Boards approve capital, sign off on risk appetite, and answer to funders and regulators. Most do it without a documented view of the technology and cybersecurity their organization runs on every day. This assessment gives them one.
Boards approve capital, sign off on risk appetite, and answer to funders and regulators. Most do it without a documented view of the technology and cybersecurity their organization runs on every day. This assessment gives them one.

An introductory call establishes size and complexity: seats, terminals to be assessed, systems in use, and the interviews required. You receive a fixed quote before anything begins.
The work happens alongside your existing structure of staff, contractors, and technology providers. Nobody is being audited or replaced. The role here is external perspective and expert evaluation, which is difficult for anyone inside the arrangement to provide about themselves.
You finish with a board and leadership-ready statement of where you stand and what to do next, written so that a trustee reads the summary and a technician reads the appendix.
Two trusted Canadian organizations, bringing complementary expertise in nonprofit operations, governance, technology and cybersecurity.


Impact Support Services is the administrative backbone for Canadian charities, foundations, and nonprofits, integrating financial operations, technology infrastructure, and administrative coordination into a single accountable layer. It brings the governance and daily operations view to the assessment, while mission, programming, and fundraising stay entirely with your organization.
Red Rhino is an award-winning IT managed service provider, delivering technical assessment, monitoring, and remediation for organizations across Canada. The firm has been named to the MSP 501 for five consecutive years and to Canada's Top 50 Best Managed IT Services Providers six years running.

The Technology & Cybersecurity Risk Assessment is a fixed-scope, external evaluation of your organization's technology and cybersecurity posture, built for boards that are asked to govern a risk they cannot see. You finish with: