected individuals.
Review and Improve	After resolution, review policies, procedures, and systems to identify changes needed to reduce the likelihood and consequences of future incidents.

When & How to Report a Cybercrime

Knowing when and how to report a cybercrime is a critical part of your incident response. Reporting helps protect your organisation from further harm and contributes to a broader understanding of the threats facing the Australian NFP sector.

You can report a cyber incident online to the ACSC.

Depending on the nature of the data breach, you may also be required to notify other regulators and government agencies, including:

Regulator / Agency	Reporting Condition
The OAIC	Required if the incident involves personal information and is likely to result in serious harm, as per the NDB scheme.
The Australian Federal Police	Responsible for combating cybercrime and disrupting cybercriminals.
The Cyber and Infrastructure Security Centre (CISC)	Required if critical infrastructure is affected by the attack.

Conclusion

Australian NFPs face significant cybersecurity vulnerability due to handling sensitive data with limited resources, making a multi-layered cyber strategy essential for their protection. This involves understanding legal obligations, implementing practical defences like the Essential Eight, and preparing a robust incident response plan to safeguard their mission and maintain stakeholder trust.

Learning these complex requirements can be challenging, but proactive steps can secure your organisation’s future. For specialised legal guidance tailored to the unique needs of the not-for-profit sector, contact the expert not-for-profit lawyers at LawBridge today to ensure your charity is fully protected.

Frequently Asked Questions