When was the last time you stopped to think about how your everyday work habits might be putting your nonprofit at risk?

From checking email and sharing files to working remotely and managing passwords, we make dozens of decisions every day that can affect our organization’s digital security. And when we’re busy juggling responsibilities, it’s easy to let convenience take priority over caution.

Spokes recently attended Protecting Our Movements: Digital Security 101 for Activists & Community Organizations, a workshop offered by The Fund for Santa Barbara and presented by Josh Berthume of Rogue Metrics.

One of the key messages? Protecting our organizations isn’t just about having the right technology in place. It’s also about the way we work.

The good news is that a few simple changes in our everyday habits can go a long way toward reducing risk.

Here are seven takeaways worth sharing with your team.

1. Stop checking email on autopilot.

We’ve all done it. You’re on the go, on your phone, moving quickly through your inbox, opening messages and clicking links without giving them much thought. But that’s exactly when you’re more likely to fall for a phishing attempt.

Slow down, especially when an email contains an unexpected link, attachment or request. Take a moment to consider who sent it and whether it’s something you were expecting.

2. Don’t reuse passwords across platforms.

Using the same password for multiple accounts may be convenient, but it also means that if one account is compromised, others could be vulnerable.

Consider adopting an organizational password manager, such as 1Password, to generate and securely store unique passwords for your various accounts. This makes it easier to maintain strong passwords without having to remember them all.

3. Think twice before connecting to public Wi-Fi.

Working from a coffee shop, airport or hotel? Be cautious about connecting to public Wi-Fi networks.

Cybercriminals can create fraudulent networks that mimic legitimate ones, potentially allowing them to intercept information or direct users to malicious websites.

A safer option is to use your phone’s password-protected hotspot. If you need to use public Wi-Fi, consider using a trusted virtual private network (VPN) to encrypt your connection.

4. Require two-factor authentication within your organization wherever possible.

Two-factor authentication (2FA) adds another layer of protection by requiring a second form of verification when someone logs in.

Even if a password is compromised, 2FA makes it much harder for someone to gain access to an account.

Berthume’s advice was straightforward: If your organization has the ability to require two-factor authentication, do it.

5. Regularly review who has access to your organization’s files.

Think about everyone who has access to your organization’s Google Drive or other shared platforms. Do they all still need it?

It’s common for employees, volunteers, board members and outside partners to receive access to files for a particular project and retain that access long after their involvement ends.

Make it a regular practice to review sharing permissions, remove unnecessary access and ensure sensitive information is available only to those who need it.

6. Use organization-specific email accounts to manage access.

Rather than granting access to organizational files through someone’s personal email address, consider creating organization-managed accounts for staff, volunteers and others who need access.

This gives your nonprofit greater control over permissions and makes it easier to revoke access when someone’s role changes or their involvement ends.

It’s a particularly useful practice for nonprofits that rely heavily on volunteers or experience regular board turnover.

7. Not expecting that attachment or invoice? Verify it first.

Phishing attempts aren’t always obvious. A fraudulent email can appear to come from someone you know, including a colleague, vendor or community partner.

If you receive an unexpected invoice, attachment or request for information, don’t assume it’s legitimate simply because you recognize the sender.

Instead, confirm the request through another trusted communication channel, such as Slack, a phone call or a separate message to the person.

That extra step could prevent a costly mistake.

Digital security is everyone’s responsibility.

Protecting an organization doesn’t necessarily require sophisticated technology or a dedicated IT department. It starts with being intentional about the way people work.

For nonprofit leaders, that means taking time to establish good habits, review existing practices and make sure staff, board members and volunteers understand their roles in keeping organizational information secure.

A good place to start? Share these seven takeaways at your next staff meeting and identify one or two changes your organization can make right away.

Small steps today can help prevent much bigger problems tomorrow.

Want to learn more?

Watch the full presentation, Protecting Our Movements: Digital Security 101 for Activists & Community Organizations, featuring Josh Berthume of Rogue Metrics, or review Josh’s presentation slides, Digital Risk Awareness & Mitigation.

Special thanks to The Fund for Santa Barbara for offering this valuable learning opportunity and to Josh for sharing his expertise.