Download IT Checklist for Nonprofit

Multi-Factor Authentication (MFA) adds an extra layer of security, making it significantly harder for attackers to gain access, even if passwords are compromised. 

Every nonprofit should enable MFA for: 

• Microsoft 365 

• Email 

• Financial systems 

• Cloud applications 

• Remote access 

• Administrative accounts 

It’s one of the simplest improvements an organization can make to strengthen cybersecurity. 

CSI Tech Corp helps nonprofit organizations deploy MFA across their entire environment, making implementation straightforward for employees while improving protection for critical systems.

Software updates aren’t just about new features; they often contain critical security patches that protect your organization from known vulnerabilities. Every nonprofit should have a process for updating:

• Windows computers 

• Macs 

• Mobile devices 

• Microsoft 365 applications 

• Antivirus software 

• Network equipment 

Managing updates across multiple devices can quickly become time-consuming, especially for organizations without dedicated IT staff. 

CSI Tech Corp provides proactive device management, patch management, endpoint monitoring, and ongoing maintenance through our Managed IT Services, helping nonprofits stay secure without disrupting daily operations. 

Request E-Recycling – CSI Tech Corp offers secure Electronic Recycling services, helping Minnesota organizations safely retire outdated technology through certified data destruction and environmentally responsible recycling practices. Before retiring equipment, it’s important to ensure data is securely removed and devices are disposed of responsibly. 

Having backups is only half the equation. The real question is whether your organization can successfully recover its data when something goes wrong. 

Ask yourself: 

• Are backups running automatically? 
• Are copies stored securely off-site or in the cloud?
• Have you tested restoring files recently? 
• Are your Microsoft 365 emails and documents included? 

Many nonprofits assume cloud applications automatically protect everything. Unfortunately, that’s not always the case. A reliable backup strategy helps your organization recover from ransomware, accidental deletions, hardware failures, and other unexpected events. 

At CSI Tech Corp, we help nonprofits implement automated Backup & Disaster Recovery solutions that protect Microsoft 365, cloud data, and on-premises systems while regularly testing recovery to ensure everything works when it’s needed most.

Invest in your people with security awareness training. Employees and volunteers are often the first line of defense, which makes ongoing cybersecurity education essential. Regular training helps staff recognize: 

• Phishing emails 

• Fake login pages 

• Business email scams 

• Password best practices 

• Safe file sharing

Short, practical training sessions throughout the year are often much more effective than a single annual presentation. 

CSI Tech Corp provides cybersecurity awareness training designed specifically for small businesses and nonprofits, helping organizations reduce risk through practical, easy-to-understand education.

Review Your Cyber Insurance Requirements. Cyber insurance has become increasingly important for nonprofit organizations, but insurance providers are also raising their cybersecurity expectations. 

Many policies now require organizations to demonstrate security controls such as:

• Multi-Factor Authentication 

• Secure backups 

• Endpoint protection 

• Employee cybersecurity training 

• Access controls 

• Incident response planning 

Reviewing these requirements before your renewal can help avoid surprises and identify areas that may need improvement. 

CSI Tech Corp works with nonprofit organizations to evaluate their current IT environment, identify security gaps, and prepare for cyber insurance renewals through practical technology planning and IT consulting. 

How to Build a Security Culture on a Tight Budget 

• Put security training on the calendar as a recurring event. 

• Name an internal “security champion” — one person for reporting suspicious activity. 

• Use free phishing-simulation tools to build muscle memory without a big spend. 

• Write down your incident response plan in one page — who to call first (including your IT provider’s number); it matters more during an actual incident than a long formal policy. 

• Get buy-in from your executive director and board — security culture starts at the top, even at a small nonprofit. 

Yet many professionals still spend valuable time creating folders, moving messages, and searching endlessly for information they know exists somewhere in their mailbox. At CSI Tech Corp, we have found that one of the simplest productivity improvements isn’t a new software platform or expensive technology upgrade; it’s learning how to use advanced email search effectively. 

Our CEO, Mark Wheatley, recently tested advanced search capabilities across Outlook Desktop, Outlook Web Access (OWA), Outlook.com (Hotmail), and Gmail. The results confirmed that most users are only using a fraction of the search tools already available to them. 

Many users organize their inboxes with dozens of folders and subfolders because they worry they won’t be able to find important emails later. The challenge is that filing and organizing emails takes time. Even worse, people often forget where they store a message.

For busy organizations in the Twin Cities area, that means: 

• Less time searching for information 

• Improved employee productivity 

• Faster customer response times 

• Better access to historical communications 

• Reduced inbox frustration 

• More efficient daily workflows 

Modern email platforms are designed to search for large amounts of data quickly. When users understand advanced search features, they can often locate information in seconds without manually sorting messages. 

One strategy our team often demonstrates during training sessions: 

Instead of spending time moving every message into folders, keep important emails accessible and use advanced search tools to locate information when needed. 

For example, imagine you need to find an email from someone – ‘Nick’. A basic search for ‘Nick’ may return hundreds of results. Advanced search operators help narrow those results dramatically.

Search operators allow you to include or exclude specific content. 

Example: 

‘Nick AND proposal’ – returns emails containing both terms. 

‘Nick NOT invoice’ – returns emails mentioning Nick but excludes emails containing the word invoice.

This simple technique can reduce hundreds of search results to only a handful of relevant messages. 

One of the most useful Outlook search features is filtering messages by time period. 

• received:“last week” 

• received:“last month” 

• received:“last year” 

You can also search specific date ranges: received:10/01/2023..11/30/2023 

This search returns emails received between October 1 and November 30, 2023. 

Combined with sender information, searches become even more powerful: Nick AND received:10/01/2023..11/30/2023

This quickly identifies conversations from a specific person during a defined period. 

Many organizations need to locate contracts, invoices, reports, or presentations. Advanced search can isolate messages containing attachments. 

Examples: hasattachment:yes or hasattachment:no

This is especially useful when trying to locate: 

• Financial reports 

• Board meeting documents 

• Vendor contracts 

• Client proposals 

• Project files 

One advantage of learning advanced search is that similar functionality exists across multiple platforms. Microsoft Outlook Desktop, Outlook Web Access (Microsoft 365), and Outlook.com generally use similar search syntax. 

Gmail offers comparable capabilities, although some search operators differ slightly. 

The underlying concept remains the same: 

The better you understand search tools, the less time you spend manually organizing email. 

Microsoft provides guidance on Outlook search features and filters. Users looking to improve their email management skills can also review official Microsoft training resources and documentation. 

Many professionals spend ‘years’ manually sorting emails without realizing how powerful modern search tools have become. Learning these advanced search techniques can make it easier to find conversations, locate attachments, and access important information when you need it most. Give these search features a try the next time you’re looking for an email. You may be surprised how quickly you can find exactly what you’re looking for. 

If your organization would benefit from additional Microsoft 365 training or cybersecurity training, we’re always happy to have a conversation.

Many local organizations assume cyberattacks primarily target large corporations. 

In reality, attackers frequently target small and midsize businesses, nonprofits, healthcare providers, legal firms, accounting practices, and professional service organizations throughout the Twin Cities. 

Organizations in Minneapolis, Saint Paul, Bloomington, Eden Prairie, Maple Grove, Plymouth, Woodbury, Eagan, and surrounding communities often depend on the same technology platforms used by larger enterprises. Microsoft 365, cloud file sharing, remote access tools, and business applications help teams stay productive, but they also create opportunities for attackers when accounts or devices become compromised. 

The question is no longer whether an organization is large enough to be targeted. 

The more important question is whether suspicious activity can be detected before it spreads. 

For business owners, nonprofit leaders, healthcare practices, legal firms, and other organizations throughout Minnesota, early detection can mean the difference between a minor security incident and a major operational disruption. 

Organizations should be especially careful with information connected to clients, employees, finances, or day-to-day operations. Even routine materials, like meeting summaries, internal planning notes, pricing discussions, or vendor communications, can contain details that were never meant to leave the organization. 

Teams should also avoid sharing anything tied to security systems, account access, confidential agreements, or regulated information. In many cases, employees may not realize that “small” details can still expose sensitive context when combined together. 

Creating awareness around what stays internal helps reduce unnecessary risk and keeps AI use practical, responsible, and easier to manage across the organization. 

At CSI Tech Corp, we have worked with local organizations across Minnesota since 2004 to make technology predictable and secure.   

When it comes to AI adoption, we help you:   

• Define simple, practical usage policies   

• Align AI tools with your existing cybersecurity standards   

• Ensure your team understands what’s safe and what’s not   

• Integrate AI into workflows without adding risk   

This is not about limiting your team. It’s about giving them clarity so they can use tools confidently

Short conversation now can prevent bigger issues later. If your team is already using AI tools, it’s worth reviewing:  
  

• Do we have clear guidelines?   

• Do employees know what they should not share?   

• Are we protecting sensitive information consistently?

To unlock and access a BitLocker-encrypted drive outside its original device, you need a recovery key — a system-generated code created when encryption is enabled. Without it, accessing the data becomes significantly more challenging, and in some cases, recovery is not feasible without a data recovery service. Fortunately, the client had done things right. They had saved their recovery key and were able to provide it to our team. 

If your organization is using Microsoft 365 or Microsoft Entra ID, there’s good news: Recovery keys can often be stored automatically in your environment. We typically recommend: 

For unmanaged or home-based setups, this is where risk increases. There’s often no central record. 

Two Different Roles

In the Minnesota business environment, where many teams operate hybrid or fully remote, relying on a single device is risky. 

A cloud-based backup strategy provides: 

Even when systems are configured correctly, hardware failure is still unavoidable. 

In our work with small businesses and nonprofits across Minneapolis–Saint Paul, this situation is more common than most people expect. Here’s where things typically break down: 

If you’re unsure about your current setup, this is a good place to start: 

At CSI Tech Corp, we’ve been supporting organizations across the Twin Cities since 2004. Our role is simple: make technology predictable, secure, and aligned with your operations. 

We help Minnesota businesses and nonprofits with: 

Most cyber incidents start with a simple email. 

These messages often appear urgent or familiar: 

• “Updated tax document — please review” 

• Payroll reports attached 

• Vendor payment changes 

• Client refund requests 

They are designed to create urgency and bypass verification. 

How to reduce phishing email risk: strong email filtering, extra login verification steps, ongoing staff training, clear rules for confirming financial requests. This is not about blaming employees. It’s about building safeguards around normal daily work. 

In some cases, attackers study communication patterns and impersonate trusted contacts: clients, vendors, or even firm leadership. 

Common examples include: 

• Requests to update payment details 

• New wire instructions 

• Messages appearing to come from a partner 

Because accounting firms regularly handle financial transactions, even one mistake can create disruption and reputational damage. 

How to reduce fake payment risk: always confirm payment changes by phone, require two approvals for financial transfers, monitor for unusual account activity, clearly define who can authorize payments.
Process discipline is often more important than technology.

Some attacks attempt to block access to files and systems until payment is made. 

For accounting firms, timing matters. A disruption in March or April can halt operations at the worst possible moment. 

How to reduce system lockouts risk: keep secure backups of critical data, regularly test recovery procedures, limit access to sensitive systems, keep systems updated and maintained. 

Preparation turns a potential crisis into a manageable situation.

Many breaches happen because passwords are reused, shared, or not properly managed. 

Common issues include: 

• Simple or repeated passwords 

• Shared logins 

• Former employees still having access 

• No additional login verification 

Since modern accounting firms rely heavily on cloud-based tools, login security is foundational. 

How to reduce weak or shared password risk: require additional verification for all accounts, use secure password management tools, review access rights regularly, and immediately remove access when someone leaves. 

Small improvements here can significantly reduce exposure.
 

Not all security issues are intentional attacks. 

Sometimes sensitive files are unintentionally shared too broadly, or former staff retain access longer than they should. 

Examples include: 

• Incorrect sharing settings 

• Public file links 

• Access not removed after role changes 

These situations are rarely malicious, but they can still damage client trust. 

How to reduce accidental data exposure risk: review file sharing settings regularly, audit who has access to what, formalize onboarding and offboarding procedures, and maintain ongoing oversight of cloud systems. 

Security is largely about disciplined management. 

Cybersecurity for accounting firms is about clear processes, defined responsibilities, regular oversight, and leadership involvement. 

Minnesota firms that approach cybersecurity as an operational responsibility, not just an IT issue, tend to experience fewer disruptions, stronger client confidence, clearer internal workflows, better alignment with insurance and regulatory expectations. 

CSI Supports Minnesota Accounting Firms Since 2004 

CSI Tech Corp has worked with organizations across Minnesota for more than two decades. 

We focus on: 

• Predictable IT support 

• Structured cybersecurity oversight 

• Secure cloud management 

• Business continuity planning 

• Strategic IT guidance 

We understand the operational pressure accounting firms face, especially during the tax season, and align technology with stability. 

If your firm hasn’t reviewed its security posture in the last 12 months, now is the time. 
A short assessment today can prevent weeks of disruption tomorrow.

Contact CSI directly: 
 
(952) 928-1788 
sales@csitechcorp.com

It came from MSalerts@pcsupport.fr. Microsoft doesn’t send alerts from outside domains. A quick check of the sender’s address often gives you a clue.

Most email setups mark outside messages with a tag like [EXTERNAL]. This one didn’t have it, which raised questions.

Hovering over the button showed a web address that didn’t lead to a Microsoft site. No need to click, just hovering is often enough to verify.

The message said account access was “limited” and asked for immediate action. That’s not how Microsoft typically communicates. Real notices tend to include more context.

Good design builds trust and that’s why attackers use it. A clean layout is not a guarantee that the message is real.

What You Can Do as a Leader

You don’t need to become a cybersecurity expert, just help build habits that keep your team informed:

• Encourage staff to pause and verify messages that seem urgent
• Set up a clear internal process to report suspicious emails
• Work with your IT provider to review email security settings

If a message raises questions, it’s always better to check than to guess.

Local IT Support That Keeps It Simple

At CSI Tech Corp, we support local organizations across the Twin Cities with practical, community-first IT solutions since 2004.

Here’s How We Help:

• Managed IT Support – Consistent help desk and systems support
• Email Security & Monitoring – Keep threats out of inboxes
• Staff Awareness Training – Simple tips for real-world situations
• Cloud & Tech Planning – Scalable infrastructure, tailored to you

We’ve worked with Minnesota teams since 2004. From nonprofits to legal firms to clinics, we focus on reliability, clarity, and strong partnerships.

Build Confidence, Not Fear

Phishing emails are part of the modern inbox. The more your team knows what to look for, the more confident they’ll feel managing daily tech.

If you’d like a local IT partner to help you review your current tech setup or train your team in practical ways, we are here for that.

📞 Contact CSI Tech Corp to get a complimentary consultation with our expert.