Nonprofits hold sensitive donor information that requires protection through comprehensive incident response plans that address detection, containment, communication, and recovery from data security incidents.