Somewhere between the budget line for the roof and the discussion about the fall fundraiser, you have to bring up cybersecurity. And you already know how it can go. Either eyes glaze over because it sounds like an IT problem for someone else, or you scare everyone with breach headlines and the room agrees it’s terrifying and then does nothing about it. Neither one gets you what you actually need, which is a decision.
The good news is that a board doesn’t need to understand security. They need to understand risk, and risk is something a board already knows how to talk about. They weigh it every time they approve an insurance policy, sign a lease, or decide whether to run a capital campaign. Your job isn’t to turn them into technologists. It’s to translate a technical subject into the language of stewardship and decisions they already speak.
Lead with what you’re protecting, not what you’re afraid of
The mistake most people make is opening with the threat — hackers, ransomware, breaches. That puts the board in a defensive crouch, and frightened people tend to freeze rather than act. Open instead with what’s yours to protect.
Your organization holds things people trusted you with. Members’ names, addresses, and family details. Donors’ giving records and, on the payment side, their financial information. Bank access. Sometimes counseling notes or benevolence requests that were shared in confidence. A board understands custody. So frame it that way: “We hold sensitive information about our members and donors, and part of our responsibility is keeping it safe. I want to spend ten minutes on how we’re doing that.” Now it’s a stewardship conversation, and stewardship is the board’s whole job.
Translate the risk into terms a board already weighs
Boards think in terms of likelihood and impact, even if they don’t use those words. You can meet them there without a single technical term.
On likelihood, the honest and useful message is that small organizations are targeted precisely because they’re small. Attacks on churches and nonprofits are mostly automated and opportunistic — nobody is singling you out, but the internet is full of programs that knock on every door looking for one that’s unlocked. Being small and mission-focused doesn’t make you invisible; it often makes you an easier target than a bank with a security team.
On impact, keep it concrete and local. The damage from an incident isn’t abstract “cyber” harm; it’s a diverted wire transfer that empties an account, a week where staff can’t get into email or files, member data exposed and a hard conversation with the people it belongs to, and the quiet erosion of trust that’s harder to measure than any dollar figure. You don’t need to inflate any of this. Stated plainly, it lands.
Bring one number, not ten
Resist the urge to build a slide of statistics. A board remembers one well-chosen figure and forgets a wall of them. Pick a single anchor that fits your point — for example, the FBI’s Internet Crime Complaint Center reports that business email compromise, the scam where an attacker impersonates a leader or vendor to redirect a payment, has driven billions in reported losses, with an average loss per incident well into the tens of thousands of dollars. One number like that, tied to a scenario your board can picture (a fake email from the pastor asking the bookkeeper to move money), does more than a dozen abstract percentages.
Whatever figure you choose, use a real one from a named source and say where it came from. A board’s trust in you is the currency you’re spending; don’t spend it on a statistic you can’t back up.
Ask for a decision, not a reaction
Here’s the part that turns a scary presentation into a productive one. Don’t end with “so we should take this seriously.” End with a specific, bounded ask the board can actually approve. Boards are built to decide; give them something to decide.
That might be approving a small annual line for security tools and training. It might be authorizing staff to spend a set number of hours getting basic protections in place. It might be as simple as endorsing a plan to turn on multi-factor authentication everywhere and adopt two short policies. The ask should be concrete, affordable, and clearly the next step — not a blank check against an unbounded fear.
It also helps enormously to walk in already knowing where you stand. If you can say “we’ve checked our basics and here’s where we’re strong and where we have gaps,” the conversation shifts from vague anxiety to a clear-eyed plan. A board responds very differently to “the sky might be falling” than to “here are our three gaps and here’s what closing them costs.”
Leave them calmer than you found them
The goal of the whole conversation is not fear. It’s confidence that a responsible plan is in motion. Fear paralyzes and fades; a plan gets funded and followed. If your board leaves the room thinking “we know where we stand and we know our next step,” you’ve done exactly what good governance of any risk requires — the same thing they already do with the building, the budget, and the insurance.
If you’d like to walk into that meeting already knowing your gaps, that’s what our free assessment is built to give you: a plain-language baseline you can put in front of a board without a translator. Get on the launch list and you’ll be first in line when it opens.
Sources
- Federal Bureau of Investigation, Internet Crime Complaint Center (IC3), Internet Crime Report — business email compromise loss figures, ic3.gov.
- Cybersecurity and Infrastructure Security Agency (CISA), Cyber Guidance for Small Businesses — on the automated, opportunistic nature of attacks against small organizations, cisa.gov.
- National Council of Nonprofits, guidance on cybersecurity as a governance and risk-management responsibility, councilofnonprofits.org.