01Delivered in 1 week
Cyber Insurance Readiness Review
$950
- Review application security questions about MFA, backups, endpoint protection, and staff training.
- Find gaps and provide a plain-language fix list before submission.
For grant-funded nonprofits
Security your funders, insurers, and auditors will accept — sized for nonprofits.
Acceptance is not promised. Insurers, funders, and auditors make their own decisions.
Practical cybersecurity governance for U.S. nonprofits with $1M–$15M annual budgets, federal or state grants (including pass-through funding), and no dedicated security staff.
Steadhold Security · Clear steps for a small team
Who this is for
For executive directors, finance and operations directors, and board treasurers.
U.S. nonprofits with $1M–$15M annual budgets, federal or state grants (including pass-through funding), and no dedicated security staff.
- Cyber-insurance application or renewal
- Funder security questionnaire
- Single-audit finding
- 2 CFR 200.303(e) reasonable-measures question
Three defined scopes
Choose the support that fits this moment.
Clear prices, practical deliverables, and work sized for a nonprofit without dedicated security staff.
02Delivered in 4 weeks
Grant Security Program
$2,800 fixed
- A right-sized written information security program and core policies for access control, data protection, incident response, and vendor management.
- Mapped to CIS Controls IG1 / NIST CSF, with a board-ready one-page summary.
- Documents reasonable cybersecurity measures under 2 CFR 200.303(e); Steadhold Security does not interpret the regulation or determine compliance.
03Up to 4 hours/month
Security Steward Retainer
$900/month
- Asynchronous support for funder and insurer questionnaires, policy upkeep, and vendor reviews.
- Includes an annual staff phishing-awareness session and a quarterly board update.
The work supports documented, reasonable measures. It does not guarantee insurance approval, grant awards, clean audits, or full compliance.
Request a discovery callA focused part-time practice
Governance that respects your team’s time.
Security work should be clear enough to use, and small enough to keep moving alongside the mission.
Work in writing
Delivery is asynchronous, with replies within one business day.
Request a discovery call
Send a request and Steadhold Security will reply about arranging a call. No time slots or time zone are published, and a request is not a booking.
Limited capacity
At most 3 retainers and 1 project at a time.
Free planning aid
Nonprofit Cyber Readiness Checklist
Fifteen questions across insurance, grants, and board basics. Use them to orient your team and identify what to ask next.
Download the 15-question checklist (PDF)No email required. This is not an audit, legal advice, or a compliance determination.
Insurance readiness
- Is MFA used for email, finance tools, and administrator accounts?
- Are important files backed up, and has the team tested a restore?
- What endpoint protection is installed on staff work devices?
- How are staff trained to spot and report suspicious messages?
- Who reviews cyber insurance answers and their supporting records?
Grants & documentation
- Which active grants or pass-through agreements include security questions to confirm?
- Who will ask the grant officer or auditor about award-specific expectations?
- Where are security policies and records stored, and who can find them?
- Do staff know whom to contact if they suspect a security incident?
- Which vendors handle sensitive information, and when were they last reviewed?
Board basics
- Who is responsible for coordinating security decisions?
- Does leadership review security risks and next steps regularly?
- Are incident response steps and key contacts written down?
- Are access rights updated when staff or contractors join or leave?
- When was the last staff security briefing, and who owns the next step?
Good to know
A few straightforward answers.
Questions about an award or insurance coverage belong with the people responsible for those decisions.
What does 2 CFR 200 require?
Ask your grant officer or auditor how the rule applies to your award and organization. Steadhold Security does not interpret regulations or provide legal advice.
Do we need cyber insurance?
That depends on your organization and the coverage available to you. Ask your insurer or broker about your needs and policy terms; Steadhold Security does not make coverage decisions or promise approval.
Can this be paid for with grant funds?
Allowability depends on your award and circumstances. Ask your grant officer or auditor; Steadhold Security does not decide whether a cost is allowable.
Start with the question in front of you
Request a discovery call.
Tell Steadhold Security what your organization is preparing for. You’ll receive a reply within one business day.
Call windows and time zone are not confirmed. This form requests a conversation; it does not book a time.