Industry pricing
Cyber insurance cost for nonprofits and charities in 2026
Nonprofits carry the lowest average cyber premium of any common sector, but donor databases and volunteer access create a distinctive risk profile.
Updated August 2026. About a 6 minute read. Written by the Cost of Cyber Insurance editorial desk.
A small nonprofit buying a 1 million dollar aggregate limit pays about 679 dollars a year in 2026, roughly a third below the small business average near 999 dollars.
Lower revenue and smaller data holdings explain most of the gap. The risk is not zero though. Donor records combine names, addresses, giving history and sometimes payment details, and a leak damages the trust the organization depends on to raise money.
Typical annual premium
679 dollars a year
Small business, 1 million dollar aggregate limit. Most quotes land between 450 dollars and 1,600 dollars.
What drives premiums in this industry
Donor and beneficiary records
Giving history is sensitive in a way that a customer list is not, and beneficiary records in social service organizations can be highly sensitive. Volume is usually modest, which keeps notification cost contained.
Volunteers and rotating access
Volunteers, trustees and short term staff often need access to systems and then leave. Accounts that are never disabled are the most common weakness underwriters find in this sector.
Constrained technology budgets
Donated equipment, older laptops and a part time technology provider are normal. Carriers are used to this and do not penalise it heavily, but they do expect multifactor authentication and current backups regardless of budget.
Grant and payment fraud
Organizations moving grant funds or paying partner agencies face the same payment redirection fraud as any business, often with fewer approval layers to stop it.
Typical range for a 1 million dollar limit
Most small nonprofits pay between 450 and 1,600 dollars for a 1 million dollar limit. Organizations holding health or social care records for beneficiaries sit higher, closer to healthcare pricing than to the nonprofit average.
Across all small businesses buying a 1 million dollar aggregate limit, the market average sits near 999 dollars a year in 2026. Treat every figure on this page as an approximate market average rather than a quote. Individual premiums vary widely because carriers price the same business very differently depending on appetite, claims history and the controls you can evidence.
What underwriters ask about
- How many donor and beneficiary records do you hold, and do any include health or financial detail
- Is multifactor authentication enabled on email and on the donor database
- How do you remove access when a volunteer or trustee leaves
- Who provides your technology support and what are they responsible for
- Are backups automatic, and when were they last restored
- Do you take donations directly, or through a hosted platform that handles card data
- Does more than one person approve outgoing payments
Small answers matter here. Turning on multifactor authentication and running a quarterly account review will often produce a better outcome than anything else available on a nonprofit budget.
How to bring the number down
- Use a hosted donation platform so card data never touches your systems
- Run a quarterly review of who still has access and disable dormant accounts
- Turn on multifactor authentication across email and the donor database
- Set a two person approval rule for outgoing payments above a modest threshold
Estimate your own premium
Sector averages are a starting point, not a quote. Run your revenue, headcount, record volume, controls and desired limit through the cyber liability insurance cost calculator for a range built around your own business.