The short answer: A findings report tells a board what’s wrong. A nonprofit security program is what the board approves to fix it. It ranks the top risks, gives each an owner and date, and adds a policy, a budget line and a review schedule. Funding tracks leadership. Among 100 Washington nonprofits surveyed in 2026, 52.3% with engaged leaders set a cybersecurity budget.
Written for nonprofit executive directors and CEOs who answer to a board: it covers turning assessment findings into a program the board approves, not the technical fixes your IT team or partner carries out.
Nonprofits whose senior leaders take part in cybersecurity decisions are far more likely to pay for the work. In UC Berkeley’s 2026 study of 100 Washington nonprofits, 52.3% of organizations with engaged leadership set a cybersecurity budget, against 14.7% of those without it (UC Berkeley CLTC, 2026). The survey covers one state, but the pattern it points to is familiar anywhere. A findings list with no leader’s decision behind it rarely gets money, an owner or a deadline. It stays a report.
In our conversations with buyers, the frustration takes the same two forms. Assessments list every possible issue instead of ranking the few that matter most. And the firm that found the gaps stops at naming them. Neither complaint is technical. Both are about who decides.
This guide covers the difference between a report and a program, and how to convert the assessment you already have. Then it sets out what a board can approve, what to do when it defers, and the three numbers that show it’s working. It draws on what buyers ask for, NIST’s Cybersecurity Framework and recent nonprofit research.
What’s the Difference Between a Findings Report and a Security Program?
A findings report describes risk on one date. A security program commits the organization to reducing it, with names, dates and a board decision behind it. The gap is common: in Salesforce’s six-country 2025 survey of 1,229 nonprofits, 11% had no data protection plan at all. A report sitting in a shared drive isn’t one either.
The difference is authority, not detail. An assessor can write an excellent report and leave the organization exactly where it was, because a report can’t assign work to anyone. Only leadership can. NIST put that in writing in 2024, when version 2.0 of its Cybersecurity Framework added Govern to its core functions, six in all. Its first accountability outcome makes organizational leadership responsible and accountable for cybersecurity risk (NIST, 2024). The framework names nonprofits among the organizations it’s written for.
Most nonprofits feel the gap in staffing first. In the Berkeley study, 64% employed no full-time IT staff, and 91% had no plans to hire more IT personnel. When nobody inside owns the list, the list owns nobody. A program fixes that by naming an owner for every item, even when a contractor does the work.
The stakes are real, if hard to count. In a 2026 study, researchers tracking publicly reported attacks on nonprofits logged 463 incidents, 222 of them in the US and 127 involving ransomware (Mierzwa et al., 2026). Those are only the incidents that became public. Many never do.
That’s what buyers ask for: help closing gaps, not a longer list of them. If your board assumes the assessment itself fixed something, our piece on why the assessment isn’t the deliverable makes that case in full.
How Do You Convert an Old Assessment Without Starting Over?
Convert an old assessment in three moves: approve the findings that matter most to the mission, turn the top ones into owned commitments with dates, and set the review that keeps them moving. NIST’s framework describes the same cycle, with risk responses chosen, prioritized, planned, tracked and communicated. A new assessment usually isn’t the first step.
Most findings reports are still useful a year later. The scan may be stale, but the shape of the risk usually isn’t. The fix is to stop treating the report as the plan and start treating it as the raw material for one.
1. Approve the five before you re-scan
The detail most organizations miss is that a report’s severity order is rarely a board’s order. Ranking findings by business risk is the assessor’s work, and our guide to remediation after a scan covers it. The board’s part is to approve the result: the five items to fix first, chosen for what would hurt the mission most. If the report is more than a year old, have IT confirm those five still exist.
2. Turn each top finding into a commitment
A finding becomes a board commitment when the approved plan gives it a target date and a budget line beside its owner, even if the line reads zero. Federal security teams already use this kind of document. NIST defines a plan of action and milestones as a document listing the tasks to be done, the resources each needs, its milestones and their scheduled completion dates (NIST CSRC). Our working rule is a list a director can read in one sitting: five commitments, not fifty.
3. Close the loop at a fixed interval
Commitments drift without a review date, so the board sets one when it approves the plan. In the Berkeley study, only 37% of nonprofits had raised IT or security budgets in the previous three years. Leadership wanting cybersecurity to be a higher priority was one of the top reasons those budgets went up. A review on the board calendar is how that push gets scheduled.
If your last assessment lists more findings than a board member could name from memory, it’s still a report. A program starts with five ranked priorities, each with an owner. Without that, nobody answers for the rest. Not sure which five? Let’s rank them together
What Goes Into a Nonprofit Security Program Your Board Can Approve
A program a board can approve fits on a few pages and carries six parts: ranked risks, owners and dates, a policy, a budget line, a review schedule and a response plan. Each part answers a question a director will ask. Many nonprofits lack the last one: Salesforce’s six-country survey found only 30% had a breach response plan in 2025.
The table below compares what a findings report usually gives you with what the board actually approves.
| Part of the program | What the findings report gives you | What the board approves |
| Ranked risks | Every issue, sorted by technical severity | The five to fix first, by mission impact |
| Owners and dates | Recommendations nobody is assigned | A named owner and target date for each |
| Policy | Gaps in policy, noted | A short written policy staff follow |
| Budget | Silence, or a vendor quote | A line in the annual budget |
| Review schedule | A one-time snapshot | A standing date to report progress |
| Response plan | A recommendation to write one | A tested plan with a named lead |
Why does the policy row carry so much weight? A policy is the part of a program that survives staff turnover. NIST’s framework asks for cybersecurity policy that is reviewed, updated, communicated and enforced as requirements change. That’s a board habit, not an IT task.
The budget row is where programs quietly fail. In the Berkeley study, 69% of nonprofits had no cybersecurity-specific budget. A program with no budget line is a wish list. Even a small line tells staff the board means it.
The play most nonprofits miss is the response plan. Berkeley found 55% had no incident response plan, and approving one costs little beyond staff time. It’s also the part of the program a board gets asked about first after an incident. C4’s Board-Ready Security Report is built in this shape: a risk register aligned to NIST CSF 2.0 and a 12-month remediation roadmap with assigned owners.
When the Board Says “Not This Year”
When the board defers, don’t re-argue the whole list. Narrow it. Ask for three things now: one approved owner, one funded priority and one review date, then bring the rest back at the next meeting. A narrow yes this quarter beats a full yes next year, because the three approved items start moving now.
- Get an owner approved at this meeting. A named owner costs nothing and changes who answers for progress. It can be a staff member, a board member or a contracted partner.
- Fund the one item that protects the most. Pick the priority that limits the worst outcome. In the Berkeley study, only 60% of nonprofits kept a separate, secure backup of important data, so backups often come first.
- Put the next review on the board calendar. A deferral with a date is a sequence. A deferral without one is the report again.
Let software chase the deadlines and keep the decisions with people. A shared tracker can flag a missed date, but only a person can decide whether the risk still matters. Closing items is hard everywhere: across all sectors, Verizon’s 2026 Data Breach Investigations Report found only 26% of critical vulnerabilities were fully remediated in 2025 (CIS, 2026). If you have an IT partner, ask them to check open items against CISA’s Known Exploited Vulnerabilities catalog, which CISA strongly recommends every organization use to prioritize fixes.
Three Numbers That Show the Program Is Working
Three numbers tell a board whether the program is real: the share of top risks with an owner and date, the share of commitments closed on time, and the age of the oldest open item. None of them needs new software, only the approved plan. Record all three before the first review so the second one shows progress.
Without a baseline, the second review measures effort, not progress.
- Ownership coverage. Count the top risks with a named owner and a target date. The target is all of them, from the day the plan is approved.
- On-time closure. Of the commitments due since the last review, count how many closed by their date. Report the share, not just the count.
- Age of the oldest open item. Count the days since the oldest open commitment was approved, and name the item. A number that only grows is the one to raise at the next meeting.
Read them together. If ownership is complete but on-time closure is low, the owners lack time or budget, and that’s a resourcing decision for the board. If closure is high but the oldest item keeps aging, the team is clearing easy items and skipping the hard one. If all three improve, the program is working. Boards that want a standard format for this reporting can borrow from board-level security governance, and documented progress also carries into your insurance renewal.
Next quarter, a director asks about the oldest item on your list. Check it now: if it’s past its date with no new one, it isn’t delayed. It’s abandoned, and your board may think it’s handled. Found one? Compare notes with us
Frequently Asked Questions
A Board Vote Is What Turns a Report Into a Program
Look at your last assessment the way your board would. If it names no owners, dates or review, it’s a report, whatever the cover says. Berkeley’s Washington numbers show where the gap sits: 52.3% of nonprofits with engaged leaders set a cybersecurity budget, against 14.7% without. And 55% had no incident response plan, a part that costs little to approve.
The decisions are your board’s to make, and the program is yours to own. Ranking the findings, documenting what’s in place and helping close the gaps that matter most is where C4 Technical Services works, alongside your staff. To see the format a board can read, download the report, or ask our IT consulting team where your program should start.
References
- “CyberCAN Washington: A Regional Assessment of Nonprofit Cybersecurity.” UC Berkeley Center for Long-Term Cybersecurity. Published April 2026. Verified live October 13, 2026.
- “Nonprofit Trends Report, Seventh Edition.” Salesforce. Published May 2025. Verified live October 13, 2026.
- “The NIST Cybersecurity Framework (CSF) 2.0.” National Institute of Standards and Technology. Published February 26, 2024 (cited for the 2024 release). Verified live October 13, 2026.
- “Trends in Non-Profit Cybersecurity: Analyzing Three Years of Incident Data from the NPCIR.” Mierzwa, Paliszkiewicz and Skarzyńska, Information 17(6). Published June 17, 2026. Verified live October 13, 2026.
- “Plan of Action and Milestones.” NIST Computer Security Resource Center Glossary. Published undated. Verified live October 13, 2026.
- “CIS Controls and MS-ISAC Insights Featured in Verizon’s 2026 Data Breach Investigations Report.” Center for Internet Security (compiling primary research from Verizon’s 2026 Data Breach Investigations Report). Published May 19, 2026. Verified live October 13, 2026.
- “Known Exploited Vulnerabilities Catalog.” Cybersecurity and Infrastructure Security Agency. Published undated. Verified live October 13, 2026.
- “Free Cybersecurity Services and Tools.” Cybersecurity and Infrastructure Security Agency. Published undated. Verified live October 13, 2026.
