One bit
The smallest unit of progress.
One password manager rolled out. One backup restored. One staff member who recognizes a phishing email. One AI policy a board can approve. Each is small, and each one counts.
Bridging the digital divide in security and AI.
Bit Fellowship is a 501(c)(3) that helps nonprofits and community organizations get the security and AI capability they cannot build alone. A bit is the smallest piece of anything digital. A fellowship of them builds something massive.
A bit is small. A fellowship is not.
The organizations that serve the most vulnerable people usually have the least capacity for security and AI. That gap is the digital divide, and it is widening as AI moves faster than small teams can follow. We close it one bit at a time.
One byte
Eight bits make something useful.
A handful of right sized controls, done together, protect a whole organization and let it use AI with confidence. Not everything at once. The right few, in the right order.
One fellowship
Thousands of bits build the bridge.
Organizations, volunteers, funders and partners, each contributing their piece, add up to a sector that can defend itself, use AI safely and keep serving. That is the fellowship.
Bit Fellowship was founded in 2009 and is led by Sean Harris.Meet the leadershipBook Sean to speak
Three programs, one path.
Advisory plans it, Readiness rehearses it and Training teaches it. The same team does all three, so what we find becomes a plan, the plan gets rehearsed and everyone knows their part.
Advisory
Plan it.
Fractional security leadership for organizations without a security lead. We assess where you stand, set your AI use policy and build a roadmap your board can approve and your funders can trust.
- Security lead (vCISO)
- Risk assessments
- AI use policy
- HIPAA readiness
Readiness
Rehearse it.
Most incidents at small organizations start with one email. We write your response plan, test your backups and run tabletop exercises so your team acts in minutes, not days.
- Incident response plans
- Tabletop exercises
- Microsoft 365 and Google reviews
- Vendor oversight
Training
Teach it.
Plain language security and AI training for staff, volunteers and boards, plus community programs that help seniors stay safe online and veterans move into technology careers.
- Staff and volunteers
- Safe AI use
- Board briefings
- Seniors and veterans
A program that runs in a circle, not a line.
Security is not a project with an end date. We run a seven step cycle that starts with what you have and what you owe, ends with measured risk reduction, and starts again every year with a fresh roadmap. Select a step to see what happens and what you get.
Repeat
every year
every year
Step 1 of 7
Scope
Establish what we are protecting: the people, the assets, the software and the data. Then read the contracts that shape the program: clients, insurers, funders, lenders and partners.
What you get
- Asset and data inventory
- Contract obligations register
Step 2 of 7
Requirements
Determine the legal and contractual requirements that apply: state law, the types of data you hold, where that data may live, and what insurers and funders expect.
What you get
- Requirements matrix by law, contract and data type
- Data residency decisions
Step 3 of 7
Controls and gaps
Build the complete control set for your organization, then measure reality against it with a gap assessment, a risk assessment and, where warranted, penetration testing.
What you get
- Control set
- Gap and risk assessment report
- Penetration test findings
Step 4 of 7
Baseline
Set the baseline you will measure against. From here on, progress is visible, not felt.
What you get
- Baseline scorecard
- Risk register
Step 5 of 7
Roadmap
Turn the gaps into a roadmap with milestones, owners and costs, and bring the board and owners along with clear, regular communication.
What you get
- Phased roadmap
- Board and owner briefings
Step 6 of 7
Measure
Track KPIs that show whether the program meets the organization’s needs and whether risk is actually falling.
What you get
- KPI dashboard
- Quarterly review
Step 7 of 7
Renew
Each year, repeat the major steps, issue a new roadmap and report to the board. The cycle is how a program stays current instead of becoming a binder on a shelf.
What you get
- Annual roadmap
- Annual board report
Alongside the cycle: build the team
Every turn of the cycle also builds the people who will run it: competency maps for in house staff, onboarding plans for new hires and career roadmaps so the program outlives any one consultant.
Alongside the cycle: fund the work
Each step produces the artifacts a grant application needs, from the risk assessment to the scoped roadmap, so funding and the program move together. See funding by state.
AI: from no to yes, responsibly.
Most nonprofits are already using AI through personal accounts. The answer is not to ban it. It is to find where AI saves hours, set the guardrails, and remove the hurdles that keep good ideas stuck at no.
Find the efficiencies
Map where staff spend hours on drafting, summarizing and reporting, from grant writing to donor communications to case notes, and pilot AI there first.
Set the guardrails
An AI use policy your board can approve and your staff can follow: which tools, for what, with which data, reviewed by whom.
Secure the data
Clear rules for what never goes into an AI tool, with access controls, logging and retention that match the sensitivity of donor, client and health information.
Turn no into yes
A review path with clear criteria and an approved tools list, so a good idea gets a decision in days instead of stalling for months.
Train the team
Hands on sessions so staff get real value from AI tools without pasting sensitive information into them.
Measure the value
Hours saved, errors avoided and adoption, reported to the board alongside the security KPIs.
This work is fundable.
Federal and state programs, donated technology and university clinics can cover much of the cost of security and AI work. We keep a state by state list and help you apply.
How we work.
Nonprofits face the same threats as any business, with smaller teams and tighter budgets. Our work is built around that reality.
- Plain language
- Findings and plans written so an executive director, a board member and a volunteer coordinator can all act on them.
- Right sized
- Controls matched to what you are actually required to meet, starting with the free and donated tools available to nonprofits before recommending anything new.
- Independent advice
- Bit Fellowship does not resell hardware or software. When you need a managed IT or 24/7 monitoring provider, we help you choose one and hold them to the plan.
- Leave you stronger
- Every engagement includes teaching, so your team can keep the program running after we step back.
Who we work with
- Nonprofits and charities
- Health and human services
- Faith communities
- Animal welfare
- Veteran service organizations
- Schools and youth programs
- Arts and culture
- Community foundations
Straight answers before the first call.
What executive directors and boards ask us most.
What does Bit Fellowship do?
Bit Fellowship is a 501(c)(3) nonprofit that helps nonprofits and community organizations with security and AI through three programs. Advisory provides fractional security leadership, risk assessments, AI use policy and compliance readiness. Readiness builds and rehearses your incident response. Training teaches staff, volunteers, boards and community members.
Why does a small nonprofit need security help?
Nonprofits hold donor, client and sometimes health information, move money every week and often rely on volunteers and shared accounts. That makes them common targets for email fraud and ransomware. Funders and cyber insurers also ask more questions about security controls than they used to.
What about AI?
AI tools are already in most organizations, often through personal accounts. We help you set a policy your board can approve, choose tools that handle data responsibly and train staff so AI improves the work without exposing donor, client or health information.
We already have an IT provider. Do we still need you?
Often, yes. Your IT provider keeps systems running. We focus on risk, policy, compliance and preparation, and we work alongside your provider rather than replacing them.
Can you help us with HIPAA?
Yes. For health and human services organizations, we perform the security risk analysis the HIPAA Security Rule requires, write or update your policies and train your workforce.
What does it cost, and can it be funded?
Every engagement is scoped to your organization’s size, needs and budget, and you will know the cost before any work starts. Much of this work can be funded through federal and state programs, donated technology and university clinics. Our funding page lists what may be available in your state.
How does an engagement start?
With a conversation about your mission and what you need to protect. From there we agree on a first step, often a baseline risk assessment or a tabletop exercise, before any longer commitment.
How can I support Bit Fellowship?
Donate, volunteer as an instructor or mentor, or sponsor a seminar for organizations in your community. Use the form on this page and choose Volunteer, donate or partner.
Tell us about your mission.
Share what you need to protect. We will follow up to schedule a consultation and talk through a first step.
Support the mission
Bit Fellowship is a 501(c)(3) nonprofit. Donations fund security and AI education for nonprofits, seniors and veterans and are tax deductible to the extent allowed by law.
Ask about giving