Why Human Workflow Management Is the Biggest Hurdle for NYC Nonprofits

This statistic, from Okta's Nonprofits at Work 2026 report, frames a core vulnerability. Attackers view the sector as target-rich due to the sensitive data held—donor records, refugee information, government grants—while defenses remain underdeveloped. The problem is structural. Nonprofits operate with a fluid workforce of volunteers, seasonal staff, and contractors, a model that traditional, employee-centric identity and access management (IAM) systems fail to secure. Manual onboarding and offboarding for these transient roles creates security blind spots and "orphan accounts."

The Procurement Bottleneck

The digital threat compounds a more established, analog bureaucratic bottleneck: contracting. New York City’s nonprofits collectively deliver $15 to $20 billion in essential human services annually on behalf of the city. The system for paying them, however, is a legacy of decades of rules meant to ensure fair competition and prevent corruption. The result is a "crazy quilt of inconsistent policies and procedures" that can leave nearly $12 billion in contracts unregistered. Providers cannot be paid on unregistered contracts, even while they are actively incurring costs to deliver services. This forces executive directors to secure bridge loans instead of managing programs and causes staff anxiety over payroll.

A Common Denominator: The Human Workflow

Both issues—the digital access gap and the procurement delay—share a root cause: the management of human-driven workflows. A "joiner-mover-leaver" framework, standard in IAM, is conceptually relevant. Procurement is a similar lifecycle: a contract is requested (joiner), modified (mover), and closed (leaver). Inefficiency arises when these workflows are manual, poorly governed, and lack alignment across agencies and organizations. The 1989 finding of a system "without a captain" persists because the challenge is not technical expertise but coordination.

Practical Takeaways

• Audit Access: Know who has credentials to organizational systems. Orphan accounts from past volunteers or contractors represent a direct attack vector.
• Centralize Identities: Implement single sign-on (SSO) and multifactor authentication (MFA) as a baseline for all users, including volunteers.
• Automate Provisioning: Reduce manual onboarding/offboarding errors for both staff and volunteers. Use role-based access controls.
• Document Contract Lifecycles: Map every step from contract request to registration and payment. Identify the agency approvers and the common hold points.
• Quantify the Delay: Calculate the average time from service delivery to registered contract for your largest city-funded programs. This metric is a direct indicator of operational fiscal health.