It’s 9am on a Monday. Your intake team logs into the case management system and the screen is blank. Not a system error — a ransom note.
Client records, NDIS plans, progress notes, staff rosters — all encrypted. The phone starts ringing: clients asking about their support workers, the board about the data breach notification, your insurers asking questions you don’t yet have answers to.
If you’re a CEO of an Australian not-for-profit or community organisation, this scenario probably feels distant. You run an essential service — disability support, aged care, community housing. Your focus is on mission, on people.
Cyber security feels like something that matters to banks and retailers. Not to organisations stretched thin doing critical work.
The reality is different. NFPs hold some of the most sensitive data in the country: health records, NDIS plans, client addresses, financial details — often for vulnerable Australians. And the attackers know it.
Cyber resilience doesn’t happen in isolation. It should be part of your broader security plan: How to Develop a Cyber Security Roadmap and Build Resilience
Why Should NFP CEOs Care About Cyber Security?
The Australian Cyber Security Centre’s annual threat reports show a sustained rise in cybercrime across organisations of all sizes. Ransomware, email compromise, and data theft don’t discriminate by sector.
Attackers follow the path of least resistance. Large enterprises have invested heavily in defences over the past decade. Mid-market NFPs with 100–500 staff often haven’t — which makes them attractive targets.
And the data they hold is valuable. Health records, NDIS plans, financial details that can be sold — or used in follow-on scams targeting vulnerable clients.
The question isn’t whether an attack could happen. It’s whether your organisation could continue delivering services when one does.
What Does an Attack Really Cost an NFP?
When a cyber security investment gets deferred — and it often does — the reasoning is understandable. Staff need to be paid. Programs need to run. Grant money has strings attached. Cyber feels like a future problem.
But the economics of delay are worth examining through the lens that matters most to NFP CEOs: the mission itself.
- Grant compliance risk. More grant programs now include cyber security requirements. Tenders for NDIS services, aged care, and community services increasingly ask about Essential 8 maturity and incident response plans. A breach that exposes client data can jeopardise current and future funding.
- Client welfare. Encrypted client records aren’t just an IT problem. You can’t access care plans, verify medication schedules, or roster staff. Service delivery stops — and the people who depend on you feel it.
- Reputational damage. Not-for-profits operate on trust. A public data breach erodes that trust quickly — and in a sector where word travels fast, recovery takes years.
- Insurance premium increases. Cyber insurers now require demonstrable Essential 8 maturity — evidence of implemented controls, not just a policy on paper — before offering coverage at sustainable rates. For organisations on tight margins, a premium spike or declined application is a significant financial hit.
The real cost of an incident isn’t the ransom, which most organisations are advised not to pay anyway. It’s the weeks of disruption, the forensic investigation, the regulatory notifications, and months of rebuilding trust.
For a grant-funded organisation with limited reserves, that’s existential.
What Is the Essential 8, Really?
The Australian Signals Directorate’s Essential 8 is often presented as a compliance framework — a checklist to tick off once a year. That framing does it a disservice.
In practice, the Essential 8 is a set of practical controls that, when implemented as a continuous operating model, dramatically reduce the likelihood and impact of a cyber incident.
There are four maturity levels. Level 1 stops basic, opportunistic attacks. Level 2 and above addresses sophisticated threats.
Most mid-market NFPs sit below Level 1 for several controls — not because their teams aren’t capable, but because cyber hasn’t been prioritised in an environment with limited IT resources.
The Eight Controls, Translated for Your Organisation
Here’s what the Essential 8 looks like in the day-to-day reality of an NFP:
- Application control. Only approved software runs on your devices. That case management laptop can’t accidentally execute a malicious attachment or a fake update. This alone blocks the majority of ransomware attacks at the door.
- Patch applications and operating systems. Security updates aren’t optional. But in a sector with shared workstations across multiple sites, patching can be complex. The goal is a systematic process — automated deployment on a regular cadence, not manual updates that rely on someone remembering to do them.
- Multi-factor authentication. Every staff member who accesses client data, every admin account, every remote access session — protected by a second factor beyond just a password. This is the single most effective control against credential theft, and it’s far more straightforward to roll out than most people expect.
- Restrict administrative privileges. Most staff don’t need admin rights on their devices. Removing them means that if a user’s account is compromised, the attacker can’t install software, change settings, or move laterally through the network.
- Backup and frequent restoration testing. This is the safety net. Automated, offline, tested backups — not just scheduled ones — so you know you can restore within hours, not days.
The difference between a same-day recovery and a multi-week outage is the difference between continuing to serve clients and shutting down.
A backup you haven’t tested is a hope, not a plan.
The key insight: you don’t need a security team. The Essential 8 doesn’t require a dedicated security team, a security operations centre, or a million-dollar budget. It requires consistent, systematic implementation — and that can be delivered as a managed service, built into the monthly operating costs your organisation already budgets for IT.
Backups are only useful if you can restore them quickly: Differential vs. Incremental Backup: Which Recovers Faster?
Where Do Most NFPs Get Stuck?
The most common pattern we see is an organisation that has some controls in place — maybe MFA for email, maybe backups running — but no systematic approach.
- Patching happens reactively.
- Application control isn’t implemented because someone’s worried it will break an older case management system.
- Admin privileges are broader than they should be because it’s easier that way.
These gaps aren’t failures of will. They’re the result of an overstretched team managing day-to-day break-fix work rather than proactively building resilience.
The organisations that succeed shift from reactive IT to proactive — where cyber security is embedded in how IT is managed, not treated as a separate project.
Start With One Control, Not an Overhaul
If some of this sounds familiar — if you’ve been meaning to address cyber resilience but it’s felt expensive, technical, or like something to deal with after the next grant round — you’re not alone. Many of the organisations we work with felt the same way before they started.
The path forward doesn’t require a complete overhaul overnight. It starts with understanding where you are today, identifying the most impactful controls to implement first, and building from there.
The Essential 8 is designed to be implemented progressively. Each level builds on the one before it.
If this sounds like the situation your organisation is in, get in touch. We can discuss how we help organisations like yours strengthen their resilience — starting with your context, your constraints, and your mission.
Because protecting your mission is what this is really about.
At Planet6, we help Australian not-for-profits build secure, sustainable IT environments. Talk to us about your Essential 8 journey.
FAQs
What is the Essential 8?
The Essential 8 is a set of eight practical cyber security controls from the Australian Signals Directorate that, when implemented consistently, dramatically reduce the likelihood and impact of a cyber incident.
Does my NFP need to reach the highest maturity level?
Most mid-market NFPs sit below Level 1 for several controls. The goal is a consistent, systematic baseline first — Level 1 stops basic, opportunistic attacks, while Level 2 and above addresses sophisticated threats.
Do we need to hire a security team?
No. The Essential 8 doesn’t require a dedicated security team or a security operations centre. It requires consistent, systematic implementation — which can be delivered as a managed service, built into the monthly operating costs your organisation already budgets for IT.
Where should we start?
Start with understanding where you are today, then identify the most impactful controls to implement first. The Essential 8 is designed to be implemented progressively — each level builds on the one before it.