Despite increased awareness among civil society groups about cyber resilience, few have basic security policies and procedures.