Trust Is Earned: What Funders Expect From Today’s Nonprofits
Nonprofits depend on data for two responsibilities that have become increasingly connected: demonstrating the results of their work and protecting the people whose information makes that measurement possible.
That connection was the focus of our recent webinar, The Data Funders Need: What to Measure, Report, and Protect for Funding Success, featuring SureImpact CEO and founder, Sheri Chaney Jones, and Jacob Turowski, Vice President of IT Services at CCB Technology. We discussed what funders are looking for from nonprofits, how organizations can use outcomes data to strengthen funder relationships, and why cybersecurity and data governance need to be part of the same conversation.
The central idea behind our conversation was trust. Funders want confidence that their investments are producing measurable results. Nonprofits also need the people they serve to trust them with personal information. Building and maintaining both forms of trust requires organizations to think carefully about what data they collect, how they use it, who can access it, and how it is protected.
Funders Want to See What Changed
For years, nonprofits have reported on activities and outputs. How many people participated in a program? How many meals were distributed? How many students attended an afterschool program?
Those numbers have value, but they answer a limited question: What did you do?
Outcomes answer a different question: What changed as a result?
During the webinar, Sheri and Jacob discussed three questions nonprofits should be prepared to answer when talking with funders:
Are you making a measurable difference?
Are you an effective and efficient organization for delivering those results?
Can additional investment help you sustain or increase those results?
Answering those questions requires moving beyond compliance reporting and activity counts. Nonprofits need credible evidence showing whether people, families, or communities are better off after participating in their programs. Funders also want to understand how services contribute to those outcomes and whether an organization can learn from its data over time.
Stories remain an essential part of nonprofit communications. Data gives those stories evidence. When an organization can pair an individual story with measurable results across the population it serves, it can give funders a clearer picture of both the human experience and the broader impact of their investment.
Three Types of Data Help Tell the Full Impact Story
One of the frameworks we discussed during the webinar was the need to connect three categories of information: demographics, services or interventions, and outcomes.
Demographic data helps organizations understand who they are serving. Depending on the program, this can help answer questions about whether services are reaching the intended population and whether different groups are experiencing similar outcomes.
Service and intervention data shows what the organization is actually providing. This can include the type, frequency, duration, or intensity of services.
Outcomes data shows what happened after those services were provided. Did students improve academically? Did families achieve greater housing stability? Did participants find employment? Did health outcomes improve?
The real value comes from connecting these categories. A nonprofit can begin asking which interventions are associated with stronger outcomes, whether different populations experience different results, where programs could improve, and how resources can be allocated more effectively.
This changes impact measurement from an annual reporting exercise into a management practice.
Leaders can use the same information they share with funders to make program decisions.
Program teams can see where participants are progressing and where additional support may be needed. Development teams can communicate results with evidence. Boards can have more productive conversations about performance and strategy.
A shared set of outcomes creates a common language across the organization.
Better Data Can Build Stronger Funder Relationships
During the webinar, we discussed the relationship between reliable data and organizational trust.
Traditional signals of nonprofit accountability, including governance, financial reporting, and the Form 990, remain part of that picture. Funders are also asking organizations to demonstrate measurable results and explain what they are learning from their programs.
A strong measurement culture gives nonprofits the ability to share results openly, learn from programs, and communicate a more complete funding story.
That learning component deserves attention.
Impact measurement should give an organization the information it needs to identify successful approaches and opportunities for improvement. A program may test an intervention and discover that participants are responding differently than expected. Good data gives leaders an opportunity to understand what happened, make an informed change, and measure the results.
That can become part of the funding story too.
An organization that can explain what it tried, what it learned, what it changed, and what happened next is demonstrating accountability and responsible stewardship. Funders gain a clearer view of how the organization makes decisions and manages resources.
Collecting More Data Creates a Second Responsibility
There is another side to this conversation.
Measuring outcomes often requires collecting sensitive information about the people a nonprofit serves. That may include demographic information, contact information, educational records, financial information, health related information, or other personal data depending on the organization and program.
As Jacob explained during the webinar, nonprofits face many of the same cybersecurity threats as other organizations, including phishing, fraudulent payment requests, ransomware, accidental sharing, compromised accounts, and attacks involving third party systems. New technologies have also made some phishing attempts more convincing and easier to produce at scale.
This means data security belongs in conversations about impact measurement.
A nonprofit needs to know where its information resides, how it is backed up, who has access to it, what vendors have access, and whether its policies can be tested and verified. Jacob also stressed that these questions extend beyond the IT department. Data governance requires leadership involvement.
That point is especially relevant for organizations collecting information about children and other populations whose records may be particularly sensitive. The consequences of a breach can extend far beyond financial loss. Protecting participant information is part of the responsibility organizations accept when people entrust them with their data.
Start With Practical Cybersecurity Priorities
A nonprofit with limited staff and resources may look at cybersecurity as a major technology project. Jacob offered a more practical starting point during our conversation.
One priority is multifactor authentication across organizational accounts wherever it is available. That should be paired with good password practices, including avoiding password reuse across systems.
Another priority is access control. People and vendors should receive the level of access required for their roles. Someone who only needs to read information, for example, may have little reason to receive administrative privileges.
Staff education also plays an important role. Phishing and social engineering attacks rely on people taking an action, so employees need training that helps them recognize suspicious messages, requests, and communications.
Then there is incident response planning.
Organizations should decide in advance who will lead the response to a cybersecurity incident, who will address legal and insurance questions, who will manage communications, and how the organization will assess what information or systems were affected. Jacob recommended reviewing the plan periodically so that it remains useful when an incident occurs.
For organizations that need a starting point, Jacob recommended several resources during the webinar. The FRSecure Incident Response Plan Template provides a framework organizations can adapt to their own needs. FRSecure’s more detailed template also covers roles and responsibilities, incident identification and assessment, containment, eradication, recovery, lessons learned, notification requirements, and communication planning.
He also recommended Rapid7’s cybersecurity resource library, which offers additional information organizations can use as they develop their security practices. During the webinar Q&A, Jacob pointed participants to both organizations as sources for cybersecurity and incident response materials.
Data Protection Is Part of Funding Readiness
One of my biggest takeaways from the conversation with Jacob is that impact measurement, cybersecurity, and funding readiness belong together.
Think about what a funder is ultimately evaluating. Program results are a major part of the decision, but funders are also entrusting organizations with resources. They want confidence that a nonprofit can manage those resources responsibly and sustain its work.
Data practices provide evidence of that capacity.
Can you explain your outcomes? Can you demonstrate how services contribute to those outcomes? Can you provide credible information about the people you serve? Can you explain how participant information is protected? Do you understand who has access to your systems? Do you have a plan for responding to an incident?
These questions tell a larger story about organizational performance.
Jacob made a useful comparison during our discussion. Years ago, internet access and email might have been viewed as separate technology investments. They eventually became basic infrastructure for operating an organization. Impact measurement, data management, and cybersecurity are increasingly becoming part of the infrastructure nonprofits need to operate responsibly and demonstrate accountability.
That shift also has implications for how nonprofit leaders discuss technology investments with boards and funders. Technology that supports outcomes measurement or protects participant data serves the organization’s ability to deliver programs, maintain continuity, communicate results, and sustain funder confidence.
Measurement and Protection Should Grow Together
Nonprofits should collect data with a purpose. Every piece of information should help the organization understand the people it serves, evaluate the services it provides, measure outcomes, improve programs, or meet a legitimate reporting requirement.
At the same time, every additional piece of information creates a responsibility to manage it appropriately.
That makes measurement and protection two parts of the same data strategy.
As your measurement practice develops, review your security practices alongside it. Know what information you collect. Understand where it lives. Review who can access it. Ask vendors how they protect it. Train staff. Maintain backups. Create an incident response plan and revisit it regularly.
Then put the information to work.
Use your outcomes to manage programs. Share results with staff and boards. Give funders clear evidence of progress. Pair quantitative results with participant stories. Look for differences across populations. Study which interventions produce stronger results. Use what you learn to improve.
During the closing portion of our webinar, we returned to the idea that strengthening funding readiness does not require changing everything at once. Focused improvements in measurement, accountability, governance, and security can give an organization a stronger foundation for demonstrating both impact and responsible stewardship.
Funders are asking nonprofits to show what their investments accomplish. Communities are trusting nonprofits with information about their lives. Organizations have a responsibility to honor both forms of trust.
The nonprofits that can measure their results, learn from their data, communicate their impact, and protect the information entrusted to them will be better prepared to demonstrate the accountability and sustainability funders are looking for.
Want to strengthen your organization’s approach to impact measurement? Download the Ultimate Guide to Impact Measurement for practical guidance on defining outcomes, selecting meaningful metrics, collecting useful data, and building impact measurement into your organization’s everyday work.
