5 Project Management Tools For Non-Project Managers & Cybersecurity On A Shoestring & Make Confident Tech Decisions

Tony Martignetti
Hello and welcome to Tony Martignetti Nonprofit Radio, big nonprofit ideas for the other 95%. I'm your aptly named host and the podfather of your favorite hebdomadal podcast. I have to apologize for the audio today in our 2nd and 3rd conversations. Consistent with the lackluster host that you know you suffer with, he— I failed to plug in the microphones to my phone for these 2 conversations. You see, at NTC, of course, I got all my remote gear. We've got 4 microphones set up, one for me and one for— and 3 for the panelists, the guests. And those mics go into the mixing board, and the mixing board plugs into the phone because my phone is where my recording app is. I use an app called Hindenburg. Well, for these 2 conversations, I didn't realize that I had not plugged my phone in. Oh, no. from the mixing board. So the sound you're going to hear in those 2 is just my phone picking up voices along with all the ambient noise. So the phone, of course, is sitting in front of me. So I'm loud and clear in these last 2 conversations today, but the guests are a little quiet and there's ambient noise. And I did the very best I could to strip out the— Noise. ambient noise as much as possible without reducing the guest voices. And I tried to elevate the guest voices, make them as clear as possible. But my apologies for the audio quality on the last 2 of today's conversations. But nonetheless, I'm glad you're with us because I'd be hit with stomatalgia If I had to say the words, you missed this week's show. Here's our associate producer Kate to tell us what's going on.

Kate Martignetti
Hey Tony, I'm on it. We wrap up our coverage of the 2026 Nonprofit Technology Conference with 3 conversations. First, 5 project management tools for non-project managers. From project charter to closing report, Adrienne Figus walks you through the essential tools to help you take control of the changes you may find yourself leading. She is with Madison College. Then, Cybersecurity on a Shoestring. Our panel covers 10 essential security measures every nonprofit can implement right now without an IT team and without breaking the bank. From knowing where your data is to changing default configurations, and from firewalls to offboarding data. They are Edward Wilson at ArchTech and Ellen Samuel from Just-Tech. Finally, make confident tech decisions. Simone Carvalho and Rebecca Kaplan explain when you need an audit of your tech stack. And the steps to conduct the assessment. Along the way, you'll lean on surveys, interviews, and process maps. Simone is with Skeleton Key Strategies, and Rebecca is at Feeding America. On Tony's Take 2.

Tony Martignetti
Thank you, N10.

Kate Martignetti
We are sponsored by the Bridge Conference. Tony will be with more than 2,400 nonprofit professionals at Bridge, July 29th to 31st in National Harbor, Maryland. Info and registration at bridgeconf.org. Here is 5 Project Management Tools for Non-Project Managers.

Tony Martignetti
Welcome back to Tony Martignetti Nonprofit Radio coverage of the 2026 Nonprofit Technology Conference. My guest now is Adrienne Figus, project manager at Madison College. Adrienne's topic is 5 project management tools you need, especially if you're not a project manager. Welcome to Nonprofit Radio, Adrienne.

Adrienne Figus
Nice to meet you, Tony. Thanks for having me.

Tony Martignetti
It's a pleasure. I love this topic, project management, something we haven't spoken about on the show for a long time. Could you give us a high-level view before we get into some detail?

Adrienne Figus
Sure. So this session grows out of what I wish that I had had handed to me when I was first becoming aware of project management as a discipline and the challenges of projects generally before I became a project manager. And a lot of that was handed to me, you know, here at the NTC over the years, many years ago. Yeah. And so this is— I'm here to try to give back and see, can I help at least a little bit with people who are dealing with massive projects without a specific project management background and try to increase the overall culture for project management in our nonprofit community.

Tony Martignetti
All right, thank you. So let's dive in. You have, um, you have 5, 5 step— not 5 projects, 5 tools, 5 tools that you are, you're giving back to the community. I love that. I admire that. Thank you. Thank you. I'm, I consider myself a member of the community. I'm, I'm not involved at all in project management. I have a one-person company, so my projects are Modest by scale and in terms of yours, in comparison with yours, but I can still say thanks for giving back to the community. That's awesome. Awesome.

Adrienne Figus
You're very welcome, and thank you for the same. You know, I think you clearly give a lot back to this community too, and it's really what we're all here for, here to do at NDC.

Tony Martignetti
You're right. We're all contributing. Yeah. All right. First, before we get into the 5, let's define what you mean by a project.

Adrienne Figus
The technical, formal definition of a project is a temporary endeavor that creates something new. So that is as opposed to operations, which is the ongoing work that makes up, you know, what we actually are doing regularly on a regular basis. But those things flow together, you know, and there's overlap in a lot of cases, especially in smaller, you know, organizations like, you know, yourself, a solo shop, or small organizations that don't have a formal culture of project management. Right. But I think that core of it's a new thing we've never done, so we don't already have a playbook for it, and it's a temporary thing that at some point we will hopefully succeed and be done with it, or it will shift and become our operations ongoing. And so project management are those tools that help us with that newness and temporariness to then hand over to A related but different set of skills for optimizing the operations.

Tony Martignetti
Okay. Is it necessarily a tech-related, a tech project? I mean, could it be a capital project? Could these tools apply to that kind of project?

Adrienne Figus
Absolutely. These tools are project type agnostic. Most of the projects that I manage have something to do with tech. I work as a project manager in an enterprise project management office in a college, and we rest inside the tech department. Just by virtue of that, there's usually tech involved, but we're also doing organizational change projects. Okay. We're doing, you know, things that maybe only incidentally have tech. And a lot of what I've learned about project management, especially through the NTC, goes back to work that I have done in my previous career in fundraising. So a fundraising appeal can be a project because it's, you know, that appeal itself is a new thing that will end. It goes into your operational flow of projects. So really anything. Um, tech is, is just the, the hook here.

Tony Martignetti
Well, that's our— yeah, that's our medium here. Yeah. Okay, cool. Yeah. Um, so let's go into the tools. What, uh, what are they?

Adrienne Figus
All right, so the 5 tools that I brought, you know, they're, they're by no means the only tool. You talk to a project manager, there's hundreds. But the 5 that I think are, are a good head start for people who, you know, have, have not done this before and might apply to basically any project are the project charter, the stakeholder register, the communication plan, the meeting agenda, and the closing report. And do you want me to go into reasons why I chose those?

Tony Martignetti
Yes, but would you say them one more time for me?

Adrienne Figus
Absolutely. The project charter, the stakeholder register, the communication plan, meeting agenda, And a closing report.

Tony Martignetti
Okay. Yeah, so let's start with the project charter.

Adrienne Figus
Sure. So the project charter is a document, you know, it can take a lot of forms. It's less common in organizations that don't have formal project management, but you can do it in a really lightweight way. It's essentially a contract that sets out the basic terms of what are we doing, why are we doing it, who has given us the authority, What kind of resources do we have, both financial and people and time? And how will we know that we did it correctly?

Tony Martignetti
Okay, so like scope, like a scope of work?

Adrienne Figus
Yep, it includes the scope of work. It includes the mission and vision of the project. It includes, you know, the scope of work also crucially includes what's out of scope. What are we not going to do? And it also pulls together who is in the project team, who's in the governance, who's responsible for the project.

Tony Martignetti
Budgeting as well is in here. Scope is going to impact budget. Absolutely. Obviously, clearly. Okay. All right, anything else on the, on the charter? I don't want to go through them too fast. I don't want you to give short shrift to Nonprofit Radio listeners. No, I can tell you're not doing that.

Adrienne Figus
So the charter is one that's really easy to skip because it seems intimidating, especially if you don't have a project management office or you're not a project manager. But even just a single one page that says This is who said it's okay to go ahead with this project. This is what we're doing. This is what we're not doing. And, you know, we have budget. It came from this department or whatever. Taking the time at the start of the project to have those discussions, to identify, so you don't get 6 months into the project and realize, ooh, turns out no one actually gave us permission for this, and now we're getting a lot of pushback. Yeah.

Tony Martignetti
Or who's responsible, or we're not clear what the budget is. Yeah, I can see. I mean, like a lot of things. The preparation and the planning are valuable even though they're a time suck, but they're going to pay off in ways that you may never even learn through the remaining 4 tools.

Adrienne Figus
Exactly.

Tony Martignetti
You're going to get creep and accountability and authority issues and things like that that you're going to avoid if you're intentional at the beginning. At the outset. Okay.

Adrienne Figus
I got an interesting question from one of the participants who was describing a situation where she's, you know, new to a department in her org and is being tasked with picking up a project that has gone adrift because there was a lot of staff turnover. The people who were on it are no longer there. There's uncertainty of what was done. Things are in some abandoned Asana boards, and she was asking about what to do to move forward. I really think that taking some time to write a new project charter and say, like, this is maybe the phase 2 of this project, we're starting over again, we're acknowledging what was done, but we're not going to be bound by, like, a contract that was maybe implicitly created, even if it wasn't written down, by people who aren't there anymore to carry out the terms of the contract. But that's a proxy for the conversations that have to be had anyway, and it's the, the charter is a holder for that.

Tony Martignetti
Okay. And then the register.

Adrienne Figus
The stakeholder register. So, you know, projects like operational work or anything else we do in nonprofits are actually all about people. You know, nothing is going to happen. AI is not there yet. I don't think it ever will be, but that's not our topic. Right. Anything you do in a project involves people, and the lingo in project management for people is stakeholders. The formal definition of that is basically anyone who will be affected by your project's outcomes or, you know, the, the work it takes to do the project. Anyone who can affect the project, either affect the outcomes or affect the way that the project works. And anyone who can get in the way of the project or enable the project to move forward.

Tony Martignetti
Oh, like potential risks.

Adrienne Figus
Exactly. So some of your stakeholders are people who may be threats, but also may be your greatest allies later. So the stakeholder register is really just a list of all those people. And I've provided a template that is, you know, it's a simple Google Sheet that gives you some ideas of things that you want to know about those people in order to get them to contribute as best they can to the project, hold yourself accountable to checking in with them, and if they are people who may present threats or be, you know, a potential challenge for your project, how to activate them and turn them into champions and assets for your project. But it all comes down to, in the first place, you have to know who they are. And that's what the stakeholder register is all about.

Tony Martignetti
Okay. Okay. Yeah, the folks who are going to be impacted by the project, I mean, I hope they have influence in the project too.

Adrienne Figus
They absolutely should.

Tony Martignetti
It's not foisted on them and assuring, you know, non-use.

Adrienne Figus
And that's one of the things that is absolutely the responsibility of the project manager. It's also the responsibility of everyone else in the project. But I see an important role of the project manager as being the communications hub for the project, the person who anyone can come to me and say, oh, well, there's this project going on. Adrienne's involved. I'll just ask her what's going on. And then I give them all that information, even if I already emailed them 3 times. I'm always happy to tell you again because the fact that you asked me matters. But I'm also accountable. You know, if I had Tony on my list of users who's going to be affected by this change, I have to proactively reach out to you to understand, you know, if you're, if you're a core user, to understand what your needs are, explain to you how things are going to be changing. But even if, you know, you're my user but you're not in my org, you know, like I don't know you, I have to understand as much as I can about you to be sensitive to that. And so sometimes you might be on my list of stakeholders, you don't even know the project is happening, but it matters to me that it happens in a way that works for you. Yeah. So all of these things, again, it just comes back to knowing who we're thinking about in these projects. I

Tony Martignetti
can see that's an important part of your work because you're at a big university, well, college, whatever, but big organization. I mean, big enough that it has a project management team that you're on. So you don't know a lot of the people unless you've made projects with them before. But throughout the college, you may not know a lot of the stakeholders. Because you work in a project management team serving the whole college. So getting to know folks, getting their buy-in, I mean, I would think that's a big part of your work as a project management expert team member.

Adrienne Figus
Absolutely. Anytime I'm starting up a new project, I'm just about 2 years into my current role, so I'm just now starting to get my feet under me and understanding where all the offices are. And when people use acronyms, I think I know what that is. At this point now, I'm starting new projects that involve people that I knew before, but it's still my first task to say, okay, what are all the offices and people that are going to be involved? What are the groups of students that might be affected or faculty, sometimes community members outside the college? Some of those, it's groups, you know, so maybe it's all of the students in one, you know, area of the academic area, or sometimes it's all of the staff members in, you know, the library. Right. And so I have that group, but then I start dialing in and saying, how do I learn more about that group as individuals? And then when I have actual individuals, how do I use the networking tools that I have available to me inside the organization to say, hey, like, I haven't met Mike before. What can you tell me about him? How do I, how do I talk to him in a way that makes sense to him? And then introduce myself as, as the project manager and help them see how they can interact. Yeah. Because you never want a project to get too far along and end up being a surprise to somebody who needs to actually be involved.

Tony Martignetti
Yeah, that's poor. That's the antithesis of smart project management. Number 3 is your communications plan. All right, so how are we going to keep in touch with all these stakeholders that we identified in the register?

Adrienne Figus
Absolutely. They go hand in hand. Personally, I actually like to use a single spreadsheet with multiple tabs, one for my stakeholder register and one for my communication plan, so I can just tab back and forth and see, okay, for each of these stakeholders, some of them individuals, sometimes groups, those are audiences that I need to communicate with. What can I put on the communication plan as far as one-on-one conversations or, you know, roadshow presentations or, you know, email blasts or however I can communicate? But then as I'm writing out the communication plan, I think of other things that I might wish to communicate and think about the audience. And then if that audience isn't in the stakeholder register, I scurry back over to that tab and add new lines. Both of those are living documents that keep going through the whole course of the project. As I learn more about the project, I learn more about the needs and the people and build it together. And then next time I do a project that's similar, I can go back and sort of take some of that information and start. Great. Okay.

Tony Martignetti
Go ahead with number 4, our agenda.

Adrienne Figus
Meeting agenda. So this one is—

Tony Martignetti
A meeting agenda.

Adrienne Figus
Meeting agenda. Yeah, it's the simplest one. I don't belabor it in my presentation, but it's so important and something that is so easy to ignore. I'm not an anti-meetings person. You know, I think that meetings are an important communication tool. I put them on my communication plan. You know, Sometimes a week-long email chain could have been a meeting. But it's sort of a sacred trust to ask people to come to a meeting. You're asking them for their time. You're asking them to put themselves out there and hopefully feel that they're actually contributing, in this case, to the project. And part of that is the agenda. You need to have a goal for the meeting. You need to understand who's invited, who of your stakeholders are invited. You need to understand what are you attempting to discuss, accomplish, what decisions do you need? But also, you need everyone who's coming to the meeting to have access to that information up front. If I just call, you know, you and Amy and 3 other people into a meeting, but I don't tell you what's happening, you're coming in puzzled, annoyed with me, not ready to engage. You might just, like, say no at the last minute. But if I send out the agenda and say, like, here is the importance of this meeting, here's why you, Tony, are coming, and if you can't come, I need you to delegate somebody from your team because we need this decision. Sharing that information up front helps to level the playing field, make sure we have everybody in line, and really get value from that meeting.

Tony Martignetti
What kind of meeting cadence do we need?

Adrienne Figus
That varies by project.

Tony Martignetti
Suppose we have like an 18-month project.

Adrienne Figus
That's something that I like to negotiate with each project. Very commonly, I'll have a core team that's usually like, you know, between 4 and 6 people who are steering the project and maybe, you know, they're doing hands-on tech work, and I'll do a weekly check-in with them. And, you know, it'll be sometimes a half hour just to say, here's what we're doing, which we're ready to cancel if nothing new has happened. And so that's a big part of the agenda is like check in a few days beforehand. Can we cancel this or do an asynchronous check-in? Then I like to do sometimes like either biweekly or monthly meeting with more of a steering committee. That are people that have decision-making authority or who are very concerned stakeholders, but maybe not doing the actual work of the project. And then I'll often, especially in a longer project like an 18-month or a 2-year project, I'll have sub-areas within where we'll have, you know, meetings once a week for 2 months for a sub-team that's working on something really heavily in that 2 months, but it's only the people that are actually doing that heavy work. Like, I had a project where we were doing some compliance regulatory changes that needed some technical updates, but also needed quite a bit of information sharing and communication to bring the whole college community along, because it involved some somewhat significant business process changes to meet our new state regulations. So we had a communications subproject that involved doing a lot of website updates because, you know, for a large institution, getting all the approvals to update the website and just the mechanical work of that is a lot. So we had a little communications strike team of 3 people and we were meeting once a month— or sorry, once a week for a short period of time while the overall project team was meeting at a different cadence.

Tony Martignetti
Okay.

Adrienne Figus
So it's a— that's part of setting up the agenda is if it's a recurring meeting, getting everyone to agree on the cadence. And then revisiting that. I also like to revisit a meeting cadence about every 6 months and say, or in higher ed, I'll do it on a semester basis. Like, so, you know, for spring semester we met this regularly. Do we need to do that for the summer?

Tony Martignetti
And on our closing report.

Adrienne Figus
So the closing report, you know, it brings us back to that definition of a project that by definition it's a temporary endeavor. That means it has to end. This is a thing that really trips a lot of us up, especially those of us Currently, I work in a place that has very defined policies around closing projects for budgetary reasons. But at my previous roles, it was very common, and I know a lot of people that this is very common, that a project will just keep going. Maybe you weren't able to accomplish what you thought you were going to, or you had some staff turnover and no one's quite sure what's happening, or a grant got pulled so you had to put it on the back burner, but you didn't actually close it. 'Cause maybe that's admitting defeat or you're not quite ready to declare victory and it's just there. Mm-hmm. And then it becomes a major, you know, psychic and time weight on everyone who was involved with it. 'Cause even if you're not working on it day to day, it's in the back of your brain and you remember, oh yeah, you know, that refresh on the website that we decided not to do, I'm still gonna think about it every couple of weeks. And so having a way to close a project, by, you know, policy and will of your organization, but also a practice and a template to do that. Whether it's because you finished the project successfully and you're going to celebrate it, it's wonderful, or we're acknowledging, you know what, having this project open no longer meets our needs, so we're going to just close it down and we'll have lessons learned. No blame. It's just, it's okay. Having a template ready to go that you know at the start of the project, you know, would help you sort of write your charter to say, how will we know that we're done? Preparing yourself to then close it, I think, can help lessen that pressure of just having these projects that just don't stop.

Tony Martignetti
It's a boundary. We know this is completed. Good, hopefully not bad. Let's say just good or indifferent. It's wrapped up. We're all moving on. Okay.

Adrienne Figus
Absolutely. And then the report itself can live in your organizational files. If you have a PMO, it lives in your PMO. Project PMO? Sorry, Project Management Organization. And that's the group that I work in. But there are organizations that have what they call a PMO, but it's just one person who holds all the templates and the records. That can be a PMO. But your way of doing projects, and maybe it's just a file in your OneDrive, But if you have those records of all these past projects, then when you do a new project and you're going to charter a new project that's somewhat similar, pull out the closing report from the old ones that were similar and say, what did we learn on this project about how we operate, things we did that ended up not being productive for us, things that were really great? You know, and that will make your next charter and your next set of meetings and everything else much easier and better for the next time.

Tony Martignetti
Where do we document changes, process changes, maybe staff changes that have been made. We've been doing it this way at the college for many, many years, and now that our project has closed, business processes have changed. Maybe reporting responsibility, or who's responsible for different things that change. Where do we document all these organizational changes?

Adrienne Figus
Oh, that's a really good point. So that's part of the closing report, is acknowledging that you did the handover to operations. And so the closing report should document the decisions that you made, the changes that you made, but just because it's in the closing report of a project doesn't mean it actually happened, I think is what you're implying or alluding to. Sure. And so that's where the, like, project shaking hands with operations really comes in, is you're saying, okay, this project made this happen, but then Some team, you know, some operational team or department or person has to take responsibility for that. So you can't actually close the project until you've done the handover. So, you know, oh, I, you know, did this project where I, you know, helped you implement your new scheduling system for your podcast guests. Until I hand it over and you say, okay, I acknowledge that I have this new process and it's in my area, I can't say my project is done. Do we have a ceremony?

Tony Martignetti
Is there a ribbon cutting? I mean, if it's a physical project, but still, even so, that's ceremony. That's not operational continuation.

Adrienne Figus
Yeah, so you can have— I highly recommend having, you know, some sort of a ceremony to close the project, a final meeting or a pizza party or something, but that sort of that handover of the new I like the idea of it having to be some sort of a pomp or circumstance to make it happen, but the recording of the new policies should be done in whatever way you are recording your policies. So like, however you had it written before, you change and put it in. Now, if the project was to set up a change and tracking system for your things, then you'll have it.

Tony Martignetti
Yeah. Okay. Interesting. All right. What else, what else did you talk about in your session? that we haven't talked about with our listeners?

Adrienne Figus
So one of the things, and, and, you know, I can share with you the link to the templates. Um,

Tony Martignetti
yeah, actually, would you do that? You email me the, the link.

Adrienne Figus
Yeah.

Tony Martignetti
And then I'll include it in the show notes.

Adrienne Figus
Absolutely, I can do that. And, and I really encourage anyone to, to take a look. They're all, um, you know, the just Google Docs and Google Sheets. Anybody can download them, brand them yourself, use them, you know, fully free. I have a little CC BY license on it, but really I assume you're going to be changing them enough that it's your own work if you use it. So it's my interest to get it out there. But in each of those areas, as people who work in nonprofits and mission-based institutions, I think each of these tools is an opportunity for us to like express and forward our values. Um, so in the project charter, you should be Writing your project vision or project mission in line with your vision and mission of your organization. You should be expressing your values. In your stakeholder registry, you should be expressing your values based on who you are targeting as your stakeholders. That, you know, it's not just like you Googled and saw, okay, who should be a stakeholder for a website change. It's, you know, your people. And your people who matter to you on a deep level as an organization. Go for that. There are some really useful things around accessibility that you can do in a stakeholder register. You can note, you know, are there people who have specific accessibility needs? Like, do they need a wheelchair-accessible meeting room? So you make sure that you have that for them, or you have live captioning so that you don't have to keep asking people the same questions in order to make sure that they are able to be in the room with you. Same thing with your communications. Every project communication you send out, should be an expression of your organizational values. And that's going to play out differently depending on the project. But I think if we keep this in mind and make sure that, you know, we're not ignoring that aspect of it just to drive a project through, we're all going to end up with better outcomes in the end.

Tony Martignetti
That's a great place to end. That's perfect. End with values.

Adrienne Figus
Absolutely.

Tony Martignetti
Adrienne Figus, project manager at Madison College. Madison was Thanks very much. Thank you for sharing.

Adrienne Figus
Well, thank you, Tony. This has been lovely.

Tony Martignetti
Thanks. And thank you for being with Tony Martignetti Nonprofit Radio coverage of the 2026 Nonprofit Technology Conference.

Kate Martignetti
It's time for a break. We are sponsored by the Bridge Conference, produced by AFP DC and DMAW July 29th to 31st at the Gaylord National Resort and Convention Center in National Harbor, Maryland. More than 2,400 professionals will gather at Bridge. Tony will be with them. The question is, will you? Thought leaders from nonprofits, associations, foundations, hospitals, higher ed, faith-based, and mission-driven causes across the country come to Bridge to discover new ideas, solve real challenges, and connect with smart people shaping the future of our industry. From 125+ educational sessions and hands-on pre-conference workshops to BridgeTech, the Faith and Fundraising Forum, and inspiring keynote speakers, Bridge offers something for every mission and every role. The conversations happening at Bridge will shape strategies, careers, and organizations long after the conference ends. Don't hear about it afterward. Be in the room. Register at bridgeconf.org. Now it's time for Cybersecurity on a Shoestring.

Tony Martignetti
Welcome back to Tony Martignetti Nonprofit Radio coverage of the 26 NTC. That's the 2026 Nonprofit Technology Conference. where we are all gathered together in technology community in Detroit. My guests now are Edward Wilson, principal at ArchTech, and Ellen Samuel, COO at Just-Tech. Edward, Ellen, welcome to Nonprofit Radio. Thank you. Thank you for having us. I'm very glad you're with us. Your topic is Cybersecurity on a Shoestring: Safeguarding Nonprofits in the Age of AI. Ellen, could you do a— just give us a 30,000-foot view of the topic before we go into the details?

Ellen Samuel
Sure. So we wanted to make sure that nonprofits understand the importance of cybersecurity and securing their technology and their staff and their client information and data. And we went through how we can do this affordably, or as affordably as we can. So we went through the importance of why nonprofits are at risk and how they are attacked, and then some list of things that nonprofits can do relatively cheaply in order to improve their security. And then we had a bit of a dive into business email compromise and wrapped things up at the end with some amazing questions from the audience.

Tony Martignetti
Okay. Well, we're going to talk about all that and maybe even some of the questions. We'll see. So we're going to go into some detail. So thank you very much for giving a high-level view. Why are we— Edward, let's turn to you. Why are we nonprofits at risk? How are we at risk?

Edward Wilson
That's a great question. One of the things that we run into with most of our nonprofits is that there is more demand for their service than there is budget to help them meet that demand. And that leads to a lot of difficult decisions along the way. Nonprofits are actually the number 2 target these days for cybercriminals because they're aware that there's some weakness in that area where we haven't strengthened the whole picture.

Tony Martignetti
We underinvest in cybersecurity because we're more devoted to mission and programs.

Edward Wilson
Yes. And sometimes I think there's that— again, it's an education thing, right? So we've seen nonprofits who have spent a lot of money potentially covering one small space of what they need to work on, but leaving other areas of the business not covered. And so our goal was to help them get that 360-degree coverage for less than they might spend on one fancy tool.

Tony Martignetti
On a shoestring, right? Absolutely. We're cybersecurity on a shoestring. By the way, I love— we have like some symmetry. Edward Nellen, ArchTech, Just-Tech. It all seems to fit together very well. I wish you had the same initials, your last initial. Maybe you could change your name to Samuel. Yeah, I thought that. Edward, maybe you could change your name to Samuel. Yeah, Samuel's— yeah, Ellen Samuel. It's cool. Like Ellen Samuel, Edward Samuel, ArchTech, Just-Tech. Okay, well, we'll work with what we have. You know, it doesn't— he's open to the idea, but he's not about to run out and do it, so change his name. So, all right.

Edward Wilson
Probably maybe check with her first.

Tony Martignetti
Yeah. All right. All right. So we'll stick with you. I like the ArchTech, Just-Tech. All right. So I don't know, should we just like do ping pong? Like you have 10 essential— oh, let me— I do have a threshold question from your session description. 10 essential security measures every nonprofit IT team Do we have to have an IT team to do a lot of these 10 essential security measures, or can we do it if we don't have an IT team? Maybe an outsourced IT vendor helping us, is that okay? Or do we need to have an internal team?

Ellen Samuel
Absolutely. We understand that most, a lot of nonprofits don't have—

Tony Martignetti
Probably most. Our listeners are small and mid-sized nonprofits. Yeah, they don't have a— We're the other 95%. We're the other 95%. Exactly.

Ellen Samuel
So we don't have one person who is the IT team. Yeah, they're not trained in that. That's one of the services that we as managed service providers provide more affordably to nonprofits, is we can give them those services and that expertise without having to hire a full-time person.

Tony Martignetti
Okay, okay. So we can still take advantage of the 10 essential security measures that every nonprofit can implement right now without breaking the bank. We can still take advantage of these?

Edward Wilson
Absolutely.

Tony Martignetti
Otherwise, the mics are going off and we're done. We're done in fewer than 5 minutes. All right, that's good.

Edward Wilson
Whether they have an in-house team or they're using an external team, that list of top 10 items is a great checklist to walk through and say, am I covering all of these things with our in-house or external team? So for decision makers, All right,

Tony Martignetti
let's get into the— let's get into the 10. Let's kick us off. Give us numbers 1 and 2, because we're not gonna go 1 Samuel, I mean, 1 Edward, 2 Ellen, Edward, Ellen, Edward. So do— let's do like 2 or 3 at a time. Edward, give us our top 2.

Edward Wilson
Sure. The first thing we say is that you need to identify where all of your information systems actually are. People store information in a lot more They may think a server or an email system, but you've got your accounting platforms, your HR platforms, your telecommunication platforms, your backup platforms.

Tony Martignetti
Backup, email, online giving.

Edward Wilson
Making sure that you understand all the places that you need to protect, controlling what we call the information system boundary. And then we want to protect access to that by protecting the users who access it with things like MFA, passwords, and so on. And even protecting the devices that access that where we can.

Tony Martignetti
Okay. Is that 1 and 2?

Edward Wilson
That is 1 and 2.

Tony Martignetti
Okay. So number 2 is the protection of the data once you identify where it all is.

Edward Wilson
Protecting that access. Absolutely.

Tony Martignetti
Okay. Protecting access. All right. Ellen, it's your turn.

Ellen Samuel
So one of the highest ROI things that firms can do or organizations can do is implement MFA, multi-factor authentication. authentication. And this, for anyone who doesn't know, is a way of logging into systems using both a password and something else. So a token, a text message, we all know about this from our bank, other systems. It is one of the best ways that you can protect your users from being attacked or Or people giving up their credentials to your systems. And it's usually free or easy to implement. And we see a surprising amount of organizations that just don't have it turned on. They just haven't checked the button and they need to do it.

Tony Martignetti
Okay. So number 3 is do MFA.

Ellen Samuel
Do MFA.

Tony Martignetti
It's just an extra step. I mean, I think initially maybe it was annoying, but now it seems like it's just, okay, I'll get the text. I don't know, maybe this is true on Android phones, but I know on iPhones you get the text and you don't even have to put the numbers in. If you're on the phone, it just says, use from text, put the number. Yes, tap that and it fills in the 5 or 6 numbers. So you don't even have 5 or 6 keystrokes that you have to do. Yes. Key taps, I should say. So, all right, do MFA.

Ellen Samuel
Do MFA.

Tony Martignetti
Number 3. All right, what else? What else for?

Ellen Samuel
We talk about also changing your default credentials to your hardware that you get. So you get a camera that comes with default credentials that are open and available. That information is on the internet, and anybody can come in and log into those systems and do kind of nefarious things with those. And it's It's really easy and cheap, free to go in and change that information on your routers, on your Internet of Things devices. Just go in and change those things so that people can't come in and look at your video or get into your systems.

Tony Martignetti
Because they're standard format defaults, right? Right.

Ellen Samuel
Admin is admin.

Tony Martignetti
Yeah, right. I just learned one, you know, on WordPress, the admin, the admin URL is standard, like wordpress/admin-wp or something like that, or wp-admin. So everybody knows that and it's easy for a bot to exploit it. Okay. And that also applies at home, like your Ring system, your refrigerator, whatever, you know, whatever. Like you mentioned the Internet of Things. I'm just drilling down. Whatever you've got, it came with some default admin password. Your home, well, home as well as office, internet access, internet, right? It's like ocean307 is your Spectrum router default. Yeah, change. Yeah, ocean307. That's not mine. That's not mine. That's not mine. That's not mine. Yeah, mine is 307ocean. I'm very savvy about passwords. Yeah, yeah, that's it. No, no, don't do that. That's bad advice. Don't follow that. Don't— I don't want anybody saying, I did that and he said it was a good idea. All right, all right. So number 4, change your default configurations on all your devices. Okay. All right, Edward. Edward Wilson is up.

Edward Wilson
I like the next one, update your infrastructure. So I've actually got a story about this one from yesterday. One of the things we do is free security and incident response for nonprofits. They can just call us and them out if they run into a security incident. And our most recent call came in yesterday from somebody who had had their router hacked, and they were using an old Cisco router.

Tony Martignetti
Oceans 307.

Edward Wilson
Of course.

Tony Martignetti
It works. It works. You use that everywhere.

Edward Wilson
They were using a Cisco router that had been installed in 2014 and had gone end of life in 2020 with no additional security updates. And the interesting thing was, as we got into this And we looked at it, the last time that it had been updated, the firmware on that, was in 2014.

Tony Martignetti
Oh, they hadn't even done the updates from 2014 to 2020.

Edward Wilson
So we're 12 years behind on updates for this. And that's one example of just needing to keep that infrastructure up to date. On our laptops, it's our Windows OS updates, it's our third-party software patching, which a lot of people don't think about, the browsers that we run, Adobe, keeping all those other programs that are on our computers up to date. Can

Tony Martignetti
you just click the automatic, just tap the automatic updates option?

Edward Wilson
A lot of times that's going to take care of Windows, but it might not take care of everything else. So IT teams want to be conscious of that.

Tony Martignetti
Okay. Okay. Update the infrastructures. All right. That's incredible. So they even— I mean, so the product had been no longer supported since 2020, but even before that, from 2014 2015 to 2020, they hadn't done any updates.

Edward Wilson
It was missing 6 years of security updates.

Tony Martignetti
So like, yeah, right, like 2015 it was out of date for the— and okay, that's a bad situation.

Edward Wilson
Honestly, we were a little surprised it took so long for them to get hacked, given that.

Tony Martignetti
We've been lucky all these years and you should be thankful.

Edward Wilson
But we do these technical assessments, both our organizations do, where we'll go in and we'll look at organizations. And one of my very One of my favorite standards for us to look at is the HIPAA compliance standard, the HICP, that the government publishes and puts out there for free. And the smallest one that's designed for physicians' offices of less than 10 physicians, the average score on that is about 50%. So this is common in nonprofit world.

Tony Martignetti
All right, you have one more, Edward. We're doing 2 at a time.

Edward Wilson
Got it. I like using the firewall, making sure that we've got that We used to be very complex in our firewall setups, and now that we're more cloud-based, that becomes less important. We want to secure the user and device no matter where they are, but firewalls still have great tools to help protect us at the office. And so just making sure that we've implemented many of our vendor best practices—it's the same among most brands—not using some of those default configurations, making sure that the admin access. to the firewalls is MFA protected. Goes back to the story I just told.

Tony Martignetti
Change that default. Make sure you change the default admin on the firewall. Yeah, but firewalls are so annoying.

Edward Wilson
Yeah,

Tony Martignetti
they're going to prevent content from— they're going to prevent pop-up windows. Sometimes I need the pop-up window because I do want to subscribe to the nonprofit's newsletter, or I want the—

Edward Wilson
the firewalls are on. Radio programs and podcasts.

Tony Martignetti
We don't have— we don't use pop-ups. Yeah, we don't even We don't need— we're not even that sophisticated. But no. All right, so how do I overcome the objection, the firewall, so annoying, I have to load the content directly, or I'm, I'm missing out on pop-ups, I'm getting warnings from some sites? How do I overcome— how do we— how do you two at Just-Tech and ArchTech overcome these naysayer objections?

Ellen Samuel
I think that leads nicely into one of our other top 10s, which is to train your users and explain why we're doing these things, why they're important, what the risks are, and what these systems do. Okay. We find that organizations really do not put the time and effort into training the people at their organizations about how to use their technology safely and efficiently and effectively. And a lot of those concerns, a lot of those issues, you can handle in those trainings and talk And explaining, yeah, this might make it a little more difficult for you to do your day-to-day work, but it's important because we don't want other people getting into our system. We have really important client information that we are protecting. So you need to make sure that you're training, training people on technology and safety and security.

Tony Martignetti
Okay. Can we call that number 7 then? Training, training. Okay. Training, train the users. You get another one. Go ahead, Ellen.

Ellen Samuel
Okay. Another really important thing Is that when people leave your organization, you need to make sure that you are completely offboarding them.

Tony Martignetti
Yeah, yeah.

Ellen Samuel
A lot of organizations just kind of miss this step. They don't log people out of systems, they don't clear their computers, they, um, they don't make sure that people don't have access to their systems anymore. And it is a huge security risk regardless of who it is, if it's an intern or volunteers in particular. They just kind of send them out the door, forget about them. But people can do a lot of damage and those systems can be opened and hacked if people are not properly offed.

Tony Martignetti
Okay, so it's more than just taking back the ID card. Right. There might be a code for entry. They might have a personal code for entry into the office. You got to disable that code. You don't want these people coming back. You just perp walk them out. Let's not have them come back on Saturday using their Another thing

Ellen Samuel
that we recommend is using a password manager because a lot of our organizations, even though they shouldn't share passwords among their staff, and for example, we do use it, we work with a lot of law firms and sometimes there's court passwords and court system passwords that you have to share, and giving those out to people and having them save them themselves is really a risk. So having that email in a company-provided password manager that can better protect that information as well, so that when somebody leaves, they don't have access to it.

Tony Martignetti
Oh, that's interesting. Okay. Right. So there are some that have to be shared. Okay. Yeah, Edward.

Edward Wilson
One that would be really interesting, I think, for your users is to realize that when they're on that company device and they're saving passwords to their browser, we've seen people do things like log in with their personal Gmail account. Not only is this problematic in terms of saving their passwords to their personal Gmail account. But when they leave the organization and they give the laptop back to IT, there's the potential to get in and access that information. And this will lead users to support the adoption of company password managers. Highly recommended.

Tony Martignetti
Okay, Edward, thank you. That's a good one. That reminds me of a story I heard. The organization provided company phones But a recently dismissed employee didn't use the company phone. All her personal info was on her own phone, and all her company info was on her own personal phone. Yeah. They took the personal phone. Or maybe it was the other way around. She had all her personal info on the company phone. That's what it was. She lost all her contacts. Because they took back— that's what it was. She had everything on the company phone. They took back the company phone. They took it. She lost— like, she had to ask for permission, you know, can I call my husband to let him know that I don't want to work anymore? Yeah. I mean, she lost everything. All her personal contacts. Yeah. Gone because it was on the company phone. Big mistake. If your company's giving you a phone, you got to use it just for company info because Even if you're, you know, you don't necessarily have to be perp walked out, you might resign, you might go to another job. When you're surrendering your company phone, you're surrendering everything that's on it. Very risky, very risky. All right, that's a good one. Okay, so offboard completely, that was kind of, we spun off from offboard completely. So I think we have 2 left. Does that sound right?

Edward Wilson
One of my favorites is to separate admin and user accounts. This goes out to the IT staff who are logging in as an administrator every day on their systems. If you're logged in as an administrator and somebody compromises you, then they are the administrator.

Tony Martignetti
Right.

Edward Wilson
And so it's really important that we have a daily use account and that we keep those admin credentials separate for only admin purposes.

Tony Martignetti
Don't share the admin credentials because it's easier. Okay, just use this, just use this and you'll be able to change your desktop.

Edward Wilson
Never share admin credentials, but also if I'm an IT administrator, I need to have an account that I'm using for daily work that does not have administrator privileges. The only nonprofit I've ever seen truly go under from a cybersecurity— personally that I've seen go under from a cybersecurity incident happened because the IT director was just using their admin account for regular work all day long. They hit the wrong link. They ransomware the entire organization.

Tony Martignetti
I see. Oh, using— okay, using their admin account for day-to-day. All right, now I see the implication.

Edward Wilson
Because now the attacker had admin privileges.

Tony Martignetti
Right, right, right. They hacked the admin account, not just the user-level account. Okay, that's an excellent one. You love these, I can tell. Edward's like smiling. He loves all these. I mean, Ellen is smiling too, but Edward is— okay, gleeful. Edward is like gleeful. Ellen is just Smiling.

Edward Wilson
I'm passionate about making affordable cybersecurity a reality for folks, because sometimes these are things we don't work at, work through, or think about.

Tony Martignetti
All right, that's why we're cybersecurity on a shoestring here. All right, you have one more left. Go. Are you deferring to Ellen for the final?

Ellen Samuel
I can do this one. Okay, okay. Another—

Tony Martignetti
because by right this would be Edward's because we were doing 2 by 2, but he's surrendering. Chivalry is not dead. Chivalry has not died. It's embodied here. That's right, so it's a trade-off. Yeah, yeah. Okay, go.

Ellen Samuel
So another thing that organizations really need to do is have a disaster recovery and business continuity plan. We see again organizations— this is something that you don't need to hire somebody for, but you can. But you need to make sure that you have a plan in place if and when you are compromised. A lot of times we hear It's not a matter of if you're going to be compromised, it's when. And a lot of places actually don't even know that they are currently compromised and there's people in their systems. You can, if you get ransomware and you get locked out of your system, that's not the time you want to figure out what are we, who am I supposed to contact? Who's our cybersecurity insurance provider? Who are my IT people? What is the cell phone number of the IT person? Right? Like these things that you need to have worked on Had written out. I even recommend printing them out, like old school, having a physical printed copy, because when you're locked out of your systems, you're not going to be able to get in there and look at the documents.

Tony Martignetti
You're the second guest here at NTC to say print your disaster recovery. She and I were talking about disaster recovery and incident recovery, and she was making the distinction between the two. But she— and the business continuity plan— have these things printed, because when you're locked out of the cloud, you're locked out. So you can't get the, you can't get the IT cell number. So print the things and keep them in your office.

Ellen Samuel
And do a run-through.

Tony Martignetti
And keep them at home too. Keep them at home too, because a disaster might be in your office. You might have a fire or flood or some emergency that you're not allowed in. Now, so go, you go back home and there's your printed plan.

Ellen Samuel
Right, exactly. And do practice runs because, you know, you don't know where your weaknesses are. You don't know how it's going to go until you practice. practice and gone through the information with everybody on the team who needs to know that information. So do it a few times a year. It's always more things that people have to do, but it really is going to save you time and money and the safety of your information when you get hit.

Tony Martignetti
Awesome. I love this. The Ellen and Edward Show.

Ellen Samuel
We should have our own podcast.

Tony Martignetti
ArchTech, Just-Tech, Edward, Ellen. Okay. So there's our 10. We've enumerated our 10 and gone into some detail on each. You mentioned business email, something about business email. Don't hold back. You talked about it in your session. You got to share it with Nonprofit Radio listeners. What is it about business email that we need to know?

Edward Wilson
So we've been doing free security and incident response for nonprofits for about 5 years now, and we've only seen one incident that wasn't compromised email. In some way or another. And there are 2 main categories of that. The first is financial compromise, and it's not an IT item, it's actually for the finance team. Never change a payment method or process without picking up the phone and calling somebody. We've seen vendors get hacked, and the vendor submits an invoice and says, please pay this invoice over here, and it looks completely authentic. They pay the invoice, Only to find out that they've paid to the wrong account, the wrong person. That money is no longer recoverable. That's a finance issue. But even on the IT side, there's a lot that we can do in order to protect email. And in our session, we went through how to get that number to close to zero.

Tony Martignetti
All right, let's do it. We're not just going to talk about what we talked about in the session. We're going to talk about the substance here.

Edward Wilson
Excellent. What do we do? Front-end and back-end protections in email. Front-end protections involve products like Proofpoint, Mimecast. They scan our incoming email to find bad things and make sure you don't click those. You can actually do a lot of this for free in Google and 365 without even using those products. And I don't know how to tell our listeners to download things, but if you put our contact info in, they can reach out. We distributed a step-by-step Step-by-step how-to for all of the attendees to harden those email systems, and I'm happy to send that out to folks.

Tony Martignetti
Okay, what you should do is give me the URL for where that, where that is, and I'll include the URL in the show notes.

Edward Wilson
Perfect.

Tony Martignetti
Okay, we've got— you got to make sure you do it. Somebody has to email me, and then when your show is going to be aired, in your episode show notes, I'll include the URL.

Edward Wilson
Excellent.

Tony Martignetti
Okay, okay, so we can get—

Edward Wilson
We've got several good ones

Tony Martignetti
in there for you. All right. All right.

Edward Wilson
But we're going to walk them through how to protect that email account and get the odds of their being compromised as close to zero as we possibly can in this technical environment. And a lot of it involves backend protection. Eventually, no matter how good your frontend protections are, an email is going to get through. The user is going to click a link. They're going to enter in their credentials, their MFA, and they're going to give that MFA token that access to a threat actor. who now has access to the email account. And our ability to detect that, respond, and to shut them out automatically becomes key.

Tony Martignetti
Okay. Ellen, is there more we can talk about around business email safeguards?

Ellen Samuel
Just to echo what Edward said, nearly every attack that we've seen has come in through email and somebody giving away their credentials. So you've got the email issue, right? If those emails never come in, that's great. But then you also, again, have MFA. That's if an email does come through and somebody tries to give away their credentials, that MFA can stop the bad actor from getting it.

Tony Martignetti
All right. Business email, very, very common method of exploiting nonprofits.

Edward Wilson
I would guess it's in the 99%.

Tony Martignetti
You said everyone, everyone, everyone except one.

Edward Wilson
Yeah.

Tony Martignetti
In a test that you did, or

Edward Wilson
in our experience, we have nonprofits calling us and saying, we've been compromised, what do we do? Right. And we try to help them through that process along the way. It's been email every time but one

Tony Martignetti
in

Edward Wilson
the last 5 years.

Tony Martignetti
All right. I'll tell you what, Edward, you're so gleeful about this, passionate about it. Why don't you take us out since Ellen gave us the overview? You could take us out with, you know, inspiration and empowerment, why cybersecurity on a shoestring is so important.

Edward Wilson
I want to emphasize to our audience that we want to solve the problem with one expensive fancy tool, but usually that only covers a small amount of our attack surface. We want to look 360 degrees at the whole picture, and there are 2 open-source sources that I would like to refer people to that are free and available online. One is the HIPAA standard, the HICP. They can start with Volume 1. It is simple, it is approachable, it is designed for mom-and-pop doctor's offices With less than 10 physicians. It's written in clear, clean language, and we'll give them a checklist to start walking through.

Tony Martignetti
Okay, so it's valuable for nonprofits even though we're not a doctor's office?

Edward Wilson
Even though you're not a doctor's office, every time it says PHI, protected health information, just insert my sensitive and protected information and you'll be fine.

Tony Martignetti
Excellent. Okay, and number 2?

Edward Wilson
Number 2 are the CIS controls, the critical information security controls, and that also is open It's open source, it's available to everyone. I prefer the HICP because I think it's more approachable. And a bunch of really smart people sat down at a table and said, how are we actually being compromised? And wrote a list on that to protect healthcare providers. And number one is email.

Tony Martignetti
All right. And the second resource was CIS?

Edward Wilson
CIS controls.

Tony Martignetti
And what does CIS stand for?

Edward Wilson
Critical Information Security Controls. Somebody may have to test me on that acronym later.

Tony Martignetti
It's CIS Controls.

Edward Wilson
The CIS Controls version 8. If you Google it, it'll come right up.

Tony Martignetti
Version 8, okay. But your preferred is the HICP, which is the HIPAA.

Edward Wilson
Yeah, it's put out by the Department of Health and Human Services. It's available online. It's a free download. HICP Volume 1.

Tony Martignetti
Outstanding. That's Edward Wilson, principal at ArchTech. It's named ArchTech because they're in Missouri, the Arch. Ellen told me that before.

Edward Wilson
It actually was supposed to have a play on the word architecture because we believe good design can solve most of your problems in advance.

Tony Martignetti
Okay, I thought about that possibility, but then when she said it's ArchTech, it's not, it's not architect. So is it ArchTech or ArchTech? I don't work for them.

Edward Wilson
To be fair.

Tony Martignetti
How do you want it said?

Edward Wilson
We call it ArchTech. I started pronouncing it ArchTech. But we're in St. Louis, so the point applies. About 6 months in, I realized it was going to be ArchTech forever because of the St. Louis Arch.

Tony Martignetti
I see. All right, so it's evolved into— it is ArchTech, so I said it correctly. All right.

Ellen Samuel
Can you say our? Pretty easy to say.

Tony Martignetti
Yeah, Just-Tech. Just-Tech. Just-Tech. J-U-S-T-T-E-C-H. That's Ellen Samuel. She's the COO at Just-Tech. Just-Tech with a hyphen in between. Well, if you're typing it, You don't want me to say Just-Tech? The company is Just-Tech?

Ellen Samuel
I mean, you could get people to your website.

Tony Martignetti
Oh, well, all right. Well, they're going to Google Ellen Samuel too. But the website does have a hyphen if you need that. Okay. Edward, Ellen, thank you very much. Great fun and value. Thank you. Thank you for the value. Thank you for sharing.

Edward Wilson
Thank you. Thank you.

Tony Martignetti
And thank you, listener, for being with Tony Martignetti Nonprofit Radio coverage of the 2026 Nonprofit Technology Conference.

Kate Martignetti
It's time for Tony's Take 2.

Tony Martignetti
Thank you, Kate. Thank you, N10. This is our final show from the 2026 Nonprofit Technology Conference where we were all together, as you, as you hear episode after episode, in Detroit, Michigan. I'm just grateful for the partnership. They take good care of us. They appreciate the value that we bring to the conference, promoting it for months after the conference, amplifying their speakers to our, our complete audience way beyond just the folks who attend the conference. So, and I appreciate the value that they bring. They give us accessibility and exposure for the show. And I appreciate the, the partnership and the collaboration for N10 year after year. This year was our 13th. Next year, I'm already looking forward to it. It's in Portland, Oregon. It's in March of 2027, and we'll be there for our 14th NTC. So looking forward to that. Thank you very much again, N10. I'm grateful. Thank you. Listeners, again, I apologize about the audio. It was, it was your lackluster host. I'll make sure— well, I'll do everything I can to make sure it doesn't happen again. Thanks. Thanks for understanding.

Kate Martignetti
Kate, are we coming up on episode 800?

Tony Martignetti
We most certainly are. This is episode number 798.

Kate Martignetti
Oh, 2 more.

Tony Martignetti
Absolutely.

Kate Martignetti
We've got just about a buttload more time. Here is Make Confident Tech Decisions, finishing our 26 NTC coverage.

Tony Martignetti
Welcome back to Tony Martignetti Nonprofit Radio coverage of the 2026 Nonprofit Technology Conference. We're all gathered in Detroit, Michigan. This is the final day. With me today is Simone Carvalho— with me right now today— Simone Carvalho and Rebecca Kaplan. Simone is Principal Consultant at Skeleton Key Strategies, and Rebecca Kaplan is Senior Director of Member Grants Strategy and Operations That's Member Grants Strategy, not Member Grants Strategy and Operations. Oh, okay. She only has 2 things, not 3. Rebecca Kaplan is Senior Director of Member Grants Strategy and Operations. So operations modifies the grant strategy and the member modifies the grant strategy. So there's Member Grants Strategy and Operations. No, it's quite simple. No, no, Member Grants Strategy and Operations at Feeding America. America. Okay. Welcome. Welcome, Simone, Rebecca. Good to have you both.

Simone Carvalho
Thanks for having us.

Tony Martignetti
Pleasure. It's a pleasure. Simone, would you do an overview, give us like a, you know, a high-level view of the topic to kick us off, please?

Simone Carvalho
Sure. So Rebecca's here with me today, and we're at the Nonprofit Tech Conference to talk about competent tech decisions. And we specifically talked about the tech assessment framework. So a technology assessment A tech assessment is a structured evaluation of your organization's current technology, the underlying processes, and the capacity within it. And we walked through— and I'll probably—

Tony Martignetti
We're going to do it here. Yeah, yeah, yeah.

Simone Carvalho
I'll walk through in detail.

Tony Martignetti
We're not going to just talk about the session here. We're going to talk about the topic here.

Simone Carvalho
Yeah. The phases of a tech assessment, when to anticipate or when you should really consider Yeah. Having your own tech assessment, whether or not you should involve consultants, and then ultimately, like, what are the potential outcomes and benefits of conducting tech assessments?

Tony Martignetti
Okay, thank you. And I should have said that the topic is Assess, Don't Guess: A Framework for Confident Tech Decisions. All right. All right. So thank you very much, Simone, for getting us started. You can take off your little Mini mic. Okay, so we have the opening threshold question. Let's turn to you. Do you go Rebecca or Becca? Do you prefer?

Rebecca Kaplan
Either is fine.

Tony Martignetti
Either is fine. You go by Becca? Can I call you Becca? Is that all right? Okay. Okay. Then at the end, I'll say Rebecca Kaplan again. Keep it formal for people who want to connect with you on LinkedIn. Okay, Becca. So how do we know whether we should— we are ripe for an audit, an assessment,

Rebecca Kaplan
Yeah, so I can talk about Feeding America's symptoms. We think about it as internal triggers that might indicate you need something like this or external triggers. So that's when you hear people say things like, oh, I'd rather look at this in my spreadsheet, or there's one of those, right? So those are some common ones. And for us, we were deep in the work of that. Yeah. So, for example, I do grantmaking, so getting funds out to your humans. And in order to pay our grants, we needed to download payments from our grants management system, reformat them in Excel, email multiple spreadsheets, one per grant opportunity, to our finance department for finance to upload in their system.

Tony Martignetti
Okay, 4 different, 5 different steps, and a lot of it Manual, or it's all manual.

Rebecca Kaplan
Right. And then we had no good record of our payments. They were in email, they were in spreadsheets. Finance had them, but they weren't connected to reports. So that was these workarounds, that's one. The other was staff morale. So our system was a legacy system. We had been using it over 10 years, or close to 10 years rather. And it was slow. We had performance issues. And staff morale suffered. We knew that formally from our employee engagement survey.

Tony Martignetti
Okay. Okay. Things look bad.

Rebecca Kaplan
Things look bad.

Tony Martignetti
Lots of, lots of multi-step processes that humans are involved in, and employee satisfaction was low or mediocre.

Rebecca Kaplan
We were just frustrated by the technology. Yeah. And so are our grantees. And so when it was also affecting our network partners, that was another trigger.

Tony Martignetti
Okay. Simone, it looked like you may want to add something.

Simone Carvalho
Yeah, yeah, I can talk about— so when Becca mentioned like external and internal triggers and goals, I'm borrowing that framework actually from change management. So change management theory often talks about like organizations change basically when they're forced to. And external triggers, so Becca talked about like a specific scenario at Feeding America That initiated her tech assessment. But other organizations might hear whispers of a hedge fund has purchased your product and will be sunsetting it, or, you know, they're going to suddenly hike up the prices. So there's external factors that are pushing you, or perhaps like an external— that would be an external trigger. An external goal would be something like, we want to aspirationally just be better serving our clients, for example. Okay. Expanding our geographies. Internal, same thing. There's internal triggers and internal goals where it's coming from inside the house. Perhaps there's a change in leadership.

Tony Martignetti
Like employee dissatisfaction.

Simone Carvalho
Employee dissatisfaction is a great one.

Tony Martignetti
Rebecca said.

Simone Carvalho
That was like super interesting to learn that it came up in like her employee surveys. It could be the change in leadership, or you could just simply find that like the process is taking 3 days instead of 2.

Tony Martignetti
Okay. All right. These are troubling symptoms, but we have a therapy. We have a treatment. Yeah. It's a tech audit. I'm going to tick through some— I think these are your phases or your process. I want to make sure for an audit that you're looking at— there's a discovery, analysis, prioritization, and a roadmap. Yeah. Okay. And you're including Your people, processes, and your strategy.

Simone Carvalho
Yeah.

Tony Martignetti
Okay. Let's talk through these. That's a great overview, but that's all I can do, like tick through. Let's talk about who the folks are and what the processes are that should be involved in your tech audit.

Simone Carvalho
Sure. So taking like one step back really quickly, the reason why our tech assessments aren't just about the technology is that we often think about technology as like one leg of a 3-legged stool, where it's technology, people, and process all supporting strategy. So if one of the legs of the stool is a little bit wobbly, you know, you could potentially topple over. Yeah. So our tech assessments aren't just looking at purely the technologies and the systems itself. We always, in our discovery and all these phases, think about the underlying processes and capacity and the folks involved in it. So The first phase, discovery, is pretty self-explanatory. It's lots of interviews, group discussions. It's trying to glean as much information as possible. And we often are pulled in because consultants don't always have to be involved, but can be helpful when you find that perhaps you don't have the internal trust or buy-in from folks and they need like an objective third party because I think that's the consultants can bring more than experience is there's a neutral third party that folks might feel more comfortable discussing their, you know, system secrets with.

Tony Martignetti
Okay.

Simone Carvalho
Yes. So that's discovery. You're gleaning as much information as possible, and perhaps you would have a survey in there. I should also say before all of these phases, there is scope definition. The one thing that I think we really pressed upon was, you know, like the There's an essential need to document and define the scope of your tech assessment because we often find folks are really not aligned about what is a tech assessment and what's included in the tech assessment, and scope creep just explodes.

Tony Martignetti
Okay.

Simone Carvalho
So knowing definitively, because we want to go deep rather than wide, explicitly what systems or departments or processes are involved or are not involved in the tech assessment.

Tony Martignetti
Let's just turn to Becca for a second. So more than a second, even more than a second. So what was the experience at this phase for Feeding America, discovery phase? Like, were there people who wanted to participate who shouldn't be, or people who didn't want to who should be involved? And, you know, how did that discovery phase go for Feeding America?

Simone Carvalho
Great question. So Skeleton Key did probably over 50 interviews with stakeholders across many departments. So if you think about grantmaking, it's touching finance, it's touching development, it's touching the teams that are programmatically overseeing the grants. So we were lucky that folks were really invested and interested in helping us define the processes, understand the roles and responsibilities, what we were doing for. So the discovery was exciting for us because we had a lot of feelings about our Mostly negative? Mostly. And also dreams about it.

Tony Martignetti
What about potential too? Good feelings about potential, but frustration in the moment.

Simone Carvalho
Exactly. So, we're excited to think through like, it would be really cool if those sorts of ideas. So, I think there's a lot of buy-in at the discovery phase. Okay.

Tony Martignetti
Yeah. Cool. All right. All right. Should we— can we move to analysis? Is that all right? So we're in our analysis phase.

Simone Carvalho
Analysis is taking the globs of information and doing something with it. So that's when we start actually combing through what we've collected through documentation and interviews, group discussions, surveys, and we've compiled— there's a couple of different outputs. It ultimately depends on back in the discovery phase and when you're defining your scope, it could be the thing that has to to clearly define is like, what question are we trying to answer? For Feeding America, I'll let Becca speak to that, but there was some big questions. So some of the key outputs of analysis is developing user stories. So these are like human-centric requirements. So as Becca mentioned, it was like very future-facing and aspirational. As a grants manager, I wanted to XYZ in order to fulfill a specific business objective. Yeah. There's process maps, so visualizations.

Tony Martignetti
Beyond the grants managers, the grantees, right? I'm sure you interviewed some grantees among those 50 and the aspirations for them. Oh my God, these emails that I get from Feeding America, I love having their support, but my goodness, enough is too much. It's too much already. These are Becca's emails coming that they're commenting on. But yeah, but among the grantees.

Simone Carvalho
Yes, exactly.

Tony Martignetti
Okay.

Simone Carvalho
And then there's process mapping, which again is typically aspirational and future-facing. Folks really like that because we are daydreaming about what I want my process to look like in the future. And then as I mentioned, you just get lots of information and not all of that information is specific to the technology. And especially with Feeding America, we just started Compiling what we called a process improvements inventory, because there was lots of things outside of the GMS, the grants management system, like ownership struggles, everyone owning a thing or no one owning a thing, that also needed to be addressed before we talked about the actual technology systems.

Tony Martignetti
Okay, so there's the processes, the people, and the technology as well. All right, cool. It sounds like you really need an outside facilitator, coordinator of this kind of audit? I mean, I don't know, can an internal IT team do it? Now, you have to be— I'm asking you to be objective, Simone.

Simone Carvalho
Yeah, I do actually do think so. The key question to ask, or for someone to determine whether or not they can do it internally, there's a couple of things. I think the first thing is capacity, because it can be done internally. It ultimately I think it depends on what is your timeline. So if it's an external trigger, like, hey, we're going to be sunsetting your system, you might not have the internal capacity and velocity to get it done in 6 weeks in the way you need to. There is also just that question I raised earlier, which is, are your stakeholders going to be honest with you? Sometimes there's like the benefit of relationships. Yeah, right.

Tony Martignetti
Or I'll say more to an outside consultant than I will to colleague in the IT department.

Simone Carvalho
Sometimes we're the therapists.

Tony Martignetti
Data department. Yeah. Okay. Okay. Fair

Simone Carvalho
enough. So we— one of the reasons we brought in a consultant was that in order to have the business case to invest in a new system and spend a lot of money, they wanted the confidence that consultants bring as leaders to make that decision.

Tony Martignetti
Okay. Leadership buy-in is important for a project like this, right? Everybody's got to be participating. And that encouragement comes from the top. Plus there's—

Simone Carvalho
The budget.

Tony Martignetti
The budget. I was thinking of conflict. I don't know why I'm focused on conflict, like people who don't want to participate that should, or I said, people who should participate who don't want to. I don't know why I'm focused on negative. But there's also, you know, there can be decisions to be made, like about the scope, which is going to impact the budget. Scope of the audit is going to determine how much we're spending on this. This venture, right? Okay. Yes, leadership buy-in. Thanks, Becca. Excellent. Okay. Prioritizing. Becca, can you lead with prioritizing? Okay, let's mix it up a little bit. Yeah.

Simone Carvalho
Yeah, so we had a long list.

Tony Martignetti
Okay. From the analysis phase? Yes.

Simone Carvalho
Right, from the analysis phase of the things that we wanted to do and accomplish through this transition. And we used— Simone mentioned it, but basically a prioritization framework that allowed us to think about what was the effort and what was the return going to be. And we picked a mix of things on that prioritization list, some that would be the low-hanging fruit that we could actually confidently accomplish, some that were going to be really difficult and really important, and then some in the middle. So it was a realistic mix of the overall thing. And that framework really helped us narrow down what we could actually accomplish.

Tony Martignetti
Okay, you want to talk to the framework, Simone?

Simone Carvalho
Yeah, so it was a pretty simple one for Feeding America because they did have a really long list. And I think the thing I would emphasize here is, and as we talk about roadmap, there's the low-hanging fruit, but there was also things that needed to be immediately addressed regardless of the system. That would be things that had to be addressed regardless of how long it took to put it in the system.

Tony Martignetti
Okay. You might also be looking for maybe low lift and high impact. Exactly. It affects a lot of people and this one is not going to be difficult to do. Boom. That's obviously a top priority.

Simone Carvalho
And it builds our confidence and buy-in into like, oh, this was worthwhile.

Tony Martignetti
Yeah. Right. Versus the other quadrant, the quadrant opposite that one, which is high lift and low return. Yeah, right. You probably had some of those.

Simone Carvalho
Definitely.

Tony Martignetti
Okay. So what happens to those? Do they— I mean, realistically, do they never get done?

Simone Carvalho
I mean, I hope not. But that brings us to the roadmap phase.

Tony Martignetti
And also the scope. I mean, there's only so much we can do together. There's only so much Feeding America is willing to pay for. So some of these things are not going to get done this year.

Simone Carvalho
Yeah.

Tony Martignetti
As part of this process. Okay, I'm sorry, that brings us to what you said, the roadmap. Okay, well, even the lackluster host can provide a decent segue. Okay, good. What's the roadmap?

Simone Carvalho
Yeah, so it's, you know, you've collected all this information, you've analyzed it, you have all these artifacts, you have this list of prioritized things, but now it's about putting it down on paper, assigning ownership, and like actually planning some scenarios. Allocating budget and putting it on a timeline. And we got asked this question a couple of times, but like, what, how big is a roadmap? We tend to do like 2 versions of the roadmap. There's the immediate needs roadmap, right? Like we mentioned, there's typically things that are like immediate pain points that have to be addressed in order to like help people and their morale while migrations take time. So, Between choosing and actually migrating to a system, it could be over a year. And so there are things that just have to be addressed in that year. So we usually do like a short version of the roadmap. So it's maybe like 3 months, the next 3 months, here are the immediate things you guys can do based on how much capacity or budget you have. And oftentimes we're actually not doing these activities, we're giving it back to the client and they can decide for themselves and assign it. Okay. The key thing here is ownership because nothing is—

Tony Martignetti
Nothing's going to get done if nobody owns it.

Simone Carvalho
Exactly. And nothing is more disappointing than spending all this time and investment in a tech assessment and it lands in a room full of people who have lots of opinions, but then there's no one with the authority to act on it. So that's pretty critical. And then depending on, again, the size and the scope of the organization and the tech assessment and what they're going towards, it's anywhere from a 12-month And this also includes total cost of ownership as well, which is— What does that mean?

Tony Martignetti
What is that?

Simone Carvalho
Total cost of ownership. So in Feeding America scenario, I'll let you speak to that, Becca. But like, oftentimes a tech assessment comes on the heels of some external factor, like we have to move off of a system. And leadership wants to know, okay, but going to this new system, scenario A, how much is it actually going to cost us. So it's not just the licensing, you know, ongoing licensing, it's the implementation, the data migration, the training, the backfill of staff, the consultants, and then the ongoing costs. Like, you're going to have to change your staffing model and hire a new admin to help you support this product. So that's the total cost of ownership.

Tony Martignetti
Okay, that's great. Rebecca Kaplan, Senior Director of Member Grants Strategy and Operations at Feeding America, and Simone Carvalho, Principal Consultant at Skeleton Key Strategies. Thank you very much, Simone, Rebecca. Thanks very much for sharing.

Simone Carvalho
Thank you so much for having us. Thanks, Tony.

Tony Martignetti
My pleasure. And thank you for being with Tony Martignetti Nonprofit Radio coverage of the 2026 Nonprofit Technology Conference.

Kate Martignetti
Next week, a wide-ranging AI conversation with 3 experts. If you missed any part of this week's show—

Tony Martignetti
I beseech you, find it at tonymartignetti.com.

Kate Martignetti
We are sponsored by the Bridge Conference. Tony will be with more than 2,400 nonprofit professionals at Bridge, July 29th to 31st in National Harbor, Maryland. Info and registration at bridgeconf.com. Our creative producer is Claire Meyerhoff. I'm your associate producer, Kate Martignetti. The show's social media is by Susan Chavez. Marc Silverman is our web guy, and this music is by Scott Stein.

Tony Martignetti
Thank you for that affirmation, Scotty. Be with us next week for Nonprofit Radio, Big Nonprofit Ideas. Ideas for the other 95%. Go out and be great. Go out and be great.