Cybersecurity for Australian Not-for-Profit Organisations

Why Australian NFPs are a cyber target

Australian NFPs are increasingly targeted by cybercriminals — they hold valuable data (donor payment details, client records, beneficiary information) and typically have fewer IT resources than commercial organisations. The ACSC has reported a significant increase in ransomware incidents targeting the NFP sector, particularly organisations in disability services, mental health, and aged care. NFPs are often perceived as soft targets due to lean IT budgets, reliance on volunteers with personal devices, and older technology environments.

The motivation is straightforward: NFPs hold the same categories of sensitive data as commercial businesses — personally identifiable information, payment data, health records — but with a fraction of the security budget. Ransomware operators know that an NFP with no tested backups is more likely to pay, and that an NFP with no MFA is trivially easy to compromise through a single phishing email sent to a busy fundraiser or volunteer coordinator.

The sector's reliance on volunteers compounds the risk. Volunteers use personal devices, share credentials, and rotate frequently — making traditional perimeter security ineffective. The threat surface is not just the NFP's systems but every volunteer's laptop, phone, and home network.

What donor and client data do NFPs need to protect?

Australian NFPs hold a broader range of sensitive data than most commercial organisations of equivalent size. Understanding what needs protection is the first step in building defences:

• Donor payment records: Credit card data, direct debit details, and bank account information. If your NFP processes donations directly — rather than through a payment provider like Stripe or PayPal — you may fall within scope of PCI DSS. Most NFPs avoid PCI scope by tokenising payments through a processor, but donation receipts and reconciliation spreadsheets still contain enough personal data to be valuable to attackers.
• Client and beneficiary records: Personal information subject to the Australian Privacy Act — including names, addresses, dates of birth, and in many cases health information for disability, aged care, and mental health NFPs. Health information is classified as sensitive data under the Privacy Act, triggering stricter handling obligations. A breach of client records in these sectors is a notifiable data breach under the OAIC scheme.
• Staff and volunteer records: Payroll data, background checks, Working with Children checks, and tax file numbers. These records are valuable to identity thieves and are often stored in SharePoint or shared drives with overly permissive access.
• Grant acquittal documents: Financial records, outcome data, and program reports subject to ACNC reporting obligations. Compromised acquittal data can undermine funder confidence and jeopardise future grant rounds.
• Board papers: Governance documents often containing strategic plans, financial forecasts, and sensitive operational decisions. Board papers leaked to the public or to competitors can cause significant reputational damage.

The common thread: NFPs hold data that is valuable to attackers and subject to regulatory obligations they may not realise apply. Identifying where this data lives — SharePoint, shared drives, staff laptops, email attachments — is the foundation of NFP cyber security.

Essential Eight for Australian not-for-profits

The Essential Eight is the ACSC's recommended cyber security baseline — increasingly required for NFPs that supply to government, receive government grants, or hold cyber insurance. Essential Eight compliance is the framework Mycelium 365 implements for Australian NFPs.

Here is how each critical control applies in the NFP context:

• MFA (control 7) — the single most impactful control for NFPs using Microsoft 365. Enforcing MFA across all staff and volunteer accounts blocks the vast majority of credential-based attacks. Microsoft 365 Business Premium includes Entra ID Conditional Access, which makes MFA enforcement straightforward.
• Patching applications and operating systems (controls 2 and 6) — critical for NFPs with aging device fleets. Unpatched laptops running unsupported Windows versions are common in NFP environments and are a primary ransomware entry point. Intune (included in Business Premium) centralises patch management.
• Restricting admin privileges (control 5) — particularly important where volunteers have been granted admin rights historically. NFPs should restrict local admin to named, paid staff and use standard user accounts for volunteers and program teams.
• Regular backups (control 8) — essential for ransomware recovery without paying a ransom. Backups must be tested — an untested backup is a hope, not a strategy. Azure Backup provides encrypted, tested backup for Microsoft 365 data.

Microsoft 365 Business Premium covers most Essential Eight controls at Maturity Level 1–2 — making it the right starting point for NFP cyber security. For NFPs that need to demonstrate Maturity Level 2 to a funder or insurer, Mycelium 365 provides an Essential Eight baseline assessment to identify gaps and build a remediation plan.

Australian government cyber grants for not-for-profits

Cyber security funding for NFPs is available through several channels, though the landscape changes frequently:

• The Australian Cyber Security Centre's guidance for small organisations provides free resources, templates, and the Small Business Cyber Security Guide — written for organisations without dedicated security staff. The ACSC does not provide direct funding but its guidance is the benchmark insurers and grant bodies reference.
• ACNC Strengthening for Purpose grants are periodic — check grants.gov.au for current availability. These grants can fund cyber security improvements when framed as governance and operational resilience projects.
• State-based programs include Service NSW Small Business Support and equivalent programs in Victoria, Queensland, and other states. These programs typically offer rebates or matched funding for cyber security assessments and tooling.
• Microsoft itself provides cyber security tooling at NFP pricing through Business Premium and Defender for Business. The donated and discounted licensing under Microsoft for Nonprofits means the foundational security tooling is already heavily subsidised.

The challenge for NFPs is not usually the availability of grants — it is building the case for cyber investment to boards that may not see cyber security as a mission-critical spend. Mycelium 365 can help NFPs identify applicable grant programs and build the case for cyber investment to boards, framing security spending as donor and beneficiary protection rather than IT overhead.

Cyber insurance and not-for-profits

Cyber insurance for NFPs is increasingly requiring evidence of specific technical controls before a policy is issued or renewed:

• MFA enforcement across all accounts — insurers want to see MFA on email, admin accounts, and remote access. A policy that excludes volunteer accounts from MFA is a policy that will not pay out on a volunteer-related breach.
• Backup tested and recoverable — insurers ask for evidence of backup testing, not just backup existence. An annual backup restore test is the minimum credible evidence.
• Endpoint protection deployed — Defender for Business or equivalent EDR on all staff and volunteer devices. Organisations with unmanaged volunteer devices will struggle to satisfy this requirement without a managed device policy.
• Essential Eight compliance at Maturity Level 1 or higher — increasingly the baseline insurers expect. NFPs without documented Essential Eight evidence face either being declined for cyber insurance or paying significantly higher premiums.

Microsoft 365 Business Premium managed by Mycelium 365 typically satisfies the technical requirements for most Australian NFP cyber insurance policies. The Secure Essentials managed package includes the MFA, device management, endpoint protection, and backup controls insurers look for.

Managed cyber security for NFPs — what Mycelium 365 provides

Mycelium 365 provides managed IT for not-for-profits across Australia, including managed cyber security tailored to NFP budgets and risk profiles:

• Defender for Business — endpoint detection and response on all staff and volunteer devices, with alerts triaged by Mycelium 365.
• Huntress-powered 24/7 SOC monitoring — available via the Secure Cloud package for NFPs that need round-the-clock detection and response, including outside business hours when NFP programs often operate.
• Entra ID Conditional Access — MFA enforcement, device compliance requirements, and location-based access policies. Volunteers can be restricted to accessing Microsoft 365 only from compliant devices.
• Intune device management — for staff and volunteer devices. Intune enforces encryption, patch levels, and security baselines on any device accessing NFP data, whether NFP-owned or personal (BYOD).
• Microsoft Purview — data classification and loss prevention for client and donor data. Sensitivity labels prevent accidental sharing of beneficiary records or financial data outside the organisation.
• Quarterly Essential Eight reviews — documented evidence of security posture for boards, funders, and insurers. Each review tracks maturity progress and identifies remediation priorities.

All at fixed, predictable pricing from $95/user/month — with Microsoft 365 for not-for-profit licensing managed at donated pricing on top. NFPs know their monthly cost, their security posture, and what evidence they have for their next funder or insurer conversation.

Frequently asked questions

Why are Australian not-for-profits targeted by cyber attacks? Australian NFPs hold valuable data — donor payment details, client records, beneficiary information — and are often perceived as soft targets due to lean IT budgets, volunteer workforces using personal devices, and older technology environments. The ACSC has reported increasing ransomware incidents targeting the NFP sector, particularly disability services, mental health, and aged care organisations.

What cyber security does an Australian NFP need? The Essential Eight is the ACSC's recommended baseline for Australian organisations including NFPs. The most critical controls for NFPs are MFA enforcement (control 7), regular patching (controls 2 and 6), restricted admin privileges (control 5), and tested backups (control 8). Microsoft 365 Business Premium covers the majority of Essential Eight controls at Maturity Level 1–2 when properly configured.

Is cyber insurance available for Australian not-for-profits? Yes — cyber insurance is available for Australian NFPs and increasingly required by boards, funders, and government grant bodies. Insurers typically require MFA enforcement, tested backups, endpoint protection, and evidence of Essential Eight compliance at Maturity Level 1 or higher. Microsoft 365 Business Premium managed by Mycelium 365 typically satisfies these requirements.

Does Microsoft 365 help with NFP cyber security? Yes — Microsoft 365 Business Premium includes Defender for Business (endpoint protection), Intune (device management), Entra ID Conditional Access (MFA enforcement), and Microsoft Purview (data loss prevention). These tools cover the majority of Essential Eight controls at Maturity Level 1–2 for Australian NFPs, at the donated price of $9.84/user/month.

How much does managed cyber security cost for an Australian NFP? Mycelium 365 provides managed cyber security for Australian NFPs from $95/user/month (Secure Essentials), which includes Microsoft 365 management, Defender for Business, Intune, and Essential Eight controls. Microsoft 365 Business Premium licensing is additional at the donated rate of $9.84/user/month. 24/7 SOC monitoring is available under the Secure Cloud package.