# Growing IT Management Capacity at Nonprofits with Johan Hammerstrom pt 2

An episode of [Community IT Innovators Nonprofit Technology Topics](https://invisiblenetwork.ai/podcast/1536843269), 2 Oct 2026, 33 min.

Audio: https://www.buzzsprout.com/1029925/episodes/19863673-growing-it-management-capacity-at-nonprofits-with-johan-hammerstrom-pt-2.mp3

In Part 2 of the Growing IT Management Capacity at Nonprofits webinar, Carolyn Woodard and Johan Hammerstrom, CEO of Community IT, get practical about what well-managed IT looks like, and why the capacity to manage IT matters more than any tool, device, or license you can buy. Johan walks through a simple framework: five capacities every nonprofit's IT should have, and ten security essentials that non-technical leaders can use as a checklist. Carolyn then shares why she wrote the upcoming white paper with the Technology Association of Grantmakers (TAG), reframing nonprofit IT around assets instead of deficits. Nonprofit staff bring deep knowledge of their mission, IT vendors bring technical expertise, and funders bring capacity-building dollars and a view across their grantees. The missing piece is IT management, and closing that gap takes everyone working together. The Q&A takes on a question many listeners will recognize: what can a one-person team wearing too many hats do to be more proactive when there's no time to think strategically? Johan's answer is to make your vendor carry the proactive work, and to build in simple checkpoints that keep the relationship accountable. Haven't listened to Part 1 yet? Find it in your podcast feed. This episode covers: • The five IT capacities your nonprofit should be able to do either internally or with vendor support: resolving simple issues on demand, resolving advanced technical issues, proactively managing IT systems, proactively managing IT operations, and planning strategic investments • Ten security essentials across devices, accounts, data, and governance, and why your acceptable use policy should address AI and be a living document • Why funding technology without funding IT management capacity leads to technical debt, and why expecting mission-driven staff to also be IT experts is an equity issue • How a monthly vendor check-in and an annual assessment timed before budgeting can shift a vendor relationship from reactive to proactive, and why an assessment is an easier ask of funders • Why AI adoption is exposing underlying IT management gaps that AI can't fix on its own Resources Mentioned: • Webinar: Growing IT Management Capacity at Nonprofits – Community IT • Template: Acceptable Use of AI Tools in the Nonprofit Workplace – Community IT • Webinar: Nonprofit Cybersecurity Playbook, Updated for AI (October 21) – Community IT • Kauffman Foundation – kauffman.org • TAG 2026 Conference – Technology Association of Grantmakers – tagtech.org • Start Here: Nonprofit Cybersecurity Basics - Community IT • 2026 Cybersecurity Readiness for Nonprofits Playbook - Community IT _______________________________ Start a conversation :) • Register to attend a webinar in real time, and find all past transcripts at https://communityit.com/webinars/ • email Carolyn at cwoodard@communityit.com • on LinkedIn • on reddit/r/nonprofitITmanagement • on the Community IT website Thanks for listening.

## Transcript

[0:23] Community IT Intro: Thank you for joining this Community IT podcast, part two.
[0:27] Community IT Intro: You can find part one in your podcast feed if you subscribe wherever you listen to podcasts.
[0:34] Carolyn Woodard: Welcome to the Community IT Innovators webinar on growing IT management capacity at nonprofits.
[0:41] Carolyn Woodard: My name is Carolyn Woodard.
[0:42] Carolyn Woodard: I'm the outreach director for Community IT.
[0:45] Johan Hammerstrom: My name is Johan Hammerstrom.
[0:47] Johan Hammerstrom: I'm the CEO at Community IT.
[0:49] Carolyn Woodard: So, Johan, I think we're going to move on and talk about what a healthy nonprofit IT environment looks like.
[0:55] Carolyn Woodard: And this is part of the white paper.
[0:57] Carolyn Woodard: So I, you know,
[0:58] Carolyn Woodard: You contributed a big section to the white paper about if you are at a nonprofit or if you're at a funder and you're thinking about like, I don't even know what a healthy IT system looks like.
[1:11] Carolyn Woodard: Here is a list that you can work from.
[1:14] Carolyn Woodard: So could you talk a little bit about the capacity needs here on the left-hand side, those five areas?
[1:21] Johan Hammerstrom: Yeah, I mean, this is kind of the money slide in some ways.
[1:24] Johan Hammerstrom: And the idea was just providing a very simple framework for non-technical staff at nonprofit organizations to think about whether or not their IT is uh living up to its potential, you know, providing all of the service uh that it should for the organization.
[1:42] Johan Hammerstrom: So on the left, you see this, these five capacities.
[1:47] Johan Hammerstrom: So each one of these, you can sort of ask the question does our organization have the capacity to, or does the IT at our organization have the capacity to?
[1:59] Johan Hammerstrom: And you should be able to answer yes to all of these.
[2:01] Johan Hammerstrom: You there should these should all be checkboxes.
[2:04] Johan Hammerstrom: So does the IT at my organization have the capacity to resolve simple issues on demand?
[2:11] Johan Hammerstrom: Sometimes that's performed by a help desk.
[2:14] Johan Hammerstrom: Not always.
[2:15] Johan Hammerstrom: Small organizations maybe have someone in-house that staff go to for getting simple technical issues resolved, but this is a critical capacity that is a hallmark of IT being well managed at an organization.
[2:30] Johan Hammerstrom: Number two, does my organization have the capacity to resolve advanced technical issues?
[2:36] Johan Hammerstrom: So, the majority of technical issues should be relatively simple and they should be addressed, you know, pretty quickly, but there will be advanced technical issues that come up, regardless of the complexity of the environment that you're operating in.
[2:52] Johan Hammerstrom: It's just the nature of IT.
[2:54] Johan Hammerstrom: These are complex systems, something's gonna happen, the system might change, whatever the cause, and you need someone with advanced technical expertise to address it.
[3:04] Johan Hammerstrom: Oftentimes, this will be outsourced for smaller organizations, much larger organizations might have an IT team in-house that has more advanced technical staff who can do that.
[3:15] Johan Hammerstrom: So that's the second.
[3:17] Johan Hammerstrom: The third, does my organization have the capacity to proactively manage IT systems?
[3:23] Johan Hammerstrom: Is there a fully functioning antivirus solution deployed to all of my um devices, to all of the uh endpoints that are being used by the organization?
[3:34] Johan Hammerstrom: Is the organization proactively monitoring all of the logins into Google Workspace or Microsoft 365?
[3:43] Johan Hammerstrom: These are all examples of ways that IT systems can be and should be proactively managed.
[3:49] Johan Hammerstrom: So that's an important capacity to have.
[3:51] Johan Hammerstrom: Number four, does my IT have the capacity to proactively manage IT operations?
[3:58] Johan Hammerstrom: So that would be ongoing, sort of managing the, for example, when somebody new joins the organization, is their account getting created in a timely manner?
[4:10] Johan Hammerstrom: Is their laptop getting provisioned for them and delivered to them in a timely manner?
[4:15] Johan Hammerstrom: Do they have uh IT orientation?
[4:17] Johan Hammerstrom: That's a very simple sort of operational requirement, but that's something that should be proactively managed by the organization.
[4:25] Johan Hammerstrom: And then fifth and finally, does IT have the capacity to plan strategic investments?
[4:30] Johan Hammerstrom: Is IT a stakeholder and a participant in the annual budgeting process?
[4:36] Johan Hammerstrom: As the organization puts together its strategic plan for the year, is IT involved in that process?
[4:44] Johan Hammerstrom: And um, do the strategic organizational plans include an IT component?
[4:49] Johan Hammerstrom: So those are the five capacities.
[4:52] Johan Hammerstrom: And if that's if your organization has uh one or two but not the other three, then that's something to look into.
[5:00] Carolyn Woodard: And then on the right hand side of this chart, we have 10 essentials.
[5:04] Carolyn Woodard: And these are kind of a little bit more technical.
[5:07] Carolyn Woodard: So if you have technical people in the audience, um, you know, don't don't worry.
[5:12] Carolyn Woodard: Like you already know all this.
[5:13] Carolyn Woodard: But if we have non-technical people in the audience, can you just go through, I think, quickly these 10 essentials of securing devices, securing accounts, securing data, and then the IT governance?
[5:25] Johan Hammerstrom: Yeah, and these are all very security-oriented.
[5:27] Johan Hammerstrom: So in some ways, these are the 10 security essentials.
[5:30] Johan Hammerstrom: And even if you're technical, uh, these can be effective for communicating to non-technical stakeholders in the organization, senior leadership, um, potentially even the board.
[5:43] Johan Hammerstrom: We think of the 10 security essentials in these four categories.
[5:47] Johan Hammerstrom: First category is securing devices.
[5:49] Johan Hammerstrom: Does everyone who's accessing the organization's information have an organization-owned uh computer?
[5:56] Johan Hammerstrom: That's pretty critical.
[5:58] Johan Hammerstrom: Obviously, there's some exceptions to that.
[6:00] Johan Hammerstrom: If you're working with consultants, they may have their own computers that they're using.
[6:04] Johan Hammerstrom: But in those cases, you want to have very strict um limitations on the level of access they have to the organization's information.
[6:12] Johan Hammerstrom: Typically, staff in the organization have you know comprehensive access to the organization's information.
[6:19] Johan Hammerstrom: That should only be happening from uh computers that are owned and managed by the organization.
[6:25] Johan Hammerstrom: That's number one.
[6:26] Johan Hammerstrom: Number two, make sure that uh antivirus software, anti-malware, and endpoint detection and response software is installed.
[6:34] Johan Hammerstrom: And number three, that there's proactive cybersecurity systems for monitoring activity on all of the laptops as well as activity on the cloud systems.
[6:43] Johan Hammerstrom: So that's how you secure your devices.
[6:47] Johan Hammerstrom: Number two, securing your accounts.
[6:49] Johan Hammerstrom: The number one way you can secure your accounts is by training your staff, providing security awareness training.
[6:56] Johan Hammerstrom: The number one way now, the number one method by which hackers uh gain access to systems is through phishing attacks.
[7:04] Johan Hammerstrom: And so if you can train your staff to uh detect and um and uh report but not succumb to phishing attacks, uh it goes a long way towards uh securing the organization.
[7:18] Johan Hammerstrom: Number five, implementing multi-factor authentication and ensuring the use of strong passwords.
[7:24] Johan Hammerstrom: And number six, this is kind of an analog of number three, um, monitoring account activity uh on your cloud hosted systems.
[7:32] Johan Hammerstrom: And then finally, you want to secure your data by backing it up and uh testing recovery, make sure you have a good recovery process.
[7:40] Johan Hammerstrom: Number eight, um having a good permissions management framework in place, a good structure for who has access to what, and a good system for defining who can grant access to different levels of information.
[7:53] Johan Hammerstrom: Number nine, uh regularly monitoring access to information in cases where sensitive information is being um stored, potentially setting up um like a data loss uh protection system.
[8:08] Johan Hammerstrom: And then finally, number 10, having good IT policies.
[8:11] Johan Hammerstrom: These will be pretty simple and straightforward for smaller organizations, could end up being much more complex uh for larger organizations.
[8:19] Johan Hammerstrom: But IT policies are sort of the starting point for uh good IT governance.
[8:25] Carolyn Woodard: And that's something that I definitely I feel like we have a lot of, at least prospects that come to us and don't have like an acceptable use policy.
[8:35] Carolyn Woodard: And that is something that it can feel like you can put it off, like, oh, policy will write that at some point.
[8:41] Carolyn Woodard: We have to solve the MFA problem right now.
[8:44] Carolyn Woodard: But definitely that IT policy, like you can't hold your staff accountable for misusing something if they don't, if there is no policy that they don't that you, you know, you just can't hold them accountable for that.
[8:58] Carolyn Woodard: And then I would say also that that policy, I mean, there are templates out there for writing that acceptable use policy, but that really is just such a bedrock.
[9:06] Carolyn Woodard: And it should be, you know, in your first days on the job, part of your employee handbook, but it's also something to refer back to.
[9:14] Carolyn Woodard: And especially now in the days of AI, like if you have an acceptable use policy, but it doesn't include anything about how your organization has agreed to use AI, uh, then you're you're you're missing this huge chunk as well.
[9:27] Carolyn Woodard: So make sure it's a living document and not just something that somebody wrote back in the day, and you hand out to new staff and then you forget about it.
[9:35] Carolyn Woodard: Um thank you so much.
[9:37] Carolyn Woodard: I feel like this slide, like as we said, it's a it's so useful and helpful to uh someone in IT who is thinking about like what are the things that we need to have or the level that we need to get to as a start, as a foundation.
[9:52] Carolyn Woodard: So I now I want to like shift gears a little bit.
[9:56] Carolyn Woodard: And I want to put in the chat.
[9:58] Carolyn Woodard: Um, if you're thinking about this, um, you know, kind of put this in the chat again.
[10:04] Carolyn Woodard: This is all you know anonymous, we're not gonna share this out.
[10:07] Carolyn Woodard: Um, but one thing that would change at your organization if someone truly owned IT strategy and IT management.
[10:16] Carolyn Woodard: Um, so go ahead and think about that.
[10:17] Carolyn Woodard: It doesn't have to be an essay, maybe a couple of sentences, um, and and put it in the chat as we continue talking.
[10:23] Carolyn Woodard: And uh if we have some good answers, we'll we'll come back to it in the QA um area and talk some more about some of the things that can change.
[10:32] Carolyn Woodard: So just a way to get you started thinking about, you know, IT is not, it's something that has the capacity, like your IT management, you have the capacity to grow that.
[10:41] Carolyn Woodard: So I want to try to make this a positive thing.
[10:45] Carolyn Woodard: Um, to the person who put in the question in the QA chat, that's a fantastic question.
[10:51] Carolyn Woodard: We will answer that in the QA at the end of the presentation.
[10:55] Carolyn Woodard: And so moving on, I want to talk a little bit about the white paper and about internal IT capacity as an opportunity.
[11:05] Johan Hammerstrom: Yeah, thank you, Carolyn, for you were really the uh the inspiration.
[11:10] Johan Hammerstrom: It was your inspiration to uh work with TAG on putting together this white paper.
[11:15] Johan Hammerstrom: And I was wondering if you could uh share a little bit um you know what was on your mind, like what what sort of inspired you to make this white paper happen, why you think it's important, and maybe start with, you know, what is sort of the the white paper about?
[11:32] Carolyn Woodard: Yeah, so the white paper um started for I've thought about this for years now.
[11:38] Carolyn Woodard: I described for you earlier my experience as an IT director and a lot of the um kind of philosophical essential questions about my role at that organization and um the many challenges that I faced.
[11:55] Carolyn Woodard: But I really um I wanted to write this white paper because I didn't, I feel like this issue gets framed a lot around deficit and challenges.
[12:05] Carolyn Woodard: And kind of, you know, since I've been in nonprofits and working in IT and nonprofits, it's kind of always framed around why doesn't it work?
[12:14] Carolyn Woodard: Why doesn't it work better?
[12:16] Carolyn Woodard: Why is IT such a challenge for nonprofits?
[12:19] Carolyn Woodard: And so one of the things I wanted to think about in writing this paper was to use the asset framing uh instead.
[12:27] Carolyn Woodard: So to start from a point, a positive point, and a point of um assets of what do these different, the different players in the IT at nonprofits, what do these different actors and players bring to the table that are assets?
[12:44] Carolyn Woodard: Um, and that capacity itself is an asset that you can you can grow.
[12:49] Carolyn Woodard: And one of the things I think that we really don't think about enough in the nonprofit sector when we frame it as a deficit, as a challenge that we have to fix is that nonprofits, in my experience working both for for-profits and for nonprofits, nonprofit staff have really an amazing knowledge of what their organization does and how it does it, and what their job is and how they do it.
[13:19] Carolyn Woodard: And I don't know for the people in the in the audience who work at nonprofits the last time you worked for a for-profit, but it's very common to find someone who like they really only understand maybe their little piece of what the company does, or they may not even understand that.
[13:35] Carolyn Woodard: They just like do the things that they're supposed to do.
[13:38] Carolyn Woodard: So, in all of the nonprofits that I've interacted with over the many years, um, there's a really deep knowledge, like I said, of what the nonprofit does.
[13:47] Carolyn Woodard: And that is just like kind of a killer app in a lot of ways.
[13:52] Carolyn Woodard: If you're an IT person or a funder coming into work with a nonprofit, that is knowledge that you really need to work with.
[14:01] Carolyn Woodard: Um, because those people, those staff know what they want to be able to do.
[14:06] Carolyn Woodard: And so, starting from that standpoint of what could the technology allow them to do if they could do what they wanted to be able to do, I think is really important to you know come into this argument.
[14:19] Carolyn Woodard: And that, you know, and then you have your IT vendors, of course.
[14:24] Carolyn Woodard: So MSPs like like we are, and consultants and um, you know, management consultants, change management consultants have a lot of their expertise and understanding of, as I said at the outset, what the landscape is, you know, what tools are out there, what companies are reputable, are gonna be around, you know, 20 years from now and still able to provide that tech stack.
[14:46] Carolyn Woodard: So that nonprofits are in a position when they're using a technology that a lot of organizations and for business, um, for-profit businesses are using, there's a lot more consultants out there who can help them with it.
[14:59] Carolyn Woodard: Like we want to get away from, like you and I know, Johan, 20 years ago, there were a lot of custom-built solutions, and it just locks you into, like, the, like you said, the one person who knows how the access database works.
[15:12] Carolyn Woodard: And then they can charge you anything, really.
[15:15] Carolyn Woodard: You don't have other options where you can go to find someone else who can help you with this problem.
[15:20] Carolyn Woodard: So I think you know, the IT vendors bring so much, they have all of this IT knowledge, but they don't have the deep understanding of what the nonprofit does and what their business needs are and what the technology needs to help enable.
[15:37] Carolyn Woodard: And then for funders, you know, funders coming in, you know, like who they they're interested in this great grantee, they want to, you know, enable them to do their mission more, you know, whether it is, you know, reaching kids after school or saving a whale, or, you know, all the many, many things that all of the nonprofits do in the different sectors where they work.
[15:59] Carolyn Woodard: And so these funders are coming in with that, you know, capacity-building funding that is going to enable the nonprofit to do its thing.
[16:07] Carolyn Woodard: So they have a lot of understanding, maybe across their grantees who work in education of what works.
[16:14] Carolyn Woodard: And then, but they don't like they aren't thinking about the IT.
[16:19] Carolyn Woodard: And they aren't thinking about the ways that the IT could be part of the solution.
[16:23] Carolyn Woodard: So that's where I, you know, like I started out with um for this white paper.
[16:28] Carolyn Woodard: And I wanted to, I wanted to originally do like just like a landscape of like what are funders doing in this space that is working.
[16:37] Carolyn Woodard: What are the models that are out there?
[16:39] Carolyn Woodard: And yeah, there are very few.
[16:42] Carolyn Woodard: I'll put that as a at the at the outset.
[16:46] Carolyn Woodard: There are some amazing funders who are doing really amazing things.
[16:49] Carolyn Woodard: Um, Kauffman Foundation in uh Kansas City is one of the ones to look to where their operating funds say explicitly when you apply for that funding that IT support is a part of operations and that you should be putting in your application what you need for your IT to work effectively.
[17:09] Carolyn Woodard: And so even just naming that is really important from the funder's standpoint.
[17:14] Carolyn Woodard: And there are there are several other good examples and models, but I was really surprised.
[17:19] Carolyn Woodard: Well, I guess I wasn't really surprised.
[17:21] Carolyn Woodard: The fact that this challenge has persisted over so many years really speaks to the fact that, you know, like funders are not looking at this as an opportunity or not looking at this as something that they understand what they can do.
[17:35] Carolyn Woodard: And so that was another big impetus to me to write this white paper was to try and uncover some of those models that are working and get people talking more about, you know, experimenting and seeing what works and talking openly about IT needs at a nonprofit when they're talking with their funder, when they're talking with the vendors.
[17:56] Carolyn Woodard: And so for all of these actors to kind of come together and contribute to, you know, bring their assets to the table to work on this, um, on this project.
[18:06] Carolyn Woodard: Some of the things that come out in the in the white paper that I talk about is that, you know, funding the technology without also funding that IT management capacity building is just is one of the things that has led to technical debt that nonprofits find themselves in and strategic challenges in mission delivery.
[18:25] Carolyn Woodard: So one of the arguments in the white paper is that this lever of increasing the ability of the nonprofit to manage IT is something that is going to make their mission more impactful.
[18:38] Carolyn Woodard: So they're not spending a lot of their time doing workarounds, worrying about their IT, trying to get an answer from the help desk for something that's not working, that's keeping them from working because their laptop won't open or won't open the program that they need.
[18:53] Carolyn Woodard: They're spending all of that time on that instead of spending the time on their mission, you know, delivery.
[18:59] Carolyn Woodard: That is why they're there in the first place and why the funder is working with them in the first place.
[19:03] Carolyn Woodard: So that's one of the arguments that comes out of that is that the IT management capacity is going to make more impactful nonprofits.
[19:15] Carolyn Woodard: Along those lines as well, like um another thing, another aspect that the white paper talks about is this shared responsibility and shared partnership, which really built on a lot of my experience at Community IT.
[19:29] Carolyn Woodard: So when we work with our clients, we really consider ourselves partners in the um technology that they want to be able to use to be able to do their mission and that well-managed IT.
[19:43] Carolyn Woodard: And so, you know, correct me if I'm wrong, Johan, but we it's very difficult for us if we are working with a client who really wants us to do all the IT for them and then this, you know, present it to them of like, well, here's how your IT works.
[19:59] Carolyn Woodard: Because they're keeping from us that, as I said, that deep knowledge of what they're trying to do and what their constraints are and what they're, you know, like what their staff deal with day to day.
[20:09] Carolyn Woodard: Um, so it's really, really difficult as an MSP to just kind of work in that environment where you're not partnering with the organization.
[20:19] Carolyn Woodard: And so from that understanding of how a partnership or good IT partnership can work, um, I I really thought a lot about that when I was thinking about these three or four or five pieces of the different actors that work around IT at nonprofits.
[20:35] Carolyn Woodard: The paper talks about, and I'm sure people in the audience know this, this we've moved from, you know, 20 years ago, 25 years ago, there was this myth of keeping the overhead as low as possible, to moving now into more trust-based philanthropy, which is this exciting kind of new area that has been working really well for founders, uh, funders who can have that kind of relationship, and to even this new, newer uh ideas around total cost budgeting.
[21:05] Carolyn Woodard: So the idea that for you know decades, nonprofits have gone to funders and donors with the least of what they need to function, and that if they took a better account of everything that goes into being able to deliver their mission, it would be a larger budget, basically.
[21:22] Carolyn Woodard: A lot of people at nonprofits are not paid an equitable salary.
[21:28] Carolyn Woodard: Um, they don't take into account total cost of ownership, like for devices, for change management, for new tools.
[21:36] Carolyn Woodard: Um, so trying to move into really a better accounting for what IT costs to have functioning IT.
[21:45] Carolyn Woodard: There's the idea that IT management capacity is an equity issue.
[21:50] Carolyn Woodard: So we're asking our nonprofits staff and founders and these amazing of their community organizers, if they're you know environmental activists, if they're any sector that they're working in, we're finding these amazing people who have started these amazing organizations, who are doing these amazing things.
[22:11] Carolyn Woodard: I mean, that's why we're all working in nonprofits, right, in the philanthropy sector.
[22:15] Carolyn Woodard: And then to also expect them to be an expert in IT when that's not their core, you know, lived experience, experience of what of what they're bringing to the table, it just is really unfair.
[22:27] Carolyn Woodard: So making it making this sector be better able to recognize that and provide the supports for the IT itself, but also for growing that ability to manage IT, I think is really important.
[22:41] Carolyn Woodard: As I said, you know, the delivery models and examples do exist.
[22:45] Carolyn Woodard: Trying to surface them and have more examples that funders can look to when they're thinking about, like, oh, I need to actually help grow this management capacity.
[22:56] Carolyn Woodard: How do I do that?
[22:57] Carolyn Woodard: And then in the paper, some of the next steps that come up is, as I said, this is an unrealized opportunity.
[23:04] Carolyn Woodard: So, you know, in our experience in our 25 years of doing this, the person who owns IT is so important.
[23:12] Carolyn Woodard: Investing in that ability of the nonprofit to have that person who owns the IT really be able to do what they need to do is just going to be very impactful.
[23:22] Carolyn Woodard: So we're trying to argue for that for the for the funders.
[23:27] Carolyn Woodard: And then for nonprofits, the ability to grow that capacity, it could be an internal person, it could be partnering with an MSP.
[23:35] Carolyn Woodard: There's lots of resources out there.
[23:38] Carolyn Woodard: But I think it's been kind of disguised a little bit as you need the right IT.
[23:43] Carolyn Woodard: And we want to try and reframe that a bit as you need the right IT management.
[23:48] Carolyn Woodard: The IT itself can fall into place, but without management, it's really difficult to have your nonprofit reach its goals.
[23:56] Carolyn Woodard: So that was a bit long-winded.
[24:00] Johan Hammerstrom: No, it's great.
[24:00] Johan Hammerstrom: That was great.
[24:01] Carolyn Woodard: I think we're going to need to get to ...
[24:03] Carolyn Woodard: Here's some key takeaways from today.
[24:05] Carolyn Woodard: As you think about this, and if you share this presentation, or the you know, the video will be on our website.
[24:12] Carolyn Woodard: Um, some things to think about that we've talked about over the course of this presentation.
[24:18] Carolyn Woodard: The tools, devices, and licenses is like the least of what you'd need, that can't be impactful without management capacity and that strategic thinking.
[24:28] Carolyn Woodard: That management capacity can be grown, and there are lots of ways to do that that are in the paper, and we'll talk about more of them in future webinars as well.
[24:38] Carolyn Woodard: This moment of AI adoption is showing underlying IT management issues.
[24:44] Carolyn Woodard: AI cannot deliver well-managed IT on its own.
[24:49] Carolyn Woodard: These funders, if you're listening, have an opportunity and the models do exist.
[24:54] Carolyn Woodard: And like I said, all of the partners bring capacity and knowledge to the table.
[24:59] Carolyn Woodard: The key is going to be working together to be a change and face this challenge.
[25:06] Carolyn Woodard: So I think now we can get into the QA.
[25:09] Carolyn Woodard: So I want to make sure we get to this question that is in the QA side.
[25:14] Carolyn Woodard: If you have more questions, you're in the audience, go ahead and put them in.
[25:17] Carolyn Woodard: Like I said, we'll be able to answer some of them on Reddit also.
[25:20] Carolyn Woodard: But here's the question: I wear too many hats at my nonprofit, and I worry that I over-rely on our tech vendor to tell us what best actions are because I lack the bandwidth to think strategically.
[25:31] Carolyn Woodard: Ideally, I'd like to be able to think through these strategic questions, but in the meantime, is there one thing you would recommend to a one-person team who would like to be more proactive, but just can't all the time?
[25:45] Johan Hammerstrom: Yeah, it's a fantastic question.
[25:47] Johan Hammerstrom: Um, and there's kind of uh two parts to the to the answer.
[25:51] Johan Hammerstrom: The first part would be you know, when you if you're working with a third-party vendor who's providing a lot of your tech support, require them to be proactive.
[26:03] Johan Hammerstrom: So you can delegate in some ways the proactivity to them.
[26:07] Johan Hammerstrom: If they're not capable of being proactive, then that kind of tells you something about you know how much of a partner they're gonna be able to be for you in this situation.
[26:16] Johan Hammerstrom: But some of the ways that you can be proactive with your vendor are to have a monthly meeting, a monthly check-in.
[26:22] Johan Hammerstrom: You may already have this, but that goes a long way towards being proactive.
[26:27] Johan Hammerstrom: Ask that they come to the meeting with a summary of what's happened with IT in the IT environment, like a summary of how many issues they've worked on over the course of the month, a summary of the antivirus activity activity if there's been any, um, summary of issues that they've been working on.
[26:47] Johan Hammerstrom: So just having that monthly check-in with your vendor will really go a long way towards uh shifting the relationship to being a more proactive one.
[26:56] Johan Hammerstrom: So I would strongly encourage that.
[26:59] Johan Hammerstrom: I would also ask them to do an annual assessment.
[27:02] Johan Hammerstrom: So every year, you know, preferably, you know, maybe a month or two before you start putting your budget together for the following fiscal year, have them just do an assessment.
[27:13] Johan Hammerstrom: And that should be something that's very easy for them to do.
[27:16] Johan Hammerstrom: They can make recommendations about you know things they're seeing in the in the IT environment that maybe need to be changed or invested in.
[27:24] Johan Hammerstrom: Um but you know, work require your vendor to be proactive and and provide you with that information.
[27:32] Johan Hammerstrom: So that's kind of the first half of the answer.
[27:35] Johan Hammerstrom: The second half may be um, you know, uh maybe asking about whether or not you should trust your IT vendor and the things that they're recommending.
[27:47] Johan Hammerstrom: Uh, and that's a more difficult question.
[27:49] Johan Hammerstrom: And and ultimately, um you need to get to a point where you can trust your IT vendor.
[27:54] Johan Hammerstrom: And if you have concerns that um they're selling you instead of making recommendations, if you have concerns that they're not really capable of thinking proactively, uh, one way of addressing that would be to get a third uh party to come in and do a mini assessment.
[28:11] Johan Hammerstrom: You know, just get another IT support provider to come in and you know, offer you their a second opinion basically on what your current vendor is is recommending or suggesting.
[28:22] Johan Hammerstrom: So those would be some ways hope that hopefully wouldn't be too time consuming, uh, that would help you to be kind of more proactive with your existing vendor.
[28:32] Carolyn Woodard: And the the assessment, like that's one of the things I talk in the white paper about, is that funders like to fund "things" like this many laptops or this many licenses, or we sent you to a retreat, that sort of thing.
[28:45] Carolyn Woodard: Um so an assessment is a thing.
[28:47] Carolyn Woodard: So it can be an easier ask, to go to your funders or donors and say, like, we'd really like to just get a baseline of what how our IT is doing and and and how we can be proactive about it.
[28:59] Carolyn Woodard: And the other thing I was gonna say about having that monthly meeting that I know has come up with our clients is that it can also help you see what's going on.
[29:07] Carolyn Woodard: So if you have the help desk and they report to you what the incidents were and like 80% of them is one laptop, like maybe that laptop is the one that you need to replace first.
[29:17] Carolyn Woodard: Or if it's you know, phishing issues and there's one person that's always clicking on everything, get that person some more training.
[29:25] Carolyn Woodard: Those are gonna be ways that you can take advantage of that monthly meeting um yourself as well with your staff.
[29:31] Carolyn Woodard: So it is really hard to be the one person department, and we really appreciate you and everything that you're doing.
[29:38] Carolyn Woodard: So I want to move on.
[29:40] Carolyn Woodard: Um, we're gonna answer some more questions at Reddit, but um, thank you again.
[29:44] Carolyn Woodard: That was just a fantastic question.
[29:46] Carolyn Woodard: I think we did a really good job of hitting our learning objectives today.
[29:50] Carolyn Woodard: So, what does it mean for someone to own IT?
[29:53] Carolyn Woodard: Um, you can think about who that can be at your organization.
[29:56] Carolyn Woodard: Um, what does well-managed IT require?
[29:59] Carolyn Woodard: We have that great slide you can go back to and see.
[30:02] Carolyn Woodard: What does building IT management capacity, why does it matter more for nonprofit resilience than buying those tools and uh licenses and devices?
[30:11] Carolyn Woodard: And what can nonprofit leaders and funders do next to start closing the gap?
[30:16] Carolyn Woodard: I want to be sure to invite you back next month for our next webinar, which will be with our CTO and cybersecurity expert, Matthew Eshelman.
[30:24] Carolyn Woodard: We're going to re-release our revised Cybersecurity Playbook for Nonprofits that includes updates about AI, how it can create increased risks, how to manage those risks, whether you're starting out, want to be better prepared, have been working in cybersecurity for a while, have been working with AI for a while.
[30:43] Carolyn Woodard: So we're gonna answer a bunch of those questions.
[30:45] Carolyn Woodard: And this year we created a new download specifically for organizations that are starting out and want to get to that foundational level of uh cybersecurity.
[30:55] Carolyn Woodard: I'm gonna share that in this uh chat.
[30:58] Carolyn Woodard: And it will also, you know, it's on our website at communityit.com.
[31:02] Carolyn Woodard: So you can check that out as well.
[31:04] Carolyn Woodard: If you want to register for the next uh webinar, it's uh 3 p.m.
[31:09] Carolyn Woodard: Eastern, noon Pacific on Wednesday, October 21st.
[31:13] Carolyn Woodard: And you can register at our site right now, uh community it.com, and I will share that in the chat as well.
[31:21] Carolyn Woodard: Um, I want to thank you, Johan, for joining us today.
[31:24] Carolyn Woodard: This is a fantastic conversation.
[31:27] Carolyn Woodard: Um, I really appreciate your time, all of your contributions to the white paper as well.
[31:31] Carolyn Woodard: That will be coming out early next year.
[31:33] Carolyn Woodard: Uh, we will be talking about I'm leading a session at the TAG Conference in uh Chicago in November.
[31:40] Carolyn Woodard: So you can look that up on their website, tagtech.org, for the uh 2026 conference.
[31:47] Carolyn Woodard: And Johan, just thank you again so much for joining us today.
[31:52] Johan Hammerstrom: Thank you.
[31:52] Johan Hammerstrom: It was a pleasure.
[31:54] Carolyn Woodard: And thank you to everyone in the audience.
[31:56] Carolyn Woodard: I really appreciate the hour that you spent with us.
[31:59] Carolyn Woodard: I hope this has been useful to you as well.
[32:02] Carolyn Woodard: As always, you know, get in touch with us with any questions that you have.
[32:06] Carolyn Woodard: Um, we'll be over on Reddit for for a little bit, um, so you can join us there.
[32:11] Carolyn Woodard: And uh just thank you again so much.
[32:16] Community IT Intro: Thank you for joining this community IT podcast, part two.
[32:19] Community IT Intro: You can find part one in your podcast feed if you subscribe wherever you listen to podcasts.

Shows are listed from Apple Podcasts' charts and directory, and Podcast Index where it is used. Every show and episode belongs to its publisher and plays from the publisher's own feed; this site hosts none of them.