Cyberattacks Strategy for Nonprofit Organizations

Research Problem

Purpose & Research Question

The purpose of this qualitative multiple case study was to explore strategies ISSMs at nonprofit organizations employ to protect against cyberattacks.

Theoretical Framework

General Systems Theory. The study viewed cybersecurity within the broader organizational system, recognizing the interaction among technology, people, processes, organizational strategy, and external dependencies.

Examining any one of these elements in isolation offers a partial account at best — which is part of why technically sound controls still fail inside real organizations.

Methodology & Study Design

Key Findings

The study identified three core operational pillars essential for organizational protection.

1. Cybersecurity Awareness

   People remain the operating surface of any security programme. Awareness determines whether controls are used as intended or quietly worked around.

2. Cybersecurity Strategy

   A deliberate, documented approach rather than accumulated tooling — the difference between defending an organization and reacting to events within it.

3. Third-Party Dependence

   Nonprofits rely heavily on external providers. That dependence is simultaneously a capability and an exposure, and requires governing as such.

Practical Implications

The research provides actionable guidance for enterprise security leaders and nonprofit ISSMs through a four-stage execution framework.

1. Assess

   Establish the real exposure, the dependencies, and what the organization cannot afford to lose.

2. Strategize

   Turn that picture into a deliberate, documented approach with defensible priorities.

3. Build / Acquire

   Develop capability internally or source it deliberately, including the third-party relationships already relied upon.

4. Educate

   Sustain awareness across the organization so the strategy survives contact with daily operations.

Contribution & Social Change

The study documents transferable strategies drawn from practitioners directly responsible for security in nonprofit organizations — a population that holds sensitive data and serves vulnerable people, yet rarely commands the budgets or in-house expertise that enterprises take for granted.

Social change impact. Effective cybersecurity strategies can help nonprofits mitigate and prevent cybersecurity attacks, protect organizational information, and maintain their ability to fulfil their missions without disruption to vital public services.

Full Dissertation

Derived Publications