Community IT Innovators Nonprofit Technology Topics · Community IT Innovators

Assuaging Fears, Taking Action on Nonprofit Cybersecurity with Jennifer Huftalen

July 11, 2025·22 min·2 clips

Jennifer Huftalen explains why ignoring cybersecurity feels like avoiding the doctor until it's too late.

This episode features host Carolyn Woodard interviewing Jennifer Huftalen, Director of Client Services at Community IT, about cybersecurity anxieties in the nonprofit sector. Huftalen draws on 17 years of experience supporting hundreds of nonprofit clients. The conversation centers on how nonprofits can manage IT and security amid current political and funding pressures. Many organizations express primary stress about uncertain future funding, requesting flexible IT support. Huftalen notes a specific anxiety from organizations feeling "under attack" due to their missions, even if they haven't experienced direct threats. She compares the anxiety to avoiding a doctor's appointment for a lingering ache. The discussion outlines fundamental, consistent security recommendations: securing accounts with multi-factor authentication (MFA), implementing security awareness training, and maintaining reliable data backups. Huftalen emphasizes that these basics haven't changed despite the heightened climate. A key insight is that simply starting a conversation about IT can assuage fears, as the actual threat landscape from criminals remains largely unchanged. The hosts warn against vendors who use fear to sell expensive, comprehensive packages, arguing many essential steps are not costly but require dedicated staff time. They stress that cybersecurity is not a "set and forget" task and requires annual policy reviews. New compliance requirements from funders or cyber insurance are becoming a significant driver for action. The episode covers doxxing, referencing a previous podcast with Shauna Delavue on protecting staff members' personal information online. They mention services exist at various price points to monitor or remove personal data. A memorable analogy frames implementing basic security like going to the gym—unpleasant but far less costly than the "ambulance ride" of a major breach. Huftalen specifically addresses resistance to MFA for busy executives, noting account compromise is the top breach vector and executives are prime targets. The tone is conversational, educational, and reassuring, aiming to demystify IT security for nonprofit leaders. The style is advisory, drawing heavily on direct client experiences and practical metaphors. Nonprofit executives, IT managers, and board members feeling overwhelmed by cybersecurity concerns would find this episode particularly valuable. Listeners seeking highly technical, vendor-specific security deep dives or those unaffected by current sector anxieties might find it less relevant.

As heard by us

Practical cybersecurity guidance for nonprofits, centered on planning, MFA, and follow-through.

Nonprofit cybersecurity is treated here as a set of ordinary decisions, not a specialty purchase. Jennifer Huftalin keeps the focus on basics: make a plan, know which systems hold important data, and put MFA in place before shopping for a larger package.

Read the full review in PlayNext →

Why you'd press play

Need a calmer way to tackle nonprofit cybersecurity?

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Community IT Innovators Nonprofit Technology Topics