IT Services for NonprofitsCybersecurity · Donor Data · M365 for Nonprofits · TechSoup-Aware

A managed services provider runs the day-to-day IT for your organization on a fixed monthly fee. For a nonprofit, that means help desk for staff, security operations, network and Wi-Fi management, Microsoft 365 for Nonprofits or Google Workspace for Nonprofits administration, backup, donor data protection, and one number to call when anything technical breaks. We handle the work, the board gets predictable IT spend, and program staff stay focused on the mission.

Three big differences. Budgets are tighter and tied to fiscal year and grant cycles, not calendar quarters. The compliance load mixes PCI DSS 4.0.1 for donations, HIPAA where PHI is involved, state donor data privacy laws, and grant-funder cybersecurity attestations. And the licensing landscape is unique: TechSoup, Microsoft 365 for Nonprofits at $3.60 per user per month, and Google Workspace for Nonprofits free for eligible orgs. An MSP that ignores those realities ends up reselling the wrong package.

Microsoft 365 for Nonprofits is discounted licensing for verified 501(c)(3) organizations. Business Standard runs $3.60 per user per month. Business Premium and the Office 365 E1 plan are no longer fully donated as of May 14, 2025, but remain discounted around 75 percent off commercial pricing. Eligibility is verified through partners like TechSoup. Once eligibility is confirmed, we handle the tenant build, identity baseline, and license assignment.

TechSoup is the validated marketplace nonprofits use to access donated and discounted software from Microsoft, Adobe, Symantec, Tableau, Bitdefender, and others. Eligibility is verified per organization based on 501(c)(3) status and mission. Your finance or executive team owns the TechSoup eligibility process. We map which products in your TechSoup-discounted catalog fit which program areas, then handle the deployment and ongoing administration so the licensing actually delivers value.

Yes. Google Workspace for Nonprofits is free up to 2,000 users for eligible 501(c)(3) organizations, with paid upgrades from $5.04 per user per month for Business Standard. We administer Google Workspace for Nonprofits domains the same way we run Microsoft 365 tenants: identity, sharing controls, retention, conditional access, mobile device policy, and security alerting. Many nonprofits run Google for staff and Microsoft for finance and HR; we manage both cleanly.

Donor data lives in three places for most nonprofits: the donor database (Salesforce NPSP, Bonterra, DonorPerfect, Raiser’s Edge), the email and shared drive system, and the payment processor. We harden each layer separately. Identity governance and MFA on the database and tenant. Conditional access on email and shared drives. PCI DSS 4.0.1 alignment on the donation flow. Dark web monitoring on staff credentials. Tested backup and ransomware recovery on top.

If your nonprofit accepts credit card donations online, by phone, or at events, PCI DSS 4.0.1 applies to you. Mandatory since March 31, 2025. Most nonprofits stay within scope by using a tokenized hosted-checkout flow from a payment processor (Stripe, Authorize.Net, Blackbaud Merchant Services), which keeps card data off your network entirely. We review your donation flow, document the boundary, and lock down the supporting environment.

Yes. For human services nonprofits handling protected health information, we provide HIPAA-aware managed IT, encrypted endpoints, Microsoft 365 with a HIPAA Business Associate Agreement, encrypted backup with retention controls, and access governance on every system that touches PHI. We sign a BAA with you, document the administrative, physical, and technical safeguards, and support your annual risk assessment.

A practical baseline that closes 80 percent of the risk: MFA on every account, EDR on every endpoint, email security with anti-phishing, tested backup, cyber-awareness training, and identity governance. Layered MDR on top when budget allows. We size the program to your operating budget rather than to a Fortune 500 SOC. The goal is to make a successful attack expensive enough that threat actors move on.

Yes. Grant funders and cyber-insurance underwriters ask increasingly specific cybersecurity questions: MFA coverage, endpoint protection, backup test results, awareness training rosters, written incident response plan, vendor risk management. We organize the evidence in a folder you can hand to the broker or include in a grant application. When the questionnaire shows up three weeks before renewal, you are not scrambling.

Yes. Co-managed is one of the most common engagement models for nonprofits. Your in-house IT lead keeps strategic ownership and the small daily decisions. We handle the layers a one-person shop cannot cover alone: 24/7 NOC, security operations, escalations, after-hours coverage, project work, and the documentation funders and insurers ask for. We are explicit about who does what so nothing falls between the cracks.

Yes. Cybersecurity, dark web monitoring, Microsoft 365 for Nonprofits, Google Workspace for Nonprofits, backup, and cloud are all delivered remotely to 501(c)(3) organizations across the United States. On-site work (server moves, structured cabling, multi-site network builds, security cameras, donor-event AV) is concentrated in Northern NJ, the NYC metro, Pennsylvania, and South Florida where we have engineers on the ground. If you are outside those regions and need on-site, we will tell you up front.