Fortifying the Future: The Ford Foundation’s Grantee Safety Program

In a world where social justice advocates tirelessly strive for a more equitable future, the risks they face are ever-present. From online intrusions to physical threats, the challenges confronting grantees of the Ford Foundation are significant. Recognizing these dangers, the Ford Foundation has taken a proactive stance by investing in a five-year Grantee Safety Program, designed to empower grantees with the tools and knowledge necessary to navigate these challenges securely. As the senior cybersecurity program manager for this initiative, I had the privilege of overseeing its development and implementation. Here’s a detailed look at our approach, key initiatives, and the lessons learned along the way.

Cybersecurity: A Holistic Approach

At the heart of the Grantee Safety Program is a commitment to fostering a culture of safety through a comprehensive approach to cybersecurity. This involves not only providing tools and assessments but also creating interactive learning experiences, conducting research, and facilitating open forums for discussion. By doing so, we aim to empower grantees to proactively address digital threats, ultimately building a safer and more resilient social justice ecosystem.

Cybersecurity Assessment Tool (CAT) and Webinar Series

One of the first major initiatives was the development of the Cybersecurity Assessment Tool (CAT). Recognizing the lack of resources tailored specifically for nonprofits, we collaborated with a diverse group of global cybersecurity experts to create a 70-question workflow that generates hundreds of recommendations based on an organization’s cybersecurity maturity. Initially designed for BUILD grantees, the CAT is now accessible to all organizations seeking to enhance their digital security.

Since its launch in 2020, the CAT has garnered significant attention, receiving approximately 3,500 visits per month. In 2022, we redesigned and relaunched the tool as CAT 2.0, which will be maintained by The Engine Room starting in 2025. The CAT has been referenced by various organizations worldwide, including the U.S. Cybersecurity and Infrastructure Security Agency (CISA), highlighting its importance in the global cybersecurity landscape.

To complement the CAT, we launched a webinar series known as CATFOOD (Cybersecurity Assessment Tool Forum for Open Online Dialogue). These sessions provided a platform for grantees to engage with key cybersecurity topics in a non-judgmental space, fostering a culture of openness and collaboration.

Cybersecurity Reports and Research

In addition to the CAT, the Grantee Safety Program has produced valuable research and resources tailored to the needs of our grantees. We compiled a list of cybersecurity experts in our report, "Cybersecurity Capacity Building Technical Assistance Providers: The Honest Mechanics," which serves as an inventory of global cybersecurity providers aligned with the missions of civil society organizations.

For grantees in Latin America, we conducted a landscaping analysis of the cybersecurity provider network, resulting in the report "Cybersecurity and Cyber Resilience in Social Organizations of the Andean Region." This report is available in both Spanish and English, ensuring accessibility for a broader audience.

Cyber Coffee: A Safe Space for Discussion

Recognizing the eagerness of grantees to discuss their security challenges, we launched Cyber Coffee—an informal, off-the-record space for grantees to connect with cybersecurity experts and share experiences. Since its inception in 2021, Cyber Coffee has grown to include over 200 registered attendees, creating a supportive community focused on enhancing security practices.

Cybersecurity Tabletop Exercise

To make cybersecurity engaging and interactive, we introduced a tabletop exercise designed by game designer Jason Li. Participants took on roles as either a global nonprofit or a hacktivist collective, navigating various cyber risks and defenses. This exercise not only educated participants about cybersecurity concepts but also emphasized the importance of preparation and threat modeling.

Cybersecurity Academy

In 2022, we expanded our cybersecurity programming to include all Ford grantees through the Cybersecurity Academy. This formal learning platform offers a four-month training program, providing over 300 grantees with monthly learning opportunities. The Academy’s learning portal allows participants to access resources at their own pace, further enhancing their understanding of cybersecurity.

Cybersecurity Pit Stop Program

Launching in October 2024, the Cybersecurity Pit Stop Program will provide personalized support for select grantees who have actively participated in our Cybersecurity Academy and Cyber Coffee sessions. This initiative aims to address specific security challenges through one-on-one assessments and hands-on assistance from cybersecurity professionals.

Physical Security: Addressing Real-World Risks

In our hyper-connected world, digital threats can quickly escalate into physical risks. Therefore, the Grantee Safety Program also focuses on physical security issues, ensuring that grantees are equipped to handle workplace safety and event security challenges.

Rapid Assistance Security Initiative (RASI)

In 2022, we launched the Rapid Assistance Security Initiative (RASI) in collaboration with NEO Philanthropy. This fund provides immediate support to U.S.-based grantees facing physical security challenges. Grantees can connect with physical security experts for assessments and receive funding to address urgent needs, such as active shooter preparation and office security improvements. To date, RASI has awarded over $1 million in grants to more than 70 grantees.

Physical Safety School

Inspired by the success of the Cybersecurity Academy, we will launch the Physical Safety School in October 2024. Led by the Collective Security Group, this online academy aims to enhance the physical security posture of U.S.-based organizations, focusing on the safety of offices, events, and staff.

What We Learned

Through the implementation of the Grantee Safety Program, we gained valuable insights into the nature of security in the nonprofit sector:

1. Security Can Be Engaging: By reframing security as an interactive topic, we encouraged constructive dialogue and learning. Grantees were more likely to engage with security concepts when tied to interactive activities.

2. Emphasizing Fundamentals: Security can be filled with technical jargon, but focusing on the basics allowed grantees to absorb material more effectively. Many organizations developed "security champions" who took advantage of our offerings.

3. The Power of Community: While humans are often seen as the weakest link in security, our programs demonstrated the strength of community support. Grantees cheered each other on, fostering a collaborative environment that enhanced overall safety.

4. Approachable Security: Providing a safe space for discussions about security helped alleviate fears and anxieties. With the right context and encouragement, organizations became more comfortable addressing security-related topics.

5. Resource Allocation: Our programs highlighted the strong demand for resources related to security needs. Grantmakers can play a crucial role in connecting grantees with the right resources and expertise.

Special Thanks

The success of the Grantee Safety Program would not have been possible without the dedication and expertise of numerous professionals. Special thanks to the cybersecurity and project management team, including Trinh Nguyen, Runa Sandvik, Laura Tich, Martijn Grooten, Matt Hansen, Danny Shaw, Jason Li, Evie Winter, Gem Barrett, Frances Mak, and The Engine Room.

In conclusion, the Ford Foundation’s Grantee Safety Program represents a vital investment in the future of social justice advocacy. By equipping grantees with the tools and knowledge to navigate both digital and physical threats, we are fostering a safer environment for those dedicated to building a more just and equitable world. Together, we can ensure that the important work of our grantees continues, unimpeded by the risks they face.