Automate the Joiner-Mover-Leaver Framework
Nonprofit IT teams supporting an extended, volunteer-driven workforce must remain attuned to identity lifecycle management needs, focusing heavily on governance to ensure orphan accounts or identity sprawl won’t leave an organization open to attack, advises Geoff Cairns, a principal IAM analyst at Forrester. The joiner-mover-leaver framework provisions access for new hires (joiners), modifies permissions for role-changers (movers) and revokes system access upon departure (leavers). Automating JML tasks allows teams to gain a handle on the identity sprawl that’s endemic to nonprofits, where many temporary or seasonal volunteers must be onboarded or offboarded frequently.
“That requires some investment. However, a modern identity infrastructure is becoming more critical to nonprofits’ business and agility,” Cairns says. “New identity threat detection and response and identity security posture management are areas that can also help with risk reduction and provide some insight on where they stand.”
Simplify Management, Scale IAM Frameworks and Reduce Blind Spots
Nonprofits can build identity maturity “in stages, by first centralizing user identities, implementing single sign-on and multifactor authentication, and then expanding into automated onboarding and offboarding,” Goettemoeller advises.
As organizations mature, they can enact stronger governance and implement least-privilege access and security tools that provide better visibility into who has access to critical systems.
DISCOVER: What’s the best way for nonprofits to migrate to the cloud?
Just-in-Time Access
In keeping with the zero-trust security model, granting some volunteers or employees just-in-time access has also grown in popularity as another method of reducing identity sprawl. Defined through governance or policy-driven approvals, the just-in-time model has taken hold across enterprise environments and would serve nonprofits well “as long as they can automate that,” Cairns says.
JIT grants temporary, task-specific permissions to users or artificial intelligence (AI) agents only as needed and revokes them immediately after the task is complete. By shrinking the privilege window, the model also reduces opportunities for attackers to gain lateral access to essential data or infrastructure if they somehow succeed at gaining entry.
Go Passwordless
Passwordless authentication verifies a user’s identity by relying on something the user knows (a one-time code sent to a phone, for instance) or something the user is (biometric markers, such as a fingerprint).
Many solutions are available to help nonprofits adopt a passwordless security approach, including Imprivata‘s Enterprise Access Management solution, Okta FastPass or Customer Identity Cloud (powered by Auth0), Microsoft IAM solutions, and more.
“Getting rid of passwords can be a tremendous help, especially where users don’t use them very often. They forget them, so eliminating that in a phishing-resistant way provides improvements from a security perspective, but also enhances the user experience,” Cairns says.
CHECK OUT: These are the tech trends impacting nonprofits this year.
Identity’s Importance Grows as Nonprofits Adopt AI
AI agents represent a new class of unpredictable identities with deep access to systems and data. Nonprofits — and all organizations — need to be able to discover and register agents, enforce least-privilege access, govern agent lifecycles and deactivate rogue agents.
“The connection between digital maturity and mission impact is only going to get stronger as AI enters the picture,” Goettemoeller says. “Nonprofits are already leaning on AI agents to automate repetitive tasks and analyze their data, freeing up teams to spend more time on the people and programs they serve.
“Identity needs to be secured first, though. A compromised AI agent can disrupt services, erode public trust and cause harm to the communities a nonprofit exists to protect. Nonprofits that strengthen identity security today can protect their mission from disruption and ensure AI adoption supports their work instead of creating new risks.”
