Cyber security for associations and small businesses
A one-page checklist for sports clubs, associations and local entrepreneurs: backups, MFA, updates and phishing.
Sports clubs, residents' associations and small businesses are the heart of a town like Nokia. They also handle members' personal data, payments and social media accounts, usually run by volunteers in their free time. Attackers know that, and small organisations are hit by the same phishing, account takeovers and ransomware as large ones.
The good news: a few basic measures prevent most incidents. Here is a one-page checklist you can go through at your next board meeting.
The checklist
1. Turn on multi-factor authentication (MFA)
- E-mail, social media, web hosting, banking and the member register, in that order.
- Prefer an authenticator app or passkeys over SMS codes.
2. Use a password manager
- A unique, long password for every service.
- Shared association accounts go into a shared vault, not into an Excel file or a WhatsApp group.
3. Know who has access
- Keep a list of all accounts and administrators.
- When a treasurer or secretary changes, change the passwords and remove the old person's access on the same day.
- Make sure at least two trusted people can recover each critical account.
4. Back up
- Member register, accounting and documents: automatic backups, and one copy that is not permanently connected (offline or a versioned cloud backup).
- Test once a year that you can actually restore a file.
5. Update
- Turn on automatic updates for computers, phones, routers and website plugins.
- Retire devices and software that no longer receive security updates.
6. Recognise phishing
- Be suspicious of urgency: "your account will be closed", "pay this invoice today".
- The classic: an e-mail that looks like it's from the chairperson asking the treasurer to pay an invoice quickly. Always confirm payment requests by phone, using a number you already know.
7. Collect only the data you need
- The GDPR applies to associations too. Don't collect personal identity numbers if you don't need them, and delete old members' data according to your privacy policy.
8. Know what to do when something happens
- Write down who to call: your bank, your IT helper, the service provider.
- In Finland, report incidents to the National Cyber Security Centre at kyberturvallisuuskeskus.fi (opens in a new tab) and crimes to the police.
- A personal data breach may need to be reported to the Data Protection Ombudsman within 72 hours.
If you only do one thing: turn on MFA for the association's e-mail account today. Whoever controls the e-mail can reset everything else.