Disasters’ First Responders - Nonprofits, the Other Critical Infrastructure

### Overview In this presentation, Dr. Kelley Misata argues that nonprofit organizations represent an overlooked component of critical infrastructure and disaster response. While the cybersecurity industry heavily focuses on sectors such as utilities and finance, nonprofits routinely step up as first responders during natural disasters, public health crises, and social emergencies. Despite employing the third-largest workforce in the United States and managing over 1.5 million entities domestically (and roughly 10 million globally), nonprofits are frequently relegated to the sidelines of cybersecurity initiatives. Misata emphasizes the urgent need for the security industry to move past widespread myths and integrate nonprofits into the broader security ecosystem.

### Key Topics - **Nonprofits as Critical Infrastructure**: Nonprofits provide essential emergency services, communication channels, shelter, and food during disasters. Their disruption directly threatens public well-being. - **Debunking Common Industry Myths**: - *Myth 1: All nonprofits are the same or just small businesses.* Nonprofits span massive hospital networks, professional entities (e.g., the NFL historically), and lean local organizations. - *Myth 2: Nonprofits are poor and do not spend money on technology.* Many nonprofits manage multi-million or billion-dollar operations, and all organizations surveyed by Sightline spend money on IT services, MSPs, or SaaS tools (e.g., Dropbox). - *Myth 3: Nonprofits use outdated technology and lack awareness.* Services like TechSoup facilitate access to modern software and hardware; nonprofits are actively aware of threats such as phishing and are pursuing two-factor authentication and cyber insurance. - **Critique of the "Security Poverty Line"**: Misata re-evaluates the industry concept of the security poverty line, arguing it counterproductively implies that organizations below the line are hopeless causes while excusing better-resourced entities from assisting effectively. - **Trust and Mission-Centric Risk**: Unlike traditional for-profit enterprises centered strictly on revenue loss, a nonprofit’s primary asset is trust. Donor confidence and mission execution dictate organizational survival.

### Technical Details & Operational Realities - **Dissertation Research**: Misata's Purdue University doctoral study focused on the cybersecurity preparedness of domestic violence and human trafficking support organizations. Challenging the academic committee's skepticism, she received 222 survey responses out of 500 distributed, proving clear interest in security. - **Third-Party Risk and Breach Impact**: Nonprofits rely heavily on third-party cloud services. Misata highlighted a Sightline member assisting pediatric cancer patients whose database was compromised during the 2020 Blackbaud ransomware attack, illustrating severe emotional and relational impacts over simple financial loss. - **Sightline Security Kickstart Framework**: Sightline evaluates nonprofit cybersecurity maturity using an adapted version of the NIST Cybersecurity Framework translated into nonprofit-specific terminology (replacing concepts like "assets" with mission-relevant elements, stakeholders, and community). - **Attack Visibility and Footprint**: Lean operating models make organizations susceptible to untracked SaaS sprawl, targeted phishing, and reconnaissance. Highly detailed public board bios and publicizing sensitive events on social media (such as phone-hacking sessions) expose organizational leadership and operations to attackers.

### Takeaways - **Context Over Tool Dumping**: Generic guides, free toolkits, and discounted software fail unless framed within the nonprofit's day-to-day workflow. Nonprofits operate under severe time constraints and cannot process generic security advice that does not tie to operational efficiency or mission security. - **Abandon the "Hero" Complex**: Security professionals volunteering or consulting must avoid swooping in with quick fixes or intimidating checklists. Lasting cybersecurity adoption requires listening first, building internal muscle memory, and aligning security with fundraising, donor trust, and core service delivery. - **Peer-to-Peer Scaling**: Rather than attempting universal top-down checklists for 1.5 million organizations, the industry should support collaborative cohorts where peer nonprofits teach and support one another using mission-tailored security frameworks.