Tech Impact's own Karen Graham and Francis Johnson recently presented a webinar about nonprofit technologies with Nonprofit Quarterly. Here, they choose a few audience questions on which to go deeper. Questions are lightly edited for clarity and brevity.
What happens when an employee leaves? How do you collect equipment? How do you delete org files from personal devices?
Karen: I encountered this several years ago when a member of my all-virtual team left. She had been using her own laptop and printer, which was typical under that organization’s policies. That was good and bad. The good part was that we didn’t have to collect any equipment when she left. The bad part was that, though we 100 percent trusted this person, we had no way of really knowing whether she had kept organization data or software licenses on that computer. All our data and files were online. We changed every password. Knowing what I do now about security, and how the threats and tools have both evolved, I would probably insist on organization-owned computers.
Francis: Whether your organization owns the machines or not, being able to centrally manage them is vital. You can use a Single Sign-On (SSO) tool like Azure Active Directory, which is for Microsoft 365, that can lock people out of organization devices once their employment ends. Also, encrypt the drives—that way, even if someone tried to put the hard drive into a different computer, they wouldn’t be able to get at the data.
For mobile devices, especially if they are employee owned, you can use a Mobile Device Management (MDM) tool which remotely wipes data from work apps or locks people out of work apps, without touching their personal stuff. Microsoft’s MDM solution is called Intune. Google has a similar setup and Google Enterprise now has nonprofit pricing.
As far as collecting the devices, at our organization we provide postage for people to ship the equipment back to our office.
How do you protect against sexual and racial harassment in this environment? For example, sharing inappropriate memes or using chat functions to harass.
Francis: There are a few technical options but it’s really about the culture of your organization. Anything you do in enterprise chat or messaging like Teams, Google Chat, and Slack is saved, and an administrator could gain access to that. Same thing with email. You should inform people that these channels are not truly private and that people should be respectful in their communications. Have a policy about harassment and put someone in charge of reviewing complaints and evidence.
Karen: This is something that should go in your acceptable use policy: “Use of the organization’s technology platforms for harassment or intimidation is strictly forbidden,” or something like that. Ask your human resources and legal counsel for help on this one. By the time something gets posted, the damage is done, so the main thing it to establish a culture where harassment isn’t okay.
Our calls are routed to our personal phones. I don’t love this because it means calling back on a personal line (which means vendors then have my cell number). Recommended workarounds for this?
Francis: There are a few different options here. A lot of Voice Over Internet Protocol (VOIP) digital phone systems have a soft phone option that doesn’t make use of your phone at all. Tools like Microsoft Teams give you an option to make and receive calls, but they don’t have auto attendant, extensions, or some of the other features you might be used to. Now there are hybrid options such as Teams paired with a VOIP provider. Check in with your current phone provider. There’s a good chance they have a good option and you don’t need to switch, just upgrade your account.
Karen: A virtual phone system also has the advantage of low equipment needs, whether you are in an office or not. I haven’t had a physical work phone in years. I just use an app on my computer or mobile phone to make and receive calls with my work number, manage voicemail, forward calls, and so on. It’s one less piece of equipment to buy and one less clunky item on my desk.
Do you have sample policies? Templates?Karen: You bet! The free Nonprofit Technology Policy Workbook has questions and worksheets to help you create and document policies for your organization. Here are some additional technology policy templates and samples:
- Model Acceptable Use Policy from SANS Institute
- Model Password Policy from SANS Institute
- Telecommuniting Policies and Procedures from Society for Human Resource Management
- Bring Your Own Device Policy sample from IT Manager Daily
Francis: One last thing, be intentional about who are the best people to provide input to improve upon your policies. Consider setting up a tech policy committee representing various departments and levels of the organization.
Karen Graham is Tech Impact's Managing Director of Education and Outreach. Francis Johnson is Tech Impact's Managing Director of Technology Services.