Association Data Security: A 90-Day Plan for Small Teams

On a Friday afternoon, the treasurer of a 600-member regional association gets an email that appears to come from the board president. The president is "at a conference," needs a $4,800 payment sent to a new vendor today and can't take calls. The treasurer almost pays it. The only thing that stops the transfer is a rule the board adopted last year: any change to payment details gets confirmed by phone, using a number already on file.

That's what association data security looks like in practice. It's less about expensive technology and more about a handful of habits: know what data you hold, limit who can touch it, protect every account with multi-factor authentication, keep devices updated, vet your vendors, back up and test restores, keep card data out of your hands, plan for incidents and train the people who do the work, including volunteers.

This guide turns those habits into steps a small staff or volunteer board can finish in about 90 days. It draws on free US government guidance, including NIST's Small Business Quick-Start Guide to the Cybersecurity Framework 2.0, which NIST says can also help other small organizations such as nonprofits, and CISA's cyber guidance for small businesses. It isn't legal advice; where laws vary by state, we point you to the right source.

Why Associations Are Targets

Associations hold more sensitive data than many people realize, and they often protect it with less structure than a business would.

• Volunteer turnover. Treasurers, membership chairs and committee leads change every year or two, and access often stays with the old officer.
• Shared logins. One email account or one password for the membership system, passed around in a spreadsheet.
• Personal devices. Exports of the member list on a volunteer's home laptop or phone.
• Trusted relationships. Members and vendors expect emails from leadership, which makes impersonation easy.
• Money movement. Dues, event fees, sponsorships and grants create regular payments that criminals try to redirect.

That last point isn't hypothetical. The FBI's 2025 Internet Crime Report lists 24,768 complaints of business email compromise in 2025, with reported losses of more than $3 billion. Business email compromise is exactly the scam in the opening scenario: a fake or hijacked email account asks for a payment or a change of bank details.

Step 1: Take Inventory and Collect Less

You can't protect data you don't know you have. Start with a one-page inventory, then delete what you don't need.

What associations typically hold

A simple inventory template

DATA INVENTORY (one row per system or file)

System or location:      e.g., Membership system / Treasurer's laptop / Shared drive
What data it holds:      e.g., member contact details, dues history
Who owns it:             one named person
Who has access:          list roles, not just names
How it's protected:      MFA? encrypted? shared password?
Retention rule:          e.g., delete event health info 30 days after the event
Vendor (if any):         name of provider and contract end date
Last reviewed:           date

The Federal Trade Commission's guide Protecting Personal Information: A Guide for Business frames this as "take stock" and "scale down": know what you have, and keep only what you have a legitimate need for, for only as long as you need it. When you delete, do it properly. Shred paper and wipe old computers and drives rather than just deleting files.

Step 2: Control Access and Turn On Multi-Factor Authentication

Give everyone their own login

Shared accounts make it impossible to know who did what and nearly impossible to remove one person's access. Every staff member and volunteer who needs a system gets their own named account.

Grant access by role

Decide what each role needs, then assign roles rather than one-off permissions.

Our member database guide includes a quarterly access review you can adopt as is. In campai, administrators can bundle permissions into roles, restrict reading, editing and deleting by area, and check a permission preview before handing over access.

Turn on multi-factor authentication everywhere it matters

Multi-factor authentication (MFA) asks for a second proof, such as a code from an app or a security key, in addition to a password. CISA recommends requiring MFA through technical settings rather than leaving enrollment up to each person, enabling it for all administrator accounts, and preferring phishing-resistant FIDO-based methods, such as security keys or passkeys, where available.

Turn it on in this order:

1. Email accounts, especially leadership and finance.
2. Bank and payment provider accounts.
3. Your membership and accounting systems.
4. Your domain registrar and website host.
5. Social media accounts.
6. Shared drives and file storage.

Offboard on a schedule

Tie access changes to your governance calendar. Within a week after each annual election or officer change, remove access for outgoing officers, transfer ownership of files and accounts, and give incoming officers their roles. Do the same within 48 hours when a staff member or contractor leaves.

Step 3: Passwords That Actually Work

Most password policies fail because they make life hard and people work around them. Keep it simple:

• Long and unique. Use a passphrase of several random words for each account, never reused across sites.
• Use a password manager. It generates and stores strong passwords. Use an organizational plan with shared vaults so the treasurer's banking login doesn't live in someone's personal account.
• No password spreadsheets or sticky notes. If one exists today, move its contents into the password manager and delete it.
• Change passwords after a suspected compromise, and whenever someone with access leaves.
• Never share passwords by email or text. Share access through the password manager or by creating a separate account.

Step 4: Secure Devices and Email

Devices

• Turn on automatic updates for operating systems, browsers and apps. CISA advises prioritizing fixes for vulnerabilities that are known to be exploited.
• Turn on full-disk encryption on Windows and Mac laptops and a passcode on phones.
• Set screens to lock after a few minutes.
• Remove administrator rights from everyday user accounts.
• Work inside your membership system rather than downloading exports. If you must export, delete the file when you're done.
• Wipe devices before you sell, donate or recycle them.

Volunteers will use personal devices. Instead of banning that, set minimum rules: a passcode, current updates, no member exports stored locally, and MFA on the accounts they use for your organization.

Email and payment fraud

Business email compromise succeeds because it looks routine. Build these rules into your financial procedures:

• Verify changes by phone. Any request to change bank details or pay a new vendor is confirmed by calling a number already on file, never one from the email.
• Two people for larger payments. Require a second approver for payments over a set amount, for example $1,000.
• Separate duties. The person who approves a payment shouldn't also reconcile the bank statement.
• Slow down on urgency. "Urgent," "confidential" and "I can't talk right now" are warning signs, not reasons to rush.

The FBI's Internet Crime Complaint Center advises verifying payment and purchase requests outside of email, using a known phone number. If money has already been sent, contact your bank immediately and report the incident at ic3.gov.

Step 5: Vet Vendors and Integrations

Your membership system, email platform, payment provider, website host and event tools all hold member data. Their security becomes yours.

Review integrations too. Every connected app and API key is a door. Remove integrations you no longer use, give each one the narrowest access it needs, and revoke keys when a volunteer developer moves on. If staff want to use AI tools with member data, set rules first; our guide to an AI governance policy shows how.

Step 6: Back Up and Test Restores

A backup you've never restored is a hope, not a plan. CISA recommends scheduled backups and regular tests of both partial and full restores, with a written restoration plan.

A common rule of thumb is to keep three copies of important data on two different types of storage, with one copy offline or off-site. For cloud services, that usually means your vendor's backups plus a regular export stored somewhere the vendor account can't reach.

Step 7: Keep Payment Card Data Out of Your Hands

The PCI Security Standards Council says its data security standard applies to all entities that store, process or transmit cardholder data, regardless of size, and that the payment brands, usually through your acquiring bank, decide how you validate compliance. The simplest way to keep that work small is to never handle card data yourself.

• Use your payment provider's hosted payment pages or embedded payment fields so card numbers go straight to the provider.
• Never accept card numbers by email, text, voicemail or paper forms you keep. If a member reads their card number over the phone, enter it directly into your provider's secure system and don't write it down.
• If you still use paper forms with card fields, redesign them. If you must keep a paper process for now, process the payment promptly and shred the card details.
• Ask your payment provider which self-assessment questionnaire applies to you and complete it each year if required.

Our guide to nonprofit payment processing compares how to set up online payments for dues, events and donations.

Step 8: Plan for Incidents

Something will go wrong eventually: a phished email account, a lost laptop, a misdirected spreadsheet. A one-page plan turns panic into a checklist.

What the plan covers

• Who leads. One named incident lead and a backup, usually the executive director or president.
• Who to call. IT help, your cyber insurer if you have one, an attorney, your bank and payment provider, and key vendors. Keep this list offline as well.
• First steps. The FTC's data breach response guide advises moving quickly to stop further data loss, isolating affected equipment, preserving evidence, changing credentials and fixing the vulnerability that caused the breach.
• Notification. The same FTC guide notes that all states, the District of Columbia, Puerto Rico and the Virgin Islands have laws requiring notification of security breaches involving personal information. Who must be notified, when and how depends on the state and the type of data, so involve an attorney early.
• Reporting. Report cybercrime to the FBI's Internet Crime Complaint Center at ic3.gov. You can also report incidents to CISA, the federal Cybersecurity and Infrastructure Security Agency, to request help or share information.
• Communication. Decide who speaks to members, staff and the media. Our crisis communication plan guide covers message templates and timing.

First-hour card

If you suspect a security incident:

1. Don't delete anything and don't turn the device off.
2. Disconnect the affected device from Wi-Fi and the network.
3. Call the incident lead: Jordan Ellis, (555) 018-3341. Backup: Priya Nair, (555) 018-7720.
4. Write down what happened, when, and what you clicked or sent.
5. If money was sent, call the bank immediately.
6. Don't email members about it until the incident lead approves the message.

Print it, add it to your volunteer handbook and review it once a year in a 30-minute tabletop exercise: walk through a scenario such as "the membership chair's email account was hijacked and sent a fake renewal link to 600 members."

Step 9: Train Staff and Volunteers

Most incidents start with a person, not a machine. Training doesn't need to be long, but it needs to happen for everyone who touches data, including board members.

Make reporting easy and blame-free. A volunteer who clicks a bad link and reports it within five minutes has done the right thing. Data oversight is part of the board's duty of care; our guide to nonprofit board responsibilities explains how it fits with other governance duties.

A 90-Day Security Plan

After the first 90 days, repeat the access review quarterly, the restore test twice a year and the training yearly.

Frequently Asked Questions

What data security laws apply to associations?

There is no single federal data security law for associations. Common obligations include state breach notification laws, the payment card industry standard if you accept cards, and rules tied to specific data, such as health or children's information. Requirements vary by state and activity, so ask an attorney to review your situation.

Do we have to notify members after a data breach?

Possibly. All states, plus the District of Columbia, Puerto Rico and the Virgin Islands, have breach notification laws, and whether they apply depends on the type of data, the state where affected people live and the circumstances. Contact an attorney as soon as you suspect a breach.

Is multi-factor authentication really necessary for a small club?

Yes. Email and banking accounts are the most common targets, and a stolen password alone is enough to take them over without MFA. Turning it on takes minutes and costs nothing on most services.

How long should we keep member data?

Only as long as you need it for a clear purpose, plus any period required by law or your accounting rules. Set a written retention rule for each type of data, for example deleting event health information 30 days after the event, and check record-keeping requirements with your accountant.

Can volunteers use their personal laptops?

Usually yes, with minimum rules: a passcode, current updates, MFA on organizational accounts, and no member exports stored on the device. Working inside your membership system rather than downloading lists removes most of the risk.

Do we need cyber insurance?

It depends on your size, your data and your budget. Talk with your insurance broker about what a policy covers, such as incident response costs or funds lost to fraud, and what security measures the insurer requires.

Next Steps

1. This week: turn on MFA for leadership and finance email accounts and your bank.
2. This month: complete the data inventory, delete stray member exports and adopt the phone-verification rule for payment changes.
3. This quarter: work through the 90-day plan, test a restore and run a 30-minute tabletop exercise with your board.
4. Every year: repeat training, review vendors and report on security at a board meeting.

Data security also gets easier when member data lives in one system instead of a dozen spreadsheets. Our guides to the membership portal and donor data hygiene show how consolidating records reduces copies, mistakes and risk.