Monterey County Gives opens on November 12, 2026. Last year the campaign raised $17.2 million from 8,048 donors for 213 local nonprofits in seven weeks. That's wonderful news for the mission. Scammers like it too. The same weeks bring fake donation receipts and spoofed campaign pages.
They also bring texts from an "executive director" who needs gift cards right away. We've supported nonprofits across Monterey County since 2008, and protecting the people who give to them is one of the things we do most.
What Nonprofit IT Looks Like in Monterey County
Most local charities are small. By our count of the IRS's October 2026 records, Monterey County is home to about 1,666 public charities. Roughly 72% of them report less than $50,000 a year in revenue. About 100 report $2 million or more. Many have one or two paid staff and a board that meets after work. Volunteers come and go every season.
That shapes the IT. Shared logins get passed from one volunteer to the next. A program coordinator keeps the donor list in a personal Gmail account because it was easier. A board member's laptop holds the only copy of last year's grant report. None of that is careless. It's what happens when the budget goes to the mission first.
The work is often spread out, too. Programs run from offices in Salinas and Monterey and from sites all over the county. One local food network alone runs more than 240 distribution sites. Half of Monterey County residents speak Spanish at home, so instructions have to work in both languages.
Funding can shift fast. In spring 2025, several local nonprofits saw federal grants paused, cut, or ended with little notice. Predictable IT costs and a technology plan you can show a funder matter more when the money is uncertain.
Giving Season Is When the Attacks Come
The local giving calendar is full. Monterey County Gives runs from mid-November through December 31. The Monterey Peninsula Foundation, host of the AT&T Pebble Beach Pro-Am, distributed $16.3 million to more than 200 nonprofits in its 2025-26 cycle. The Pebble Beach Concours raised a record $4 million for charity in 2025, and the Community Foundation for Monterey County granted a record $46.2 million that year. When that much money moves, criminals pay attention.
The tricks are mostly email and text. The FTC warned in January 2026 about messages that look like they come from the boss, asking an employee to buy gift cards as an urgent favor. Fake vendor invoices and "updated bank details" emails are aimed at whoever pays the bills. Nationally, business email compromise cost $3.05 billion in 2025, and the FBI added a new category just for charity fraud. Californians reported more cybercrime losses than residents of any other state.
A few changes stop most of it. We set up the domain records that keep criminals from sending email in your organization's name, so donors don't get a fake receipt that looks like yours. Every account gets multi-factor sign-in. And we help you adopt one rule: nobody changes a payment, buys gift cards, or sends bank details because of an email or text. They call the person back on a number they already have.
The Rules That Reach California Nonprofits
Many nonprofit leaders hear that California's big privacy law doesn't apply to them. That's mostly true. The Attorney General says the CCPA "generally does not apply to nonprofit organizations." But the state's data breach law covers "any person or business," and that includes you. Since January 1, 2026, people affected by a breach have to be notified within 30 calendar days. You can't figure out what a hacker touched in 30 days without logs and backups already in place.
Other rules depend on what you do. The Attorney General's Registry of Charities moved to a new online filing service for charity registrations on August 25, 2026, which adds one more login to protect. Charities with $2 million or more in gross revenue need an independent CPA audit under the Nonprofit Integrity Act, and auditors ask how accounting systems are locked down. Taking card donations online brings in PCI DSS, the card industry's security standard. A hosted donation page keeps most of that work off your plate.
Health and human services contracts go further. The County of Monterey Health Department's standard business associate agreement gives contractors five business days to report a security incident or suspected breach. It says plainly that a ransomware attack counts. Community Supports providers working under CalAIM use Medi-Cal portals and the county's Smart Referral Network, which need named accounts and multi-factor sign-in, not a shared volunteer login.
We aren't your attorney, and this isn't legal advice. We put the technical controls in place and keep records of them, so you can answer your auditor, your funder, or the county when they ask.
Software Discounts Changed in 2025
For years, many small nonprofits ran on Microsoft's free Business Premium grant. Microsoft ended it. According to its nonprofit program updates, those free licenses stopped renewing at each organization's next renewal date on or after July 1, 2025. Nonprofits can still get up to 300 free Business Basic licenses and discounts of up to 75% on other plans. Microsoft also warns that users should be moved before old licenses lapse, to avoid losing data.
The catch is that the free tier leaves out security tools many nonprofits were relying on, like device management and advanced threat protection. Google Workspace for Nonprofits is also free, with the stronger security features in its paid editions. We'll look at what you have, what you're paying, and which mix keeps you protected without wasting the discount.
Vendors deserve a look too. In 2020 a ransomware attack on Blackbaud, a donor software company, reached more than 13,000 customers. California's Attorney General later cited the company's missing multi-factor sign-in and settled for $6.75 million. Ask every vendor that holds your donor data how they protect it, and keep only the data you need.
How We Support Nonprofits
Day to day, everything runs as managed IT for small nonprofit teams, with one phone number for staff and a local technician who knows your setup. We handle Microsoft 365 setup and nonprofit licensing, including moving users off retired grants without losing mail or files.
Every staff member and volunteer gets multi-factor sign-in for staff and volunteer accounts. When a volunteer leaves, their access ends the same day. Before the giving season, your team gets short phishing practice built around donation scams, including the fake gift card request.
Donor lists and grant files get their own copies. We set up backups of donor email and grant files you can restore from, because Microsoft doesn't keep deleted data forever. For boards and executive directors, we write a technology plan your board and funders can review, with a budget that fits a capacity-building grant request.
What to Expect
We start by sitting down with your executive director or operations lead to learn how your organization works. We'll ask who has access to what and where donor data lives. We'll also ask which contracts carry security terms. You'll get a plain-English list of what to fix first and a written price before any work starts. We schedule changes around your events and campaigns. Once you're a managed client, security setup comes with the base plan, critical tickets get a technician within 15 minutes, and the emergency line answers 24/7.
Nonprofits are one of the sectors we know best. You can see the others in the full set of industries we cover.
Frequently Asked Questions
Does California's privacy law apply to our nonprofit?
The CCPA generally doesn't apply to nonprofits. California's data breach notification law does, and since 2026 it requires notice to affected people within 30 days. Health contracts and card donations can add their own rules.
Can you help us get Microsoft's nonprofit discounts?
Yes. We'll check your eligibility status and current licenses, then help you choose between the free and discounted plans. We move your users over without losing email or files.
What do we need for a County Health Department contract?
The county's standard agreement asks contractors to report security incidents within five business days and to follow HIPAA safeguards. In practice that means multi-factor sign-in and encrypted devices. You also need backups, plus monitoring that can spot trouble quickly. We set those up and document them.
How can we protect donors during Monterey County Gives?
Lock down your email domain so nobody can send fake receipts in your name, and turn on multi-factor sign-in for every account. Remind staff that no payment or gift card request gets approved by email or text. We can do all three before the campaign opens on November 12.