Managed IT and Cybersecurity for Nonprofits in Northern Virginia and Washington DC
Donor data kept private, volunteers given only the access they need, and licensing that fits the budget the board approved.
IT and cybersecurity for nonprofits protect donor, client and payment data for organizations that work with less staff and budget than a business of the same size.
This page is for 501(c)(3) charities, foundations, community organizations and associations with a small team, rotating volunteers and no IT department. DistrictConnects manages your accounts, devices, network and backups, helps you use the Microsoft and Google nonprofit programs you qualify for, and gives volunteers access to what they need and nothing more.
- 10+Years of hands-on engineering
- 2025Year Microsoft ended its Business Premium grant for nonprofits
- 1,000Virginia breach notices above which credit bureaus must also be told
What makes nonprofit IT different
Nonprofits handle the same sensitive data as a business, with tighter budgets, more turnover and more people who are not on the payroll.
- Licensing rules change. Microsoft discontinued its Business Premium grant in 2025. The granted Business Basic plan includes only Entra ID Free, so it has no Conditional Access or Intune. Getting Microsoft 365 licensing right decides which security tools you have.
- Eligibility has limits. Microsoft’s eligibility rules and Google’s each exclude some types of organization, including schools and government bodies, and Microsoft excludes trade and professional associations.
- Volunteers come and go. Accounts are created for an event and forgotten after it. Access has to be quick to grant and automatic to remove.
- Personal devices do the work. Volunteers and part-time staff use their own laptops and phones, so the controls have to sit on accounts and data through Zero Trust access, not only on the office network.
- Breach rules apply to you too. Virginia’s breach notification law covers organizations whether for profit or not, and PCI DSS covers anyone handling card data, including donations.
- Grants bring security conditions. Federal award recipients must take reasonable cybersecurity measures to protect sensitive information under 2 CFR 200.303.
Every dollar spent on IT is a dollar not spent on the mission, so we spend it on the controls that protect donors and keep staff working.
Risks we see in this industry
Volunteers who never left the system
Last year's event volunteers and interns still have working accounts, shared passwords and access to the donor list. Nobody owns turning access off, so it stays on until something goes wrong.
Donor lists in the wrong places
Exports from the donor database sitting in email attachments, personal drives and unencrypted spreadsheets on laptops. Names with card or bank details are exactly what breach notification laws cover.
Payment fraud by email
A message that looks like it came from the executive director asks finance to wire a grant payment or buy gift cards, or a vendor's changed bank details arrive mid-invoice. Small finance teams are the target because one person approves and pays.
Licensing that lapsed quietly
Microsoft discontinued its Business Premium grant in 2025, and the licenses expire at renewal. An organization that misses the change can lose device management and security features, or the data of users left without a license.
Cloud data with no backup
The donor CRM, email and shared files live in the cloud, so everyone assumes they are backed up. Deleted records, a ransomware-encrypted sync folder or a former employee's wiped mailbox can still be gone for good.
Donated hardware on a flat network
Laptops of every age, some no longer receiving updates, on the same Wi-Fi as event guests and the office printer. One infected device can reach the file server and every staff computer.
Compliance and insurance requirements
- Federal grant conditions Recipients of federal awards must take reasonable cybersecurity and other measures to safeguard protected personally identifiable information and other information the agency marks as sensitive, under 2 CFR 200.303(e).
- Virginia breach notification The law covers entities for profit or not for profit. A breach of unencrypted names with Social Security, driver's license, passport or financial account numbers means notifying affected residents and the Attorney General without unreasonable delay.
- PCI DSS for donations Card security rules apply to any organization that stores, processes or transmits cardholder data. Hosted donation pages reduce what is in scope, but card readers at events and staff taking card numbers by phone bring part of it back.
Services that matter most
Monitoring, patching, help desk, onboarding
Entra ID, Exchange, SharePoint, Teams
Phishing filtering, DMARC, DKIM, SPF
Immutable backups with tested restores
Secure access without the old VPN
Encrypt, patch and wipe every device
Heat-mapped design, UniFi, Meraki, Aruba
Roadmaps, budgets and vendor decisions
How we start
Free assessment and licensing review
We review accounts, devices, the network, backups and email security, and check which Microsoft 365 or Google Workspace licenses you hold, which nonprofit offers you are eligible for and what expires at your next renewal.
Findings and itemized quote
A plain-English list ranked by risk, with an itemized quote you can take to the board or fit into a grant budget. Monthly support and one-time projects are priced separately, and plans are month to month.
Close the urgent gaps
Old staff and volunteer accounts removed, MFA turned on for everyone, donor exports moved out of inboxes into controlled storage, and a first backup of email, files and the donor database tested.
Right-size the licensing
Staff who handle donor or client data get a plan with device management and Conditional Access. Volunteers get the lighter granted plan or guest access to specific Teams and SharePoint sites, so the budget goes where the risk is.
Set up volunteer access
Zero Trust access lets volunteers reach the files, email or apps their role needs from their own devices, without joining the office network. Access ends on a date you set, not when someone remembers.
Ongoing support and planning
Help desk, patching and network monitoring every month. Each quarter we review licensing, aging hardware and upcoming grants or events, timed so the plan is ready before the budget and the board meeting.
Service area
On-site across Northern Virginia and DC.
Prince William
- Manassas
- Haymarket
Arlington and Alexandria
- Arlington
- Alexandria
DC and Maryland
Common questions
Can you help us with Microsoft's nonprofit program?
Yes. Microsoft offers granted and discounted licenses to organizations with recognized charitable status, such as 501(c)(3) in the US. Since 2025 the main granted plan is Microsoft 365 Business Basic; Business Premium, which adds Intune device management and Conditional Access, is offered at nonprofit pricing instead of as a grant. We confirm your eligibility, move users to the right plans before renewal and set up the security features each plan includes.
What about Google for Nonprofits, and do associations qualify?
Google for Nonprofits covers Google Workspace for Nonprofits, Ad Grants, the YouTube Nonprofit Program and Google Earth and Maps for charitable organizations in good standing. Government bodies, hospitals and schools are not eligible. Microsoft's program excludes professional, commerce and trade associations, so not every association qualifies for both. We check each program's current rules for your organization before you apply, and administer Google Workspace or Microsoft 365 afterward.
How do you secure volunteers using their own devices?
With Zero Trust access instead of a shared password or an open VPN. Each volunteer signs in with their own account and MFA, and reaches only the files, mailbox or app their role needs, from their own laptop or phone, without joining the office network. Guest access to a specific Teams or SharePoint site works for short projects. When the role ends, access ends on the date you set.
How do you protect our donor data?
We find where it lives first: the donor CRM, exports, spreadsheets, email attachments and old laptops. Then we limit who can open it, turn on MFA, encrypt laptops, block risky external sharing and add email filtering against phishing and payment fraud. The donor database, email and files are backed up with restores tested, and retention can run 7 years or longer where grant or audit rules require it.
Do you support our donor database and CRM?
We support everything around them: single sign-on and MFA, user access as staff and volunteers come and go, integration with Microsoft 365 or Google Workspace, the network and devices staff use, and backups of the data. The software vendor supports the application itself, and we work with their support team when a problem sits on their side, so your staff do not have to referee.
We take online donations. Does PCI DSS apply to us?
Usually yes, in a reduced form. PCI DSS applies to any organization that stores, processes or transmits card data. A hosted donation page from your processor keeps most of that off your systems, but card readers at events, card numbers taken by phone or written on forms bring part of it back. We help you confirm your scope, separate card devices on the network and prepare the questionnaire.
Is your pricing predictable enough for a nonprofit budget?
Yes. Managed IT is a monthly fee based on users, devices, locations and the response level in your SLA, so you are not paying surprise hourly bills after something breaks. Projects such as a new network or a move are quoted separately and itemized. We do not publish prices. A free assessment comes first, then a quote you can take to the board, month to month with no long-term contract.