Donated licensing is real and large and under-claimed. The harder problem is that grants pay to build things and nothing pays to run them.
Nonprofit IT has a particular shape, and it is not simply "the same as a business but with less money". The constraint is not the amount of money. It is the kind.
A commercial business with a 200k technology budget can spend it on whatever matters most. A nonprofit with the same total may find that 120k of it is restricted to a specific programme, 40k arrived as donated licensing that cannot be converted into anything else, and the 40k that is genuinely flexible is also the pot that pays for the photocopier.
Everything else follows from that.
Where the money comes from, and what each source will not do
The one that causes the most long-term damage is restricted grant funding, and it is nobody's fault. A grant pays to build a case management system. The system is built, it is good, everyone is pleased. Then the grant ends, and there is no line anywhere for the hosting, the support contract, the person who understands it, or the version upgrade in year three.
Two defences, both unexciting.
Put running costs in the bid. Many funders will cover three years of operating cost if asked in the application. Almost none will add it afterwards. The ask has to be in the original submission, named explicitly, with a number.
Refuse to build what you cannot run. This is a board-level discipline and it is hard, because turning down a funded project feels absurd. It is still correct. A system that falls over in year two costs more than the project was worth, in staff time and in trust.
Claim the licensing you are entitled to
Microsoft, Google and a long list of other vendors grant or heavily discount licensing to eligible nonprofits. The programmes change, the eligibility rules vary by country and by charitable status, and the details are worth checking directly rather than taking from an article.
What is consistently true is that a meaningful number of eligible organisations have not claimed, or claimed years ago at a smaller size and never revisited. If you have not checked your entitlement in the last twelve months, that is an hour that frequently pays for itself many times over.
Two cautions. Grant allocations usually have seat limits, and the licences above the limit are discounted rather than free, so growing past the threshold changes your budget. And donated licensing often covers the product and not the support, the backup, or the migration, which is the gap most organisations discover at the point they need it.
The highest-value things, in order
Two of these deserve expanding.
Close the accounts of people who left
Nonprofits have high turnover, a lot of fixed-term programme staff, and frequently a volunteer population with real accounts. The result is an identity directory with a long tail of live accounts belonging to people who stopped being involved years ago.
Each one is a way in that nobody is watching, and each one may be consuming a licence from your capped allocation. Reviewing the last two years of leavers is an afternoon, it costs nothing, and it is the single highest-return security action available to most organisations in this sector.
Back up the donor database separately
Your fundraising CRM vendor backs up their platform. That protects against their failure. It does not reliably protect against somebody on your side deleting a segment, running a bad import, or a departing staff member taking an action in anger.
Ask the vendor what it costs and how long it takes to recover from a customer-side error, and whether it is self-service. If the answer involves a support ticket and an unspecified timeframe, an independent export on a schedule is cheap insurance for the asset your organisation most depends on.
Volunteers, carefully
Technically skilled volunteers are a genuine gift and a specific risk, and the risk is not about trust.
A volunteer builds something good. It works. They move on, because volunteers do. Nobody else understands it, there is no documentation, and when it breaks the organisation discovers that a core process depends on a thing no supplier supports and no staff member can change.
The rule that makes volunteer contribution safe: every volunteer-built system has a named staff owner from the first day, and documentation is part of the contribution. If neither is available, accept the help somewhere else. A volunteer who is genuinely trying to help will understand this better than anyone.
Talking to a board
Boards in this sector are generally not technical, are often risk-averse, and are personally liable in ways that commercial directors are not. That shapes what works.
What lands: the risk to beneficiaries if a system fails, the specific regulatory exposure of a data breach involving vulnerable people, the amount of staff time currently spent on workarounds, and the cost of doing nothing expressed over three years rather than one.
What does not land: product names, a maturity model, or a comparison with what commercial organisations do.
One page, three risks, one recommendation, a number. The temptation to present everything is the main reason these conversations go nowhere.
If you have one afternoon
Check your licence entitlement. Review leavers from the last two years and close what should be closed. Confirm multi-factor authentication is on for every account, including the shared info@ mailbox. Then find out, specifically, how you would recover your donor database if somebody deleted a chunk of it this morning.
That is a few hours, it costs almost nothing, and it addresses more real risk than most twelve-month strategies in the sector.
