Home Tools Funder & Grant Data Security Readiness Scanner

Would Your Data Practices Pass a Funder’s Security Review?

Answer 8 quick questions about how your organization protects payroll, HR, and grant-funded program data — and get a personalized readiness score with specific steps to prepare for funder due diligence and audits.

Start Your Assessment

Takes about 2 minutes

Do you know whether your major funders or grant agreements include specific data security or cybersecurity requirements?

Since October 2024, OMB’s Uniform Guidance (2 CFR 200.303(e)) requires federal grant recipients and subrecipients to take “reasonable cybersecurity measures” — and private foundations are following suit.

Yes, and we’ve reviewed every active grant agreement for these requirements

Yes, for our largest funders, but we haven’t checked every agreement

We assume some do, but we haven’t confirmed

We’ve never looked into this

Submit press Enter ↵

01 of 08

If a funder asked for evidence of your data security practices during a site visit or audit, what could you produce today?

Funder due-diligence reviews increasingly ask for documented policies, not just verbal assurance.

A documented data security policy, access logs, and recent training records

Some documentation, but it’s scattered across a few people or systems

Mostly informal practices with little written documentation

Nothing formal — we’d be assembling this from scratch

Submit press Enter ↵

02 of 08

How is personally identifiable information (PII) — employee, donor, and program participant data — segmented across your grant-funded programs?

Multi-program nonprofits often mix restricted-fund data in ways that don’t match what each funder actually authorized.

Each program or grant has defined access controls limiting who can see whose data

Access is mostly informal, but overlaps are rare

Most staff can see data across programs regardless of funding source

We don’t have a clear picture of who can access what across programs

Submit press Enter ↵

03 of 08

Does your payroll and HR system require multi-factor authentication (MFA) to log in?

MFA is one of the specific safeguards named in OMB’s 2024 cybersecurity guidance for grant recipients.

Yes — MFA is required for every user

It’s available but not required for everyone

No, we just use passwords

I’m not sure what our login setup requires

Submit press Enter ↵

04 of 08

If a subgrantee, fiscal sponsor, or program partner requested access to shared payroll or HR data, how would that access be managed?

Collaboratives, fiscal sponsorships, and pass-through grants are common in the nonprofit sector — and each one is a data-sharing relationship that needs its own controls.

Formal data-sharing agreement with time-limited, role-based access

Case-by-case access, generally reviewed but not formally documented

Shared logins or broad access granted informally

We’ve never had to think this through

Submit press Enter ↵

05 of 08

Does your organization have a documented incident response plan for a payroll or HR data breach — including funder and donor notification steps?

Many grant agreements now specify a notification window if a breach affects grant-funded data or personnel.

Yes, documented and reviewed within the past year

Yes, but it hasn’t been updated or tested recently

We have an informal understanding but nothing written

No plan exists

Submit press Enter ↵

06 of 08

Have staff who manage payroll, HR, or grant reporting been trained on funder-facing data security expectations?

This includes knowing what a funder site visit, compliance review, or audit is likely to ask for.

Yes — annual training tied to compliance requirements

Covered generally, but not tied to funder-specific expectations

No formal training, but staff are generally careful

Never addressed

Submit press Enter ↵

07 of 08

When was the last time your organization reviewed who has access to payroll and HR systems across all active grants and programs?

Access permissions tend to drift as grants end, staff roles change, and seasonal or project-based positions turn over.

Within the last 6 months

Within the past year

Over a year ago

Never formally reviewed

See My Results press Enter ↵

08 of 08

Would Your Data Practices Pass a Funder’s Security Review?

Do you know whether your major funders or grant agreements include specific data security or cybersecurity requirements?

If a funder asked for evidence of your data security practices during a site visit or audit, what could you produce today?

How is personally identifiable information (PII) — employee, donor, and program participant data — segmented across your grant-funded programs?

Does your payroll and HR system require multi-factor authentication (MFA) to log in?

If a subgrantee, fiscal sponsor, or program partner requested access to shared payroll or HR data, how would that access be managed?

Does your organization have a documented incident response plan for a payroll or HR data breach — including funder and donor notification steps?

Have staff who manage payroll, HR, or grant reporting been trained on funder-facing data security expectations?

When was the last time your organization reviewed who has access to payroll and HR systems across all active grants and programs?

Unlock and View Your Custom Action Plan

Unlock and View Your
Custom Action Plan