In a period dominated by interconnected technologies and rapid digital transformation, the significance of robust cybersecurity measures cannot be overstated. The relentless evolution of cyber threats poses a formidable challenge to organizations, especially nonprofits in the humanitarian, aid, conservation, and development sector. These nonprofit organizations collect sensitive data and when they fall prey to cyberattacks it does not just put their critical operations at risk but can cause harm to the vulnerable people they work with.
External data from NetHope partners confirms the high level of cyber risk facing nonprofits. The 2023 Microsoft Digital Defense Report notes that nonprofits as the third most targeted sector by nation-state-level attackers, with only the Government and Education sectors under more pressure. In the same report, phishing is cited as the most common attack vector, leading to 43% of compromises, and nonprofits accounted for 19% of ransomware incidents across all sectors. Cloudflare’s DDoS Attack Trends for 2024 substantiates this with a startling statistic that a full 13% of all traffic to nonprofit sites was HTTP DDoS attack traffic, which puts nonprofits at the third highest risk for this type of attack when normalized for average internet traffic volume.
Recognizing the gravity of this situation, NetHope, an alliance of 60+ humanitarian, development, and conservation international nonprofits collaborated with the Center for Internet Security (CIS) to conduct a comprehensive Cybersecurity Assessment for its international nonprofit Members to evaluate their cybersecurity posture using the Center for Internet Security (CIS) Cybersecurity Framework Controls and their Control Self-Assessment Tool (CIS CSAT). It is the second time that NetHope has conducted this assessment – the previous iteration was in 2021.
This report is the companion to the only international nonprofit-specific benchmarking study on the contextual realities of cybersecurity in international aid, development, and humanitarian nonprofits face. (See NetHope’s definitive 2024 State of Humanitarian and Development Cybersecurity Report).
Many of us intuitively understand the need for these organizations to focus on the physical safety of those they serve in the aftermath of a disaster or conflict. But cyberattacks are also a major challenge, with bad actors looking to take advantage of vulnerable people, putting the organizations, and the lives of those they support, at even greater risk.”
- Erin Baudo Felter, Vice President, Social Impact and Sustainability at Okta
Reports like these are important because the standard patterns of gap analysis and their associated remedies for cybersecurity issues are generally very well defined for the private sector but are severely lacking for other modes of action, like the nonprofit sector and specifically the large international nonprofit agencies that are NetHope Members. For a sector that is the critical infrastructure of last resort/last mile for some 1.67 billion people around the world, this data blind spot exacerbates a high-risk environment that puts many people at risk of harm. Yet, data without the availability of resources to remediate is only of limited use. Overwhelmingly this report makes clear that across dimensions nonprofits do not have resources to adequately resource their cybersecurity to defend themselves, their missions, and the people they work with.
Complete the form below to access and download, Critical Missions Need Critical Data: A Comprehensive Cybersecurity Assessment of International Nonprofits
To access the Critical Missions Need Critical Data: A Comprehensive Cybersecurity Assessment of International Nonprofits toolkit, please complete the form below for a download link.
Below are the 24 organizations who participated in the assessment this year.
