Where Can Nonprofits Get Help Paying for Cybersecurity?

Nonprofits can get help with cybersecurity costs from several places: CISA's no-cost services and its list of no-cost tools, cyber volunteer clinics that CISA catalogs for civil society organizations, discounted and no-cost security offers from Microsoft for eligible nonprofits, and in-kind grants from the Cyber Grants Alliance. Start with the no-cost options, then use grants and discounts for the gaps that remain.

What cybersecurity help does CISA offer nonprofits at no cost?

CISA offers no-cost services and maintains a list of no-cost tools from public and private organizations. Its list recommends three starting points for every organization: connect with your regional CISA Cybersecurity Advisor, sign up for Cyber Hygiene services, and work through the Cybersecurity Performance Goals checklist (CISA no-cost cybersecurity services and tools). Cyber Hygiene vulnerability scanning is open to U.S. public and private sector critical infrastructure organizations as well as federal, state, local, tribal, and territorial governments (CISA Cyber Hygiene Services).

Can nonprofits get free hands-on help from cyber volunteers?

Yes, in many regions. CISA's Cyber Volunteer Resource Center lists clinics and volunteer corps run by academic institutions, nonprofits, and state governments that give under-resourced high-risk communities, such as civil society organizations, free or greatly discounted support for incident response and resilience building (CISA Cyber Volunteer Resource Center). CISA also publishes training and resources for high-risk communities (CISA High-Risk Communities).

Do technology companies offer security discounts for nonprofits?

Some do. Microsoft's Security Program for Nonprofits includes a free security assessment, AccountGuard at no cost for eligible nonprofits, security training, and discounted pricing on Microsoft security products for eligible nonprofits (Microsoft: Secure your mission). Check eligibility on the vendor's own page before you plan around an offer, because terms change.

Are there government grants that cover nonprofit cybersecurity?

Look carefully before you apply. FEMA's Nonprofit Security Grant Program supports target hardening and other physical security enhancements for nonprofits at high risk of terrorist attack (FEMA Nonprofit Security Grant Program). Its program page describes physical security, so read the current notice of funding opportunity before assuming cybersecurity costs are allowable.

Where else can a small nonprofit find local cybersecurity support?

NIST's Small Business Cybersecurity Support Programs Finder lists programs across the United States, hosted by nonprofit institutions, that help their region's small business community manage cybersecurity risk (NIST Small Business Cybersecurity Corner). Small nonprofits can use it to find a regional program near them.

Can a nonprofit apply for a Cyber Grants Alliance grant?

Cyber Grants Alliance grants are in-kind: an approved provider delivers cybersecurity services at no cost to the recipient. See Cyber Grants Alliance grants for who can apply and how, or the grant programs overview. When you are ready to compare paid help, read how to choose a cybersecurity provider.