Cybersecurity for NGOs: Session 3: When Something Goes Wrong: A Simple Incident-Response Reflex

NGOs and associations are increasingly targeted by cyberattacks. They hold personal data about donors, members and beneficiaries, but often have little IT support. This course gives employees, volunteers and board members of Luxembourg NGOs a practical understanding of the cybersecurity risks they face, and the everyday habits that reduce those risks the most.

The module runs as three one-hour sessions, back to back. Session 1 covers the most common threats, such as phishing and social engineering, and the simple habits that protect against them. Session 2 focuses on keeping the data NGOs hold safe: what counts as sensitive, how to store and share it securely, and what to do if it is lost or leaked. Session 3 builds a simple incident-response reflex through a short simulated incident, worked through in small groups. Each module combines short explanations with real-world examples and hands-on exercises.The course is intended for NGO staff, volunteers and board members. 

- Spotting an incident: a phishing click, a lost device, a ransomware message, a suspicious email from a colleague

- The five steps to take in the first hour

- Who to call: management and IT support, Luxembourg's national computer incident response centre (CIRCL), service providers and, where relevant, the national data protection authority (CNPD)

- A simple written incident log any NGO can start using straight away

- Communicating honestly with donors, members and beneficiaries after an incident

- Habits that reduce the next incident: regular checks, staff reminders, a dedicated inbox for reporting phishing

+ Group exercise: a simulated incident (a phishing email with a malicious attachment), followed by a debrief

- apply the first-hour steps of incident response, including who to contact externally

Lecture

Real-world scenarios / examples

Practical exercises

Group work