Would your board survive the lawsuit that follows a data breach at your nonprofit? Nonprofit D&O insurance exists to protect individual board members from exactly that kind of personal liability.
Insurers are now scrutinizing an organization’s cybersecurity practices before they’ll extend that board member insurance at all. Here’s what that protection covers and what your board needs to keep it in place.
What D&O Insurance Actually Protects Board Members From
Nonprofit D&O insurance protects individual directors and officers from personal liability connected to decisions they made on the organization’s behalf.
It covers the people who govern the nonprofit, not the nonprofit’s bank account or its technology systems. A typical policy can respond to:
- Breach of fiduciary duty claims, including allegations that a board mismanaged funds or failed in its oversight role
- Employment-related disputes, such as wrongful termination, discrimination, retaliation, or harassment claims brought by staff
- Regulatory investigations tied to governance or fundraising compliance failures
- Donor or stakeholder lawsuits connected to a board decision, even one made in good faith
- Defense costs for board members named personally in a claim, regardless of whether the claim succeeds
Good faith doesn’t automatically protect a board member from a claim. Board member insurance exists because claims don’t require intent, and defending against one can be expensive even when the board did nothing wrong.
Why Insurers Are Asking Harder Cybersecurity Questions Before They’ll Cover a Nonprofit
Cyber risk has become one of the leading drivers of nonprofit D&O exposure, and insurers know it. A data breach spreads past the IT department into a donor trust problem and a governance problem, exactly the territory D&O coverage exists to address.
That overlap is why underwriters are asking nonprofits harder questions before they’ll issue or renew a policy. A January 2026 report from Insurance Business found that 60% of nonprofits have no post-breach response team, and 53% don’t have an incident response plan at all. Multi-factor authentication (MFA) for remote access is still missing in 29% of organizations.
Those numbers explain why insurers have stopped taking an organization’s word for its own readiness. A nonprofit that can document its cybersecurity practices presents a lower, more predictable risk.
Meanwhile, one that can’t is asking an insurer to underwrite an unknown, and insurers price unknowns conservatively when they price them at all.
The Gap: A Legal Issue, Not an IT One
Here’s where most nonprofits lose ground before an insurer even asks a question. D&O coverage gets handled by legal counsel or a broker.
Cybersecurity gets handled, if it gets handled at all, by whoever manages the organization’s technology, and it’s not often that the two conversations happen in the same room.
That disconnect leaves many boards unable to answer basic questions about their own exposure, including:
- Whether MFA is enforced across every system that touches donor or financial data
- Whether the organization has a written, tested incident response plan
- Who currently has access to sensitive records, and whether that access list is still accurate
- Whether cybersecurity policies exist in writing the board has reviewed, as opposed to living in one staff member’s head
- When the organization’s last cybersecurity assessment took place, and what it found
A board doesn’t need to become technical to close that gap. It needs a habit of asking these questions and expecting documented answers, the same way it already expects documented answers about the budget.
What “Insurable” Cybersecurity Practices Look Like in Practice
Insurers are asking for evidence that a handful of foundational practices are in place and documented, a realistic bar most nonprofits can meet without a dedicated security team. In practice, that usually means:
- MFA enforced across the board and staff accounts, instead of just on email
- A written, tested incident response plan the board has seen and approved
- Clear documentation of who has access to donor and beneficiary data, updated as staff and volunteers change
- Regular vulnerability assessments that build a dated record of ongoing diligence over time
- Cybersecurity awareness training for staff, and ideally a briefing for the board itself
A cybersecurity vulnerability assessment is the practical starting point, and it doesn’t take a large technology budget or a dedicated security hire to put these practices in place.
The assessment gives the board a clear, current picture of where the organization’s data lives and who can reach it, turning an assumption into a document an insurer, a funder, an auditor, or a regulator can review directly, the same kind of evidence that strengthens a board member insurance conversation.
That document does double duty. It supports the D&O application and renewal conversation, and it gives the board the oversight record it needs regardless of what an insurer asks for.
Turn Your Cybersecurity Into Insurable Proof
Board members deserve documented proof that their protection holds up when it’s tested. A cybersecurity vulnerability assessment gives your organization exactly that and gives your board a clear, current picture of where the real risk sits.
SecureWon builds these assessments around how your nonprofit runs, using engineers who carry CISA and CISSP certifications, the same standard used to vet security leaders at the enterprise level.
Book a call with SecureWon today to see where your organization’s cyber readiness currently stands and what’s worth doing first.
FAQs
- What does nonprofit D&O insurance cover?
Nonprofit D&O insurance protects individual board members and officers from personal liability tied to decisions made on the organization’s behalf. It typically covers breach of fiduciary duty or mismanagement claims, along with employment-related disputes and the legal defense costs that come with them. - Is nonprofit board insurance the same as cyber insurance?
Nonprofit board insurance and cyber insurance cover different things, and boards that assume one includes the other often discover the gap only after a claim is filed. D&O coverage protects individuals for governance decisions. Cyber insurance covers costs tied to the breach or attack itself, such as recovery, notification, forensic, and legal expenses. - How does cybersecurity affect nonprofit board insurance underwriting or renewal?
Insurers increasingly review an organization’s cybersecurity practices, including MFA and incident response planning, before they’ll underwrite or renew a policy. A nonprofit that can document these practices presents a lower risk profile, which can affect both the availability and the cost of coverage. - What is board member insurance meant to protect?
Board member insurance, another name for D&O coverage, protects an individual’s personal assets from lawsuits connected to decisions made while serving on the board. It applies whether the claim comes from a former employee, a regulator, a donor, or another stakeholder, and it exists because board members can be held personally liable even when they acted in good faith. - Where should a nonprofit board start if it wants to strengthen its position with insurers?
A cybersecurity vulnerability assessment is the practical starting point. It gives the board documented evidence of where the organization’s data lives and who can access it, which is the kind of proof insurers are asking for and the foundation any board member insurance conversation should be built on.
