Ohio Nonprofit Secures Donor Data and Cuts IT Spend 31%

What we walked into

An Ohio human-services nonprofit (annual budget around $9.8M, 34 staff) was running donor data in shared spreadsheets on a single on-premise file server. The server had not been patched in 16 months. Staff laptops had no endpoint protection, no encryption, no remote wipe. Donor data included names, addresses, donation amounts, and grant-recipient PII for around 28,000 individuals. The audit committee had raised the security question; the executive director needed a defensible answer before the next board meeting, while staying inside Microsoft and Google's nonprofit-program eligibility so the cost stayed near zero.

What we did

• Migrated all donor records into Microsoft 365 with Defender for Office 365 — kept the nonprofit's full TechSoup discount eligibility
• Placed the MDR partner that runs at nonprofit-friendly pricing with Microsoft Defender XDR + EDR on every staff endpoint
• Deployed conditional access MFA across email, donor database, and grant-management portal
• Encrypted all 34 staff laptops with BitLocker + remote-wipe via Intune
• Wrote the security posture document the board's audit committee needed; trained staff on phishing recognition (KnowBe4 free nonprofit tier)