WEBVTT
00:00:23.570 --> 00:00:27.489
Thank you for joining Community IT for this podcast, part one.
00:00:27.489 --> 00:00:34.769
Subscribe wherever you listen to podcasts and leave us a rating to help others find this leadership resource for nonprofits.
00:00:34.769 --> 00:00:38.049
Listen for part two in your podcast feed.
00:00:40.609 --> 00:00:51.170
Welcome everyone to the Community IT Innovators webinar on doing IT assessments at nonprofits with Nuradeen Aboki and Johan Hammerstrom.
00:00:51.170 --> 00:00:56.609
There are a lot of reasons why a nonprofit or a foundation might want to do an IT assessment.
00:00:56.609 --> 00:01:00.129
It might be recommended as part of a grant you're receiving.
00:01:00.129 --> 00:01:08.769
You may have a change in personnel or leadership, and the new person wants an outside assessment to understand your systems and your priority projects.
00:01:08.769 --> 00:01:13.569
You may be changing providers, and the new MSP starts off with an assessment.
00:01:13.569 --> 00:01:19.730
So whether you've had an assessment done before or this is your first one, it helps to know what you're getting into.
00:01:20.289 --> 00:01:21.810
My name is Carolyn Woodard.
00:01:21.810 --> 00:01:25.810
I'm the outreach director for community IT, and I'll be the moderator today.
00:01:25.810 --> 00:01:31.009
I'm very happy to hear from our experts, but first I want to go over our learning objectives.
00:01:31.009 --> 00:01:35.009
So today we want to focus on these themes.
00:01:35.009 --> 00:01:36.929
What is an IT assessment?
00:01:36.929 --> 00:01:41.009
What does it typically include, and why should you have one done?
00:01:41.009 --> 00:01:44.689
What does a healthy nonprofit IT environment look like?
00:01:44.689 --> 00:01:46.449
Is there a checklist?
00:01:46.449 --> 00:01:50.769
And what if your assessment tells you it is time to change your IT support?
00:01:50.769 --> 00:01:52.929
What are typical next steps?
00:01:52.929 --> 00:01:55.969
So, Noura, would you like to introduce yourself?
00:01:57.170 --> 00:01:58.369
Yeah, thanks, Carolyn.
00:01:58.369 --> 00:02:02.449
Uh, I'm Nuradeen Aboki, a senior consultant at Community IT.
00:02:02.449 --> 00:02:20.689
In my work with nonprofit assessments are really about helping organizations understand what their network is today and uh where risk or if you you could say even friction may show up, and what practical steps uh can help them move forward.
00:02:20.689 --> 00:02:35.889
So I'll be focusing on what uh the process looks like uh from the inside, uh, what to look for, uh how we organize uh findings and how recommendations become something a nonprofit can actually use.
00:02:35.889 --> 00:02:39.569
And now I'll ask Johan to introduce himself.
00:02:40.049 --> 00:02:41.009
Yeah, thank you, Nura.
00:02:41.009 --> 00:02:42.210
Good afternoon, everyone.
00:02:42.210 --> 00:02:43.569
Thanks for joining us today.
00:02:43.569 --> 00:02:43.889
Uh,
00:02:43.889 --> 00:02:47.650
My name is Johan Hammerstrom, I'm the CEO at Community IT.
00:02:47.650 --> 00:02:53.169
I've been helping nonprofit organizations with IT support for over 25 years.
00:02:53.169 --> 00:03:01.969
And in that time, I've uh had the opportunity, the privilege to assess a lot of nonprofit IT environments.
00:03:01.969 --> 00:03:15.250
And I'm very excited today because uh we're gonna talk a little bit about the current version of assessment that we do at Community IT, which has really matured a lot in the last uh three or four years.
00:03:15.250 --> 00:03:24.289
And I think it's really matched what we've found to be a growing priority on IT maturity in the nonprofit sector.
00:03:24.289 --> 00:03:28.689
So we're we're excited to be here with you today, and thank you for joining us.
00:03:29.409 --> 00:03:34.370
And before we begin, if you're not familiar with community IT, a little bit about us.
00:03:34.370 --> 00:03:38.769
We are a 100% employee-owned managed services provider.
00:03:38.769 --> 00:03:41.329
We provide outsourced IT support.
00:03:41.329 --> 00:03:50.370
We work exclusively with nonprofit organizations, and our mission is to help nonprofits accomplish their missions through the effective use of technology.
00:03:50.370 --> 00:03:55.490
We are big fans of what well-managed IT can do for your nonprofit.
00:03:55.490 --> 00:04:00.530
We serve nonprofits across the United States, and we've been doing this for 25 years.
00:04:00.689 --> 00:04:11.329
We are technology experts and are consistently given an MSP 501 recognition for being a top MSP, which is an honor we just received again in 2026.
00:04:11.329 --> 00:04:16.769
And we believe we're the only MSP on the list serving nonprofits exclusively.
00:04:16.769 --> 00:04:21.490
I want to remind everyone for these presentations that community IT is vendor agnostic.
00:04:21.490 --> 00:04:27.569
We only make recommendations to our clients and we only base those on their specific business needs.
00:04:27.569 --> 00:04:32.930
We never try to get a client into a product because we get some kind of incentive or benefit from that.
00:04:32.930 --> 00:04:36.370
We do consider ourselves a best of breed provider.
00:04:36.370 --> 00:04:43.250
So it's our job to know the landscape, what tools are available, reputable, and widely used.
00:04:43.250 --> 00:04:49.810
And we make recommendations on that base basis for our clients based on their business needs, priorities, and budget.
00:04:50.129 --> 00:04:55.250
So we're recording this presentation today without an audience because of some scheduling issues.
00:04:55.250 --> 00:05:07.490
So while we don't have an audience QA today, if you do have questions about this topic, you can always join us and our experts at any time in our community on Reddit at r slash nonprofit IT management.
00:05:07.490 --> 00:05:10.689
And we try to answer questions over there within about a week.
00:05:10.689 --> 00:05:16.769
You can also contact us through our website at www.community it.com.
00:05:17.889 --> 00:05:19.649
A little bit more about us.
00:05:19.649 --> 00:05:25.409
Our mission is to create value for the nonprofit sector through well-managed IT.
00:05:25.409 --> 00:05:34.129
We also identify four key values as employee owners that define our company: trust, knowledge, service, and balance.
00:05:34.129 --> 00:05:52.769
We seek to always treat people with respect and fairness, to empower our staff, clients, and our sector to understand and use technology effectively, to be helpful with our talents, and we recognize that the health of our communities is vital to our well-being and that work is only a part of our lives.
00:05:52.769 --> 00:06:03.250
And with that, I want to turn it over to Johan, who I think can walk us through this slide of what is an IT assessment at a nonprofit.
00:06:03.969 --> 00:06:05.329
Yeah, thank you, Carolyn.
00:06:05.329 --> 00:06:19.009
Uh, we wanted to talk a little bit uh specifically about the approach that we take to IT assessments, which is very well defined, something that has a very specific methodology associated with it.
00:06:19.009 --> 00:06:25.969
It's possible to get an IT assessment that can cover all kinds of different activities.
00:06:25.969 --> 00:06:31.569
And if you bring on a new IT support provider, they might conduct an assessment of your network.
00:06:31.569 --> 00:06:44.930
If you're uh working with a third-party consultant, particularly to select a new software solution, they may assess certain aspects of your data and your IT systems that you're using.
00:06:45.170 --> 00:06:50.449
But at Community IT, when we talk about an IT assessment, we're talking about something very specific.
00:06:50.449 --> 00:06:53.170
And we wanted to define that at the outset.
00:06:53.170 --> 00:07:00.689
So, from our perspective, an IT assessment is a structured review of all aspects of IT.
00:07:00.689 --> 00:07:11.170
So it's comprehensive and it's intended to look not just at one particular component of an IT, of an organization's IT environment, but to look at all of those components.
00:07:11.329 --> 00:07:13.569
So we look at IT systems.
00:07:13.569 --> 00:07:23.009
So all your laptops, your cloud-hosted systems, all of your applications, the different solutions that you're using to do your work.
00:07:23.009 --> 00:07:26.050
And that's pretty common and pretty typical.
00:07:26.209 --> 00:07:28.449
But we also look at IT operations.
00:07:28.449 --> 00:07:43.569
So we don't want to look just at the technology that is being used, but we want to look at how it's being maintained, how it's being supported, how the staff in the organization are being supported in their use of those systems.
00:07:43.569 --> 00:07:51.569
So IT operations is a critical part of uh the uh evaluation that's being done during an assessment.
00:07:51.569 --> 00:08:00.050
We especially want to look at risks in this day and age, that's critically important, particularly uh cyber security-related risks.
00:08:00.689 --> 00:08:05.649
We also look at IT governance, how are IT decisions being made in the organization?
00:08:05.649 --> 00:08:09.649
How is the IT team uh formed?
00:08:09.649 --> 00:08:11.649
Who's overseeing that team?
00:08:11.649 --> 00:08:16.529
Um, how is their performance being monitored and evaluated over time?
00:08:16.769 --> 00:08:27.250
And then finally, looking at future needs, where is uh the organization headed and how is technology evolving to meet the future needs of the organization?
00:08:27.810 --> 00:08:32.690
So the IT assessment is supposed to be comprehensive and very thorough.
00:08:32.690 --> 00:08:39.570
For that reason, it usually takes seven to nine weeks to conduct a complete IT assessment.
00:08:39.570 --> 00:08:44.450
There are a variety of activities that are being conducted during that period of time.
00:08:44.450 --> 00:08:57.009
Those activities include interviews with key stakeholders, and and that and the number of interviews that need to be conducted really varies based on the circumstances and the situation of the organization.
00:08:57.009 --> 00:09:07.889
But usually it varies, excuse me, between you know four, three or four interviews on the on the low end and 10 to 12 interviews uh on the high end.
00:09:07.889 --> 00:09:14.210
Oftentimes we'll do group interviews, so we'll meet with uh multiple stakeholders at the same time.
00:09:15.169 --> 00:09:19.009
In addition to the interviews, we're conducting technical discovery.
00:09:19.009 --> 00:09:30.289
Oftentimes that means running tools that are scanning the network for vulnerabilities, for example, or looking at other aspects of the various IT systems.
00:09:30.289 --> 00:09:52.450
Uh, it always involves hands-on uh evaluation of the different IT systems, how they've been configured and how they're being managed, uh, looking at analysis of uh reports such as um ticket histories, number of tickets that are being uh generated on an ongoing basis and supported by the organization.
00:09:52.450 --> 00:09:56.929
Uh validating things like documentation.
00:09:56.929 --> 00:10:13.330
So we we always want to look at any documents that currently exist, whether it's IT policies, uh network or uh IT system documentation, data management, and then validating those documents to some extent as part of the assessment process.
00:10:14.049 --> 00:10:20.370
Once all that information is uh gathered, then the real work begins, synthesizing it.
00:10:20.370 --> 00:10:25.250
And that's something that um takes a significant amount of time and effort.
00:10:25.250 --> 00:10:31.730
And once that synthesis is completed, it results in recommendations for the organization.
00:10:31.730 --> 00:10:40.210
How can the IT environment be improved to better meet the long-term needs and strategic objectives of the organization?
00:10:40.210 --> 00:10:44.610
So that leads into planning and roadmap work, which we'll talk about.
00:10:44.610 --> 00:10:52.210
And we're gonna get into more details in this presentation as to the deliverables that come out of the IT assessment.
00:10:52.210 --> 00:10:52.610
Uh,
00:10:52.610 --> 00:11:06.450
Because it's such a thorough uh and involved process, the IT assessments typically cost between $20,000 and $30,000, uh, varying based on the size of the organization, the number of systems that are being evaluated.
00:11:06.450 --> 00:11:18.850
Um, sometimes it can be a little bit less than that, sometimes it can be a little bit more, but in general, that range uh works well for um doing the bulk of the work that needs to be done for an assessment.
00:11:18.850 --> 00:11:25.009
Um we're gonna talk a little bit more about why you would want to get an assessment done.
00:11:25.009 --> 00:11:27.730
So I'll kind of leave that uh for the moment.
00:11:28.529 --> 00:11:38.049
Before we go on to the next slide, um, I feel like I have to ask, do you have advice on how to vet an assessment provider?
00:11:38.049 --> 00:11:48.049
Because I would expect that sometimes some companies might use a quote unquote assessment really as just a sales part of their sales.
00:11:48.049 --> 00:11:54.689
So they're going to give you an assessment that tells you that they're the only one who can solve any of your problems and you should hire them right away.
00:11:54.689 --> 00:11:55.970
So, um,
00:11:55.970 --> 00:12:02.769
What can you look for in a vendor when you're talking to them to try and get you know a thorough agnostic assessment?
00:12:02.769 --> 00:12:07.730
And is there any way to tell like how competent they would be at giving an assessment?
00:12:08.529 --> 00:12:10.689
Well, I think that that's a great question.
00:12:10.689 --> 00:12:21.009
And I think the first thing to remember is that um what one firm calls an assessment may be very different from what another firm calls an assessment.
00:12:21.169 --> 00:12:29.649
And that's part of the reason that we wanted to uh do this webinar is to just kind of clarify what we mean by an IT assessment.
00:12:29.649 --> 00:12:32.049
And from our perspective, it's comprehensive.
00:12:32.049 --> 00:12:37.809
It's uh it covers the entire the organization's entire approach to IT.
00:12:37.809 --> 00:12:39.169
Um
00:12:39.169 --> 00:12:50.929
Aa lot of managed service providers, for example, will say they'll they'll do a free assessment, you know, either as part of the sales process or at the beginning of um of the engagement.
00:12:50.929 --> 00:12:54.049
And that's very different from what we're talking about.
00:12:54.049 --> 00:12:57.570
It may be exactly what the organization needs.
00:12:57.570 --> 00:13:12.850
You know, if an organization doesn't need a comprehensive evaluation that looks at IT operations management and governance, then that sort of free assessment that that begin you know happens at the beginning of an engagement uh may be sufficient.
00:13:13.009 --> 00:13:25.169
And in some ways, that's what we do when we onboard a new client for our managed services, we do sort of conduct a similar sort of evaluation of the systems that we're going to be supporting.
00:13:25.169 --> 00:13:36.370
Uh, we would we would uh distinguish that from a full-blown assessment of the kind that we're discussing in this in this webinar today for organizations.
00:13:36.529 --> 00:13:48.289
I mean, I think in terms of how to evaluate uh uh vendors or providers that are offering an assessment, I would just ask them to share their methodology.
00:13:48.289 --> 00:13:54.049
You know, how do they what's the framework that they're using for conducting the assessment?
00:13:54.049 --> 00:13:57.009
Um, have them share sample reports.
00:13:57.009 --> 00:14:10.929
So they should be able to share kind of a generic report from previous assessments that they've done, and then ask for references so you can talk to other nonprofit organizations that they've uh conducted assessments for.
00:14:10.929 --> 00:14:20.450
And I think that'll give you a good sense of whether or not their approach to doing assessments is the right fit for what your organization is looking for.
00:14:20.610 --> 00:14:24.610
Because it's possible, you I mean, there's a hundred thousand dollar assessments.
00:14:24.610 --> 00:14:27.490
We don't do those, but there are firms that do.
00:14:27.490 --> 00:14:38.769
And there may be, you know, some organizations really benefit from uh a $100,000 assessment that maybe takes not nine weeks, but nine months to complete.
00:14:38.769 --> 00:14:50.769
So um we're not saying that this is necessarily the only way to do an assessment, but I think it'll be clear as we go through the presentation today what what it is that we do.
00:14:50.769 --> 00:15:00.529
And hopefully that sheds some light on you know whether or not it's the right fit, you know, for what a particular organization is looking for.
00:15:01.250 --> 00:15:17.649
So it sounds like the organization, as they're starting on this process of thinking, I probably need an IT assessment, they need to get their assessment objectives kind of under understand what their objectives are to begin with.
00:15:19.009 --> 00:15:24.370
Yeah, you should be very clear on what you hope why you're doing the assessment, what you hope to get out of it.
00:15:24.370 --> 00:15:28.450
I think that's a good uh segue to our next slide.
00:15:28.450 --> 00:15:32.850
Thank you, Carolyn, for that uh smooth transition.
00:15:32.850 --> 00:15:35.889
Um so I'll I'll hand it over to Nura.
00:15:35.889 --> 00:15:37.169
I've been talking a lot.
00:15:37.169 --> 00:15:37.970
And uh
00:15:37.970 --> 00:15:42.129
Nura, can you talk a little bit about when we conduct an assessment?
00:15:42.129 --> 00:15:43.409
What are the objectives?
00:15:43.409 --> 00:15:46.529
What are what are we hoping to get out of that assessment process?
00:15:46.929 --> 00:15:47.889
Well, thank you, Johan.
00:15:47.889 --> 00:15:56.210
Uh, you know, objectives of an assessment are intentionally broader than uh the computer just working.
00:15:56.210 --> 00:16:06.529
You know, so uh we are looking at the IT environment as a whole, as you mentioned, Johan, the IT systems, the infrastructure, the management, and governance.
00:16:06.689 --> 00:16:13.970
So a strong assessment uh should help the organization develop a strategic technology plan for implementing recommendations.
00:16:13.970 --> 00:16:26.450
Uh that means uh we are not just naming gaps, uh, we are helping leadership understand priorities, sequencing, uh dependencies and what will be realistic.
00:16:26.450 --> 00:16:31.090
Because oftentimes we get we could find an assessment that's too technical.
00:16:31.090 --> 00:16:41.090
And uh really sort of taking an approach where you're looking at a strategy around the assessment and the objectives of the assessment is very important.
00:16:41.409 --> 00:16:44.529
Another key objective is uh alignment.
00:16:44.529 --> 00:16:51.970
Uh so IT touches leadership, staff, you know, finance, development, operations, uh, the board.
00:16:51.970 --> 00:16:59.809
Uh so if those groups uh are not aligned on what matters most, uh it becomes very difficult to invest uh wisely.
00:16:59.809 --> 00:17:04.690
And sometimes an assessment uh supports uh organizational change.
00:17:04.690 --> 00:17:19.570
Uh uh that might mean uh clarifying ownership, uh adjusting a support model, uh preparing uh for leadership transition or sequencing uh a larger technology initiative.
00:17:21.330 --> 00:17:29.890
And I think that that speaks now to the um some of the scenarios that we find uh when we're doing an assessment.
00:17:29.890 --> 00:17:34.690
Leadership transition, that that is often when assessments get done.
00:17:34.690 --> 00:17:45.490
Um previous leadership has departed, new leadership is coming in, um, maybe IT isn't fully meeting the needs of the organization.
00:17:45.490 --> 00:17:46.050
Um
00:17:46.050 --> 00:17:51.890
Oftentimes organizations change, or organizations don't change.
00:17:51.890 --> 00:17:57.890
You know, the environment around the organization has changed, but the organization has kind of remained static.
00:17:57.890 --> 00:18:06.610
New leadership comes in, they want to under, they want to get a complete picture, a third-party sense of what's happening with IT.
00:18:06.770 --> 00:18:13.330
So those are some of the scenarios in which um assessments are are getting completed.
00:18:13.330 --> 00:18:30.370
I think, you know, just to kind of reiterate the point that it's typically not done, you know, a lot of times now um auditors, cyber insurance providers, even the board will ask the organization to conduct a security assessment.
00:18:30.370 --> 00:18:34.050
Well, oftentimes they're just asking for like a vulnerability scan.
00:18:34.050 --> 00:18:36.530
Uh, they're asking for something very basic.
00:18:36.530 --> 00:18:45.330
Um, it's probably best not to do a comprehensive assessment in that case because you're gonna overdo the effort for what's needed.
00:18:45.330 --> 00:18:45.810
Uh,
00:18:45.810 --> 00:19:03.570
But other times, you know, maybe a new CEO is coming into the organization and they're they're seeing the need for IT uh to be a strategic enabler of the organization's mission, and they're perhaps wondering is it capable of doing that?
00:19:03.570 --> 00:19:08.930
That'd be a perfect scenario to conduct one of these comprehensive assessments.
00:19:08.930 --> 00:19:17.010
And um, I think uh the the things that we look at during the assessment process will also uh shed some light on that.
00:19:17.010 --> 00:19:17.100
\
00:19:17.100 --> 00:19:24.050
So maybe Nara, you could talk a little bit about the different categories that we're evaluating during the assessment process.
00:19:24.450 --> 00:19:32.530
Yeah, these are four categories that you see on on the slide deck uh you know, give the structure of the assessment.
00:19:32.530 --> 00:19:48.930
Uh they help uh organization finds findings, uh they do help with the organization of the findings so leadership can see patterns inside of this random list of issues that we may discover during the evaluation process.
00:19:49.170 --> 00:20:22.130
The first uh is the infrastructure and core systems, and there you can see a list of uh core infrastructure systems such as uh network connectivity, endpoints, uh identity, some productivity application platforms that the organization may be using if organization is still in the cloud or has on-premises uh servers, uh, and uh any support lifecycle uh management of the endpoints and hardware is all considered as part of the infrastructure on core IT systems.
00:20:22.370 --> 00:20:30.290
Then another category we look at is the data and webslash uh you would say digital platforms.
00:20:30.290 --> 00:20:50.930
This is where you see your CRM uh uh systems that we take a look at uh reporting system, website, uh, engagement platform, business applications, integrations, uh, as well as uh how information flows through the organization, because this is where the intersection of data, web, and digital platforms uh lie.
00:20:52.050 --> 00:21:00.370
Another critical, I would say crucial category that is very important in assessment is to look at your security and compliance uh areas.
00:21:00.370 --> 00:21:19.250
And this has to do with cybersecurity controls, uh identity and access, maybe backup and recovery, data protection specifically, uh and then uh permissions, you know, monitoring incident readiness and any risk or compliance obligations that your organization may have.
00:21:19.250 --> 00:21:23.090
Uh security is becoming more and more important.
00:21:23.410 --> 00:21:43.090
We uh approach uh we utilize best practices, best practices in terms of the industry uh from a cybersecurity standpoint and best practices that nonprofit organizations actually leverage on, and that's that's what we use to assess those uh security and compliance for our clients.
00:21:43.330 --> 00:21:47.970
And then lastly, there the fourth category has to do with governance and strategy.
00:21:47.970 --> 00:21:54.530
Uh governance is so important that uh who are those making the decisions, how are they making decisions?
00:21:54.530 --> 00:22:03.810
Are there policies that are uh that are already established in the organization, or does the organization need to improve on its IT policies?
00:22:03.810 --> 00:22:11.410
Uh what as how is the budgeting done uh for from an IT standpoint when it comes to technology investments?
00:22:11.410 --> 00:22:21.970
Uh, vendor management is something we look at because these days we find in organizations utilize several vendors, but how are those vendors managed and uh are the SLAs?
00:22:21.970 --> 00:22:26.770
Or service level agreements that are being met for those vendors.
00:22:27.170 --> 00:22:33.090
Then the ownership of IT in general at the organization, we take a look at that as well.
00:22:33.090 --> 00:22:34.850
And also leadership alignment.
00:22:34.850 --> 00:22:48.610
Then change capacity is important because as technology is evolving rapidly, it's quite important to understand what is the organization's change capacity for technological changes.
00:22:48.610 --> 00:22:50.850
And then a roadmap execution.
00:22:50.850 --> 00:22:57.010
If the organization has a roadmap, how are they planning to execute and implement that roadmap?
00:22:57.010 --> 00:23:06.370
If they don't have one, then the outcome of an assessment will also produce a roadmap and with guidance on how to execute on that roadmap.
00:23:07.810 --> 00:23:14.450
And this is a, I think it's important to note that this is an overview of what's being assessed.
00:23:14.450 --> 00:23:24.930
You know, these are the categories, but within each category, there are literally dozens of different specific points of evaluation.
00:23:25.170 --> 00:23:36.290
So in the infrastructure and core systems uh category, we're we're looking at antivirus protection and how it's being managed and how it's running.
00:23:36.290 --> 00:23:43.170
Uh we're looking at how the um environment is being managed and configured.
00:23:43.170 --> 00:23:46.210
Are the are do mobile devices have access?
00:23:46.210 --> 00:23:49.970
And if so, are you know are they being proactively managed?
00:23:50.770 --> 00:23:59.970
In the data and web, you know, looking um at things like uh data integrity, is there a retention policy governing the data?
00:23:59.970 --> 00:24:05.650
Um, how is SEO being used uh to drive traffic to the website?
00:24:05.650 --> 00:24:06.130
Um
00:24:06.130 --> 00:24:19.090
Security and compliance, looking at um, you know, the vulnerability scans, as we had mentioned earlier, uh, but also um, you know, looking at incidents that may have happened over the past year.
00:24:19.090 --> 00:24:27.330
Uh and then governance and strategy looking at uh, as Nura said, policies, um operational management, IT leadership.
00:24:27.570 --> 00:24:35.490
So it's an extremely thorough evaluation that's being conducted in these uh four different categories.
00:24:35.490 --> 00:24:45.330
And there's also an extremely um well-defined approach for evaluating uh all of these different categories.
00:24:45.330 --> 00:24:50.050
So Nura, maybe you could walk us through that approach a little bit.
00:24:51.170 --> 00:24:52.130
Yeah, thank you, Johan.
00:24:52.130 --> 00:24:58.610
And you know, it's uh uh the approach uh is straightforward as we put it here.
00:24:58.610 --> 00:25:03.970
You know, we try to simplify it into discover, evaluate, uh, align and plan.
00:25:04.370 --> 00:25:20.370
But in each uh of this uh processes uh that it is described as part of the approach lies uh a tremendous amount of work that goes into ensuring the discovery phase gathers contacts thoroughly.
00:25:20.370 --> 00:25:33.010
You know, this would include interviews, uh review of documentation, uh system inventory reviews, discussion around pain points, an organization may be feeling our department or a leader.
00:25:33.010 --> 00:25:37.570
So as we go through, we are taking notes of these pain points.
00:25:37.730 --> 00:25:39.250
Then their prioritization.
00:25:39.250 --> 00:25:42.690
Uh, what is the organization's priorities when it comes to IT?
00:25:42.690 --> 00:25:46.530
Uh, do they have something already in view?
00:25:46.530 --> 00:25:51.970
Uh are there changes to their mission or priorities that will impact their mission?
00:25:51.970 --> 00:26:11.970
So we want to get that early in that discovery phase and also talk about security risk to the organization just to understand what is their feel, what are there any eminent risks, are there any known risks uh before we actually begin to evaluate the moving into the evaluation phase.
00:26:12.050 --> 00:26:15.330
And then that evaluation phase, we look at the current state.
00:26:15.330 --> 00:26:18.050
Uh, as Johan said, is quite thorough.
00:26:18.050 --> 00:26:31.570
Uh, each of those categories, uh, the four categories, we go do a deep dive into each one of them, depending on the systems that the organization have, whether it's infrastructure or the core systems, we begin with those.
00:26:31.570 --> 00:26:39.410
Uh, running our tools as we do the evaluation of uh the network or the technology infrastructure that they have.
00:26:39.410 --> 00:26:53.970
Um, that keeps the analysis organized, honestly, once we go through those four uh high-level categories, uh, and it helps us avoid focusing too much narrowly on just one specific tool or one technology issues.
00:26:54.130 --> 00:27:09.010
But we are taking notes uh along the way during the discovery phase and even in our evaluation, as we find, for instance, a risk an organization has not implemented multi-factor authentication for its systems, administrators, uh, accounts.
00:27:09.010 --> 00:27:10.370
You know, that's a risk.
00:27:10.370 --> 00:27:24.370
We note that down, and and during our project check-ins, we report that and see if there's any early actions we could take to remediate that because there's some risks that just can't wait as we go through the evaluation process.
00:27:24.530 --> 00:27:29.970
Then we shift into the uh uh after the evaluation, we move into the alignment phase.
00:27:29.970 --> 00:27:41.810
Here uh we connect the findings uh to the leadership priorities of staff experience, uh, mission, budget, and change or capacity for change.
00:27:41.970 --> 00:27:45.090
And this is where the nonprofit context really matters.
00:27:45.090 --> 00:27:48.450
As uh the findings could be a long list.
00:27:48.450 --> 00:28:03.090
Uh, we really want to make sure that they are relevant uh to the nonprofit organization that is going through that uh assessment, and we take their prioritization or their priorities into heart as we uh trying to find that alignment for them.
00:28:03.330 --> 00:28:19.490
And then finally, we move into the planning phase, and this is where we convert those findings, uh, what we've discovered for the findings into recommendations, as well as a strategic technology plan, and which eventually arrives at the IT roadmap.
00:28:19.490 --> 00:28:23.490
And we'll talk some more about the deliverables uh very soon.
00:28:23.490 --> 00:28:31.010
But the framework, you know, as you can see, is category category-based, but the output has to be practical.
00:28:31.010 --> 00:28:36.450
For instance, what to do, why it matters, and how to sequence it.
00:28:37.170 --> 00:28:52.770
I have a quick question for you, Nura, because having been on the other side of the desk in this also, I wonder how often it happens when you're doing those initial interviews that the people really know what the risks are and they tell you what the pain points are.
00:28:52.770 --> 00:28:57.970
Um, or does it happen fairly often that you discover a risk that they weren't even aware of?
00:28:58.290 --> 00:29:07.010
So in the initial phase, uh those interviews reveal what matters to the users or to the staff or to the organization, what they know.
00:29:07.010 --> 00:29:15.970
Whether it's their day-to-day work, uh, they are struggling with a report that they're unable to generate or they can't find data coherently, they need a dashboard.
00:29:15.970 --> 00:29:30.370
So they talk about their needs, you know, to them, uh that may not necessarily constitute risk, but sometimes the leaders of the organization uh may find that really everyone is using open AI, for instance.
00:29:30.370 --> 00:29:44.130
Just to give you an example, an AI that is open source, that is not uh uh a paid account, or there's just risk of proliferation of exfiltration of data, uh, which a leader is just concerned and nervous about.
00:29:44.130 --> 00:29:46.130
And then they bring that up.
00:29:46.370 --> 00:30:02.050
But during the technical uh evaluation or the evaluation phase, uh this is where we are looking at uh the uh infrastructure itself and going in deep, as Johan mentioned, we're reviewing configuration.
00:30:02.050 --> 00:30:09.410
And sometimes an organization that might been around for 10 years, they've been through a number of IT support teams.
00:30:09.410 --> 00:30:14.050
Uh, there could be some misconfiguration that has not been resolved.
00:30:14.050 --> 00:30:30.290
And this is where we take a look deeply at those systems and to make sure they have some basic or baseline uh standard configuration that is uh kind of uh error-free, if you will, or that doesn't have any misconfiguration in them.
00:30:30.290 --> 00:30:38.290
But if we find one and we find that it's uh risky to the organization based on our criteria, we report that immediately.
00:30:39.650 --> 00:30:43.410
Thank you for joining Community IT for this podcast, part one.
00:30:43.410 --> 00:30:50.770
Subscribe wherever you listen to podcasts and leave us a rating to help others find this leadership resource for nonprofits.
00:30:50.770 --> 00:30:53.970
Listen for part two in your podcast feed.
00:00:23.570 --> 00:00:27.489
Thank you for joining Community IT for this podcast, part one.
00:00:27.489 --> 00:00:34.769
Subscribe wherever you listen to podcasts and leave us a rating to help others find this leadership resource for nonprofits.
00:00:34.769 --> 00:00:38.049
Listen for part two in your podcast feed.
00:00:40.609 --> 00:00:51.170
Welcome everyone to the Community IT Innovators webinar on doing IT assessments at nonprofits with Nuradeen Aboki and Johan Hammerstrom.
00:00:51.170 --> 00:00:56.609
There are a lot of reasons why a nonprofit or a foundation might want to do an IT assessment.
00:00:56.609 --> 00:01:00.129
It might be recommended as part of a grant you're receiving.
00:01:00.129 --> 00:01:08.769
You may have a change in personnel or leadership, and the new person wants an outside assessment to understand your systems and your priority projects.
00:01:08.769 --> 00:01:13.569
You may be changing providers, and the new MSP starts off with an assessment.
00:01:13.569 --> 00:01:19.730
So whether you've had an assessment done before or this is your first one, it helps to know what you're getting into.
00:01:20.289 --> 00:01:21.810
My name is Carolyn Woodard.
00:01:21.810 --> 00:01:25.810
I'm the outreach director for community IT, and I'll be the moderator today.
00:01:25.810 --> 00:01:31.009
I'm very happy to hear from our experts, but first I want to go over our learning objectives.
00:01:31.009 --> 00:01:35.009
So today we want to focus on these themes.
00:01:35.009 --> 00:01:36.929
What is an IT assessment?
00:01:36.929 --> 00:01:41.009
What does it typically include, and why should you have one done?
00:01:41.009 --> 00:01:44.689
What does a healthy nonprofit IT environment look like?
00:01:44.689 --> 00:01:46.449
Is there a checklist?
00:01:46.449 --> 00:01:50.769
And what if your assessment tells you it is time to change your IT support?
00:01:50.769 --> 00:01:52.929
What are typical next steps?
00:01:52.929 --> 00:01:55.969
So, Noura, would you like to introduce yourself?
00:01:57.170 --> 00:01:58.369
Yeah, thanks, Carolyn.
00:01:58.369 --> 00:02:02.449
Uh, I'm Nuradeen Aboki, a senior consultant at Community IT.
00:02:02.449 --> 00:02:20.689
In my work with nonprofit assessments are really about helping organizations understand what their network is today and uh where risk or if you you could say even friction may show up, and what practical steps uh can help them move forward.
00:02:20.689 --> 00:02:35.889
So I'll be focusing on what uh the process looks like uh from the inside, uh, what to look for, uh how we organize uh findings and how recommendations become something a nonprofit can actually use.
00:02:35.889 --> 00:02:39.569
And now I'll ask Johan to introduce himself.
00:02:40.049 --> 00:02:41.009
Yeah, thank you, Nura.
00:02:41.009 --> 00:02:42.210
Good afternoon, everyone.
00:02:42.210 --> 00:02:43.569
Thanks for joining us today.
00:02:43.569 --> 00:02:43.889
Uh,
00:02:43.889 --> 00:02:47.650
My name is Johan Hammerstrom, I'm the CEO at Community IT.
00:02:47.650 --> 00:02:53.169
I've been helping nonprofit organizations with IT support for over 25 years.
00:02:53.169 --> 00:03:01.969
And in that time, I've uh had the opportunity, the privilege to assess a lot of nonprofit IT environments.
00:03:01.969 --> 00:03:15.250
And I'm very excited today because uh we're gonna talk a little bit about the current version of assessment that we do at Community IT, which has really matured a lot in the last uh three or four years.
00:03:15.250 --> 00:03:24.289
And I think it's really matched what we've found to be a growing priority on IT maturity in the nonprofit sector.
00:03:24.289 --> 00:03:28.689
So we're we're excited to be here with you today, and thank you for joining us.
00:03:29.409 --> 00:03:34.370
And before we begin, if you're not familiar with community IT, a little bit about us.
00:03:34.370 --> 00:03:38.769
We are a 100% employee-owned managed services provider.
00:03:38.769 --> 00:03:41.329
We provide outsourced IT support.
00:03:41.329 --> 00:03:50.370
We work exclusively with nonprofit organizations, and our mission is to help nonprofits accomplish their missions through the effective use of technology.
00:03:50.370 --> 00:03:55.490
We are big fans of what well-managed IT can do for your nonprofit.
00:03:55.490 --> 00:04:00.530
We serve nonprofits across the United States, and we've been doing this for 25 years.
00:04:00.689 --> 00:04:11.329
We are technology experts and are consistently given an MSP 501 recognition for being a top MSP, which is an honor we just received again in 2026.
00:04:11.329 --> 00:04:16.769
And we believe we're the only MSP on the list serving nonprofits exclusively.
00:04:16.769 --> 00:04:21.490
I want to remind everyone for these presentations that community IT is vendor agnostic.
00:04:21.490 --> 00:04:27.569
We only make recommendations to our clients and we only base those on their specific business needs.
00:04:27.569 --> 00:04:32.930
We never try to get a client into a product because we get some kind of incentive or benefit from that.
00:04:32.930 --> 00:04:36.370
We do consider ourselves a best of breed provider.
00:04:36.370 --> 00:04:43.250
So it's our job to know the landscape, what tools are available, reputable, and widely used.
00:04:43.250 --> 00:04:49.810
And we make recommendations on that base basis for our clients based on their business needs, priorities, and budget.
00:04:50.129 --> 00:04:55.250
So we're recording this presentation today without an audience because of some scheduling issues.
00:04:55.250 --> 00:05:07.490
So while we don't have an audience QA today, if you do have questions about this topic, you can always join us and our experts at any time in our community on Reddit at r slash nonprofit IT management.
00:05:07.490 --> 00:05:10.689
And we try to answer questions over there within about a week.
00:05:10.689 --> 00:05:16.769
You can also contact us through our website at www.community it.com.
00:05:17.889 --> 00:05:19.649
A little bit more about us.
00:05:19.649 --> 00:05:25.409
Our mission is to create value for the nonprofit sector through well-managed IT.
00:05:25.409 --> 00:05:34.129
We also identify four key values as employee owners that define our company: trust, knowledge, service, and balance.
00:05:34.129 --> 00:05:52.769
We seek to always treat people with respect and fairness, to empower our staff, clients, and our sector to understand and use technology effectively, to be helpful with our talents, and we recognize that the health of our communities is vital to our well-being and that work is only a part of our lives.
00:05:52.769 --> 00:06:03.250
And with that, I want to turn it over to Johan, who I think can walk us through this slide of what is an IT assessment at a nonprofit.
00:06:03.969 --> 00:06:05.329
Yeah, thank you, Carolyn.
00:06:05.329 --> 00:06:19.009
Uh, we wanted to talk a little bit uh specifically about the approach that we take to IT assessments, which is very well defined, something that has a very specific methodology associated with it.
00:06:19.009 --> 00:06:25.969
It's possible to get an IT assessment that can cover all kinds of different activities.
00:06:25.969 --> 00:06:31.569
And if you bring on a new IT support provider, they might conduct an assessment of your network.
00:06:31.569 --> 00:06:44.930
If you're uh working with a third-party consultant, particularly to select a new software solution, they may assess certain aspects of your data and your IT systems that you're using.
00:06:45.170 --> 00:06:50.449
But at Community IT, when we talk about an IT assessment, we're talking about something very specific.
00:06:50.449 --> 00:06:53.170
And we wanted to define that at the outset.
00:06:53.170 --> 00:07:00.689
So, from our perspective, an IT assessment is a structured review of all aspects of IT.
00:07:00.689 --> 00:07:11.170
So it's comprehensive and it's intended to look not just at one particular component of an IT, of an organization's IT environment, but to look at all of those components.
00:07:11.329 --> 00:07:13.569
So we look at IT systems.
00:07:13.569 --> 00:07:23.009
So all your laptops, your cloud-hosted systems, all of your applications, the different solutions that you're using to do your work.
00:07:23.009 --> 00:07:26.050
And that's pretty common and pretty typical.
00:07:26.209 --> 00:07:28.449
But we also look at IT operations.
00:07:28.449 --> 00:07:43.569
So we don't want to look just at the technology that is being used, but we want to look at how it's being maintained, how it's being supported, how the staff in the organization are being supported in their use of those systems.
00:07:43.569 --> 00:07:51.569
So IT operations is a critical part of uh the uh evaluation that's being done during an assessment.
00:07:51.569 --> 00:08:00.050
We especially want to look at risks in this day and age, that's critically important, particularly uh cyber security-related risks.
00:08:00.689 --> 00:08:05.649
We also look at IT governance, how are IT decisions being made in the organization?
00:08:05.649 --> 00:08:09.649
How is the IT team uh formed?
00:08:09.649 --> 00:08:11.649
Who's overseeing that team?
00:08:11.649 --> 00:08:16.529
Um, how is their performance being monitored and evaluated over time?
00:08:16.769 --> 00:08:27.250
And then finally, looking at future needs, where is uh the organization headed and how is technology evolving to meet the future needs of the organization?
00:08:27.810 --> 00:08:32.690
So the IT assessment is supposed to be comprehensive and very thorough.
00:08:32.690 --> 00:08:39.570
For that reason, it usually takes seven to nine weeks to conduct a complete IT assessment.
00:08:39.570 --> 00:08:44.450
There are a variety of activities that are being conducted during that period of time.
00:08:44.450 --> 00:08:57.009
Those activities include interviews with key stakeholders, and and that and the number of interviews that need to be conducted really varies based on the circumstances and the situation of the organization.
00:08:57.009 --> 00:09:07.889
But usually it varies, excuse me, between you know four, three or four interviews on the on the low end and 10 to 12 interviews uh on the high end.
00:09:07.889 --> 00:09:14.210
Oftentimes we'll do group interviews, so we'll meet with uh multiple stakeholders at the same time.
00:09:15.169 --> 00:09:19.009
In addition to the interviews, we're conducting technical discovery.
00:09:19.009 --> 00:09:30.289
Oftentimes that means running tools that are scanning the network for vulnerabilities, for example, or looking at other aspects of the various IT systems.
00:09:30.289 --> 00:09:52.450
Uh, it always involves hands-on uh evaluation of the different IT systems, how they've been configured and how they're being managed, uh, looking at analysis of uh reports such as um ticket histories, number of tickets that are being uh generated on an ongoing basis and supported by the organization.
00:09:52.450 --> 00:09:56.929
Uh validating things like documentation.
00:09:56.929 --> 00:10:13.330
So we we always want to look at any documents that currently exist, whether it's IT policies, uh network or uh IT system documentation, data management, and then validating those documents to some extent as part of the assessment process.
00:10:14.049 --> 00:10:20.370
Once all that information is uh gathered, then the real work begins, synthesizing it.
00:10:20.370 --> 00:10:25.250
And that's something that um takes a significant amount of time and effort.
00:10:25.250 --> 00:10:31.730
And once that synthesis is completed, it results in recommendations for the organization.
00:10:31.730 --> 00:10:40.210
How can the IT environment be improved to better meet the long-term needs and strategic objectives of the organization?
00:10:40.210 --> 00:10:44.610
So that leads into planning and roadmap work, which we'll talk about.
00:10:44.610 --> 00:10:52.210
And we're gonna get into more details in this presentation as to the deliverables that come out of the IT assessment.
00:10:52.210 --> 00:10:52.610
Uh,
00:10:52.610 --> 00:11:06.450
Because it's such a thorough uh and involved process, the IT assessments typically cost between $20,000 and $30,000, uh, varying based on the size of the organization, the number of systems that are being evaluated.
00:11:06.450 --> 00:11:18.850
Um, sometimes it can be a little bit less than that, sometimes it can be a little bit more, but in general, that range uh works well for um doing the bulk of the work that needs to be done for an assessment.
00:11:18.850 --> 00:11:25.009
Um we're gonna talk a little bit more about why you would want to get an assessment done.
00:11:25.009 --> 00:11:27.730
So I'll kind of leave that uh for the moment.
00:11:28.529 --> 00:11:38.049
Before we go on to the next slide, um, I feel like I have to ask, do you have advice on how to vet an assessment provider?
00:11:38.049 --> 00:11:48.049
Because I would expect that sometimes some companies might use a quote unquote assessment really as just a sales part of their sales.
00:11:48.049 --> 00:11:54.689
So they're going to give you an assessment that tells you that they're the only one who can solve any of your problems and you should hire them right away.
00:11:54.689 --> 00:11:55.970
So, um,
00:11:55.970 --> 00:12:02.769
What can you look for in a vendor when you're talking to them to try and get you know a thorough agnostic assessment?
00:12:02.769 --> 00:12:07.730
And is there any way to tell like how competent they would be at giving an assessment?
00:12:08.529 --> 00:12:10.689
Well, I think that that's a great question.
00:12:10.689 --> 00:12:21.009
And I think the first thing to remember is that um what one firm calls an assessment may be very different from what another firm calls an assessment.
00:12:21.169 --> 00:12:29.649
And that's part of the reason that we wanted to uh do this webinar is to just kind of clarify what we mean by an IT assessment.
00:12:29.649 --> 00:12:32.049
And from our perspective, it's comprehensive.
00:12:32.049 --> 00:12:37.809
It's uh it covers the entire the organization's entire approach to IT.
00:12:37.809 --> 00:12:39.169
Um
00:12:39.169 --> 00:12:50.929
Aa lot of managed service providers, for example, will say they'll they'll do a free assessment, you know, either as part of the sales process or at the beginning of um of the engagement.
00:12:50.929 --> 00:12:54.049
And that's very different from what we're talking about.
00:12:54.049 --> 00:12:57.570
It may be exactly what the organization needs.
00:12:57.570 --> 00:13:12.850
You know, if an organization doesn't need a comprehensive evaluation that looks at IT operations management and governance, then that sort of free assessment that that begin you know happens at the beginning of an engagement uh may be sufficient.
00:13:13.009 --> 00:13:25.169
And in some ways, that's what we do when we onboard a new client for our managed services, we do sort of conduct a similar sort of evaluation of the systems that we're going to be supporting.
00:13:25.169 --> 00:13:36.370
Uh, we would we would uh distinguish that from a full-blown assessment of the kind that we're discussing in this in this webinar today for organizations.
00:13:36.529 --> 00:13:48.289
I mean, I think in terms of how to evaluate uh uh vendors or providers that are offering an assessment, I would just ask them to share their methodology.
00:13:48.289 --> 00:13:54.049
You know, how do they what's the framework that they're using for conducting the assessment?
00:13:54.049 --> 00:13:57.009
Um, have them share sample reports.
00:13:57.009 --> 00:14:10.929
So they should be able to share kind of a generic report from previous assessments that they've done, and then ask for references so you can talk to other nonprofit organizations that they've uh conducted assessments for.
00:14:10.929 --> 00:14:20.450
And I think that'll give you a good sense of whether or not their approach to doing assessments is the right fit for what your organization is looking for.
00:14:20.610 --> 00:14:24.610
Because it's possible, you I mean, there's a hundred thousand dollar assessments.
00:14:24.610 --> 00:14:27.490
We don't do those, but there are firms that do.
00:14:27.490 --> 00:14:38.769
And there may be, you know, some organizations really benefit from uh a $100,000 assessment that maybe takes not nine weeks, but nine months to complete.
00:14:38.769 --> 00:14:50.769
So um we're not saying that this is necessarily the only way to do an assessment, but I think it'll be clear as we go through the presentation today what what it is that we do.
00:14:50.769 --> 00:15:00.529
And hopefully that sheds some light on you know whether or not it's the right fit, you know, for what a particular organization is looking for.
00:15:01.250 --> 00:15:17.649
So it sounds like the organization, as they're starting on this process of thinking, I probably need an IT assessment, they need to get their assessment objectives kind of under understand what their objectives are to begin with.
00:15:19.009 --> 00:15:24.370
Yeah, you should be very clear on what you hope why you're doing the assessment, what you hope to get out of it.
00:15:24.370 --> 00:15:28.450
I think that's a good uh segue to our next slide.
00:15:28.450 --> 00:15:32.850
Thank you, Carolyn, for that uh smooth transition.
00:15:32.850 --> 00:15:35.889
Um so I'll I'll hand it over to Nura.
00:15:35.889 --> 00:15:37.169
I've been talking a lot.
00:15:37.169 --> 00:15:37.970
And uh
00:15:37.970 --> 00:15:42.129
Nura, can you talk a little bit about when we conduct an assessment?
00:15:42.129 --> 00:15:43.409
What are the objectives?
00:15:43.409 --> 00:15:46.529
What are what are we hoping to get out of that assessment process?
00:15:46.929 --> 00:15:47.889
Well, thank you, Johan.
00:15:47.889 --> 00:15:56.210
Uh, you know, objectives of an assessment are intentionally broader than uh the computer just working.
00:15:56.210 --> 00:16:06.529
You know, so uh we are looking at the IT environment as a whole, as you mentioned, Johan, the IT systems, the infrastructure, the management, and governance.
00:16:06.689 --> 00:16:13.970
So a strong assessment uh should help the organization develop a strategic technology plan for implementing recommendations.
00:16:13.970 --> 00:16:26.450
Uh that means uh we are not just naming gaps, uh, we are helping leadership understand priorities, sequencing, uh dependencies and what will be realistic.
00:16:26.450 --> 00:16:31.090
Because oftentimes we get we could find an assessment that's too technical.
00:16:31.090 --> 00:16:41.090
And uh really sort of taking an approach where you're looking at a strategy around the assessment and the objectives of the assessment is very important.
00:16:41.409 --> 00:16:44.529
Another key objective is uh alignment.
00:16:44.529 --> 00:16:51.970
Uh so IT touches leadership, staff, you know, finance, development, operations, uh, the board.
00:16:51.970 --> 00:16:59.809
Uh so if those groups uh are not aligned on what matters most, uh it becomes very difficult to invest uh wisely.
00:16:59.809 --> 00:17:04.690
And sometimes an assessment uh supports uh organizational change.
00:17:04.690 --> 00:17:19.570
Uh uh that might mean uh clarifying ownership, uh adjusting a support model, uh preparing uh for leadership transition or sequencing uh a larger technology initiative.
00:17:21.330 --> 00:17:29.890
And I think that that speaks now to the um some of the scenarios that we find uh when we're doing an assessment.
00:17:29.890 --> 00:17:34.690
Leadership transition, that that is often when assessments get done.
00:17:34.690 --> 00:17:45.490
Um previous leadership has departed, new leadership is coming in, um, maybe IT isn't fully meeting the needs of the organization.
00:17:45.490 --> 00:17:46.050
Um
00:17:46.050 --> 00:17:51.890
Oftentimes organizations change, or organizations don't change.
00:17:51.890 --> 00:17:57.890
You know, the environment around the organization has changed, but the organization has kind of remained static.
00:17:57.890 --> 00:18:06.610
New leadership comes in, they want to under, they want to get a complete picture, a third-party sense of what's happening with IT.
00:18:06.770 --> 00:18:13.330
So those are some of the scenarios in which um assessments are are getting completed.
00:18:13.330 --> 00:18:30.370
I think, you know, just to kind of reiterate the point that it's typically not done, you know, a lot of times now um auditors, cyber insurance providers, even the board will ask the organization to conduct a security assessment.
00:18:30.370 --> 00:18:34.050
Well, oftentimes they're just asking for like a vulnerability scan.
00:18:34.050 --> 00:18:36.530
Uh, they're asking for something very basic.
00:18:36.530 --> 00:18:45.330
Um, it's probably best not to do a comprehensive assessment in that case because you're gonna overdo the effort for what's needed.
00:18:45.330 --> 00:18:45.810
Uh,
00:18:45.810 --> 00:19:03.570
But other times, you know, maybe a new CEO is coming into the organization and they're they're seeing the need for IT uh to be a strategic enabler of the organization's mission, and they're perhaps wondering is it capable of doing that?
00:19:03.570 --> 00:19:08.930
That'd be a perfect scenario to conduct one of these comprehensive assessments.
00:19:08.930 --> 00:19:17.010
And um, I think uh the the things that we look at during the assessment process will also uh shed some light on that.
00:19:17.010 --> 00:19:17.100
\
00:19:17.100 --> 00:19:24.050
So maybe Nara, you could talk a little bit about the different categories that we're evaluating during the assessment process.
00:19:24.450 --> 00:19:32.530
Yeah, these are four categories that you see on on the slide deck uh you know, give the structure of the assessment.
00:19:32.530 --> 00:19:48.930
Uh they help uh organization finds findings, uh they do help with the organization of the findings so leadership can see patterns inside of this random list of issues that we may discover during the evaluation process.
00:19:49.170 --> 00:20:22.130
The first uh is the infrastructure and core systems, and there you can see a list of uh core infrastructure systems such as uh network connectivity, endpoints, uh identity, some productivity application platforms that the organization may be using if organization is still in the cloud or has on-premises uh servers, uh, and uh any support lifecycle uh management of the endpoints and hardware is all considered as part of the infrastructure on core IT systems.
00:20:22.370 --> 00:20:30.290
Then another category we look at is the data and webslash uh you would say digital platforms.
00:20:30.290 --> 00:20:50.930
This is where you see your CRM uh uh systems that we take a look at uh reporting system, website, uh, engagement platform, business applications, integrations, uh, as well as uh how information flows through the organization, because this is where the intersection of data, web, and digital platforms uh lie.
00:20:52.050 --> 00:21:00.370
Another critical, I would say crucial category that is very important in assessment is to look at your security and compliance uh areas.
00:21:00.370 --> 00:21:19.250
And this has to do with cybersecurity controls, uh identity and access, maybe backup and recovery, data protection specifically, uh and then uh permissions, you know, monitoring incident readiness and any risk or compliance obligations that your organization may have.
00:21:19.250 --> 00:21:23.090
Uh security is becoming more and more important.
00:21:23.410 --> 00:21:43.090
We uh approach uh we utilize best practices, best practices in terms of the industry uh from a cybersecurity standpoint and best practices that nonprofit organizations actually leverage on, and that's that's what we use to assess those uh security and compliance for our clients.
00:21:43.330 --> 00:21:47.970
And then lastly, there the fourth category has to do with governance and strategy.
00:21:47.970 --> 00:21:54.530
Uh governance is so important that uh who are those making the decisions, how are they making decisions?
00:21:54.530 --> 00:22:03.810
Are there policies that are uh that are already established in the organization, or does the organization need to improve on its IT policies?
00:22:03.810 --> 00:22:11.410
Uh what as how is the budgeting done uh for from an IT standpoint when it comes to technology investments?
00:22:11.410 --> 00:22:21.970
Uh, vendor management is something we look at because these days we find in organizations utilize several vendors, but how are those vendors managed and uh are the SLAs?
00:22:21.970 --> 00:22:26.770
Or service level agreements that are being met for those vendors.
00:22:27.170 --> 00:22:33.090
Then the ownership of IT in general at the organization, we take a look at that as well.
00:22:33.090 --> 00:22:34.850
And also leadership alignment.
00:22:34.850 --> 00:22:48.610
Then change capacity is important because as technology is evolving rapidly, it's quite important to understand what is the organization's change capacity for technological changes.
00:22:48.610 --> 00:22:50.850
And then a roadmap execution.
00:22:50.850 --> 00:22:57.010
If the organization has a roadmap, how are they planning to execute and implement that roadmap?
00:22:57.010 --> 00:23:06.370
If they don't have one, then the outcome of an assessment will also produce a roadmap and with guidance on how to execute on that roadmap.
00:23:07.810 --> 00:23:14.450
And this is a, I think it's important to note that this is an overview of what's being assessed.
00:23:14.450 --> 00:23:24.930
You know, these are the categories, but within each category, there are literally dozens of different specific points of evaluation.
00:23:25.170 --> 00:23:36.290
So in the infrastructure and core systems uh category, we're we're looking at antivirus protection and how it's being managed and how it's running.
00:23:36.290 --> 00:23:43.170
Uh we're looking at how the um environment is being managed and configured.
00:23:43.170 --> 00:23:46.210
Are the are do mobile devices have access?
00:23:46.210 --> 00:23:49.970
And if so, are you know are they being proactively managed?
00:23:50.770 --> 00:23:59.970
In the data and web, you know, looking um at things like uh data integrity, is there a retention policy governing the data?
00:23:59.970 --> 00:24:05.650
Um, how is SEO being used uh to drive traffic to the website?
00:24:05.650 --> 00:24:06.130
Um
00:24:06.130 --> 00:24:19.090
Security and compliance, looking at um, you know, the vulnerability scans, as we had mentioned earlier, uh, but also um, you know, looking at incidents that may have happened over the past year.
00:24:19.090 --> 00:24:27.330
Uh and then governance and strategy looking at uh, as Nura said, policies, um operational management, IT leadership.
00:24:27.570 --> 00:24:35.490
So it's an extremely thorough evaluation that's being conducted in these uh four different categories.
00:24:35.490 --> 00:24:45.330
And there's also an extremely um well-defined approach for evaluating uh all of these different categories.
00:24:45.330 --> 00:24:50.050
So Nura, maybe you could walk us through that approach a little bit.
00:24:51.170 --> 00:24:52.130
Yeah, thank you, Johan.
00:24:52.130 --> 00:24:58.610
And you know, it's uh uh the approach uh is straightforward as we put it here.
00:24:58.610 --> 00:25:03.970
You know, we try to simplify it into discover, evaluate, uh, align and plan.
00:25:04.370 --> 00:25:20.370
But in each uh of this uh processes uh that it is described as part of the approach lies uh a tremendous amount of work that goes into ensuring the discovery phase gathers contacts thoroughly.
00:25:20.370 --> 00:25:33.010
You know, this would include interviews, uh review of documentation, uh system inventory reviews, discussion around pain points, an organization may be feeling our department or a leader.
00:25:33.010 --> 00:25:37.570
So as we go through, we are taking notes of these pain points.
00:25:37.730 --> 00:25:39.250
Then their prioritization.
00:25:39.250 --> 00:25:42.690
Uh, what is the organization's priorities when it comes to IT?
00:25:42.690 --> 00:25:46.530
Uh, do they have something already in view?
00:25:46.530 --> 00:25:51.970
Uh are there changes to their mission or priorities that will impact their mission?
00:25:51.970 --> 00:26:11.970
So we want to get that early in that discovery phase and also talk about security risk to the organization just to understand what is their feel, what are there any eminent risks, are there any known risks uh before we actually begin to evaluate the moving into the evaluation phase.
00:26:12.050 --> 00:26:15.330
And then that evaluation phase, we look at the current state.
00:26:15.330 --> 00:26:18.050
Uh, as Johan said, is quite thorough.
00:26:18.050 --> 00:26:31.570
Uh, each of those categories, uh, the four categories, we go do a deep dive into each one of them, depending on the systems that the organization have, whether it's infrastructure or the core systems, we begin with those.
00:26:31.570 --> 00:26:39.410
Uh, running our tools as we do the evaluation of uh the network or the technology infrastructure that they have.
00:26:39.410 --> 00:26:53.970
Um, that keeps the analysis organized, honestly, once we go through those four uh high-level categories, uh, and it helps us avoid focusing too much narrowly on just one specific tool or one technology issues.
00:26:54.130 --> 00:27:09.010
But we are taking notes uh along the way during the discovery phase and even in our evaluation, as we find, for instance, a risk an organization has not implemented multi-factor authentication for its systems, administrators, uh, accounts.
00:27:09.010 --> 00:27:10.370
You know, that's a risk.
00:27:10.370 --> 00:27:24.370
We note that down, and and during our project check-ins, we report that and see if there's any early actions we could take to remediate that because there's some risks that just can't wait as we go through the evaluation process.
00:27:24.530 --> 00:27:29.970
Then we shift into the uh uh after the evaluation, we move into the alignment phase.
00:27:29.970 --> 00:27:41.810
Here uh we connect the findings uh to the leadership priorities of staff experience, uh, mission, budget, and change or capacity for change.
00:27:41.970 --> 00:27:45.090
And this is where the nonprofit context really matters.
00:27:45.090 --> 00:27:48.450
As uh the findings could be a long list.
00:27:48.450 --> 00:28:03.090
Uh, we really want to make sure that they are relevant uh to the nonprofit organization that is going through that uh assessment, and we take their prioritization or their priorities into heart as we uh trying to find that alignment for them.
00:28:03.330 --> 00:28:19.490
And then finally, we move into the planning phase, and this is where we convert those findings, uh, what we've discovered for the findings into recommendations, as well as a strategic technology plan, and which eventually arrives at the IT roadmap.
00:28:19.490 --> 00:28:23.490
And we'll talk some more about the deliverables uh very soon.
00:28:23.490 --> 00:28:31.010
But the framework, you know, as you can see, is category category-based, but the output has to be practical.
00:28:31.010 --> 00:28:36.450
For instance, what to do, why it matters, and how to sequence it.
00:28:37.170 --> 00:28:52.770
I have a quick question for you, Nura, because having been on the other side of the desk in this also, I wonder how often it happens when you're doing those initial interviews that the people really know what the risks are and they tell you what the pain points are.
00:28:52.770 --> 00:28:57.970
Um, or does it happen fairly often that you discover a risk that they weren't even aware of?
00:28:58.290 --> 00:29:07.010
So in the initial phase, uh those interviews reveal what matters to the users or to the staff or to the organization, what they know.
00:29:07.010 --> 00:29:15.970
Whether it's their day-to-day work, uh, they are struggling with a report that they're unable to generate or they can't find data coherently, they need a dashboard.
00:29:15.970 --> 00:29:30.370
So they talk about their needs, you know, to them, uh that may not necessarily constitute risk, but sometimes the leaders of the organization uh may find that really everyone is using open AI, for instance.
00:29:30.370 --> 00:29:44.130
Just to give you an example, an AI that is open source, that is not uh uh a paid account, or there's just risk of proliferation of exfiltration of data, uh, which a leader is just concerned and nervous about.
00:29:44.130 --> 00:29:46.130
And then they bring that up.
00:29:46.370 --> 00:30:02.050
But during the technical uh evaluation or the evaluation phase, uh this is where we are looking at uh the uh infrastructure itself and going in deep, as Johan mentioned, we're reviewing configuration.
00:30:02.050 --> 00:30:09.410
And sometimes an organization that might been around for 10 years, they've been through a number of IT support teams.
00:30:09.410 --> 00:30:14.050
Uh, there could be some misconfiguration that has not been resolved.
00:30:14.050 --> 00:30:30.290
And this is where we take a look deeply at those systems and to make sure they have some basic or baseline uh standard configuration that is uh kind of uh error-free, if you will, or that doesn't have any misconfiguration in them.
00:30:30.290 --> 00:30:38.290
But if we find one and we find that it's uh risky to the organization based on our criteria, we report that immediately.
00:30:39.650 --> 00:30:43.410
Thank you for joining Community IT for this podcast, part one.
00:30:43.410 --> 00:30:50.770
Subscribe wherever you listen to podcasts and leave us a rating to help others find this leadership resource for nonprofits.
00:30:50.770 --> 00:30:53.970
Listen for part two in your podcast feed.
