NEWS
February 24, 2025
- Services
Datasheet
Tool/Template
Choosing a nonprofit CMS comes down to a few things: who can publish without a developer, how fast a campaign goes live, whether fundraising is native or bolted on, who owns the donor data, how many languages and markets the platform can carry, whether AI is governed or just demoed, how quickly a security problem gets found, and what the whole thing costs over five years. This checklist turns those criteria into a scoring sheet, with the questions to put to each vendor and space to compare three shortlisted platforms side by side.
Why platform decisions go wrong
The platform decision for a nonprofit is not a features decision. It is a governance decision: who can publish, in which language, in which market, without waiting on a developer.
By the time a shortlist reaches a vote, every demo looks capable. The differences show up later. When a crisis appeal needs to be live in six hours across four languages. When finance asks where donor data physically sits. When a founder asks for an accessibility conformance report. When a country office wants its own site and the answer is a six-month project.
Those questions are answerable during evaluation. Most teams simply are not given the agenda, because the vendor sets the demo.
What this checklist does
It gives you the agenda. Each of the criteria comes with what to treat as a must-have and two questions written so that a vague answer is obvious. Score each platform 1 to 5, apply the weighting, and you finish with a defensible comparison you can hand to a board or a procurement committee.
What's inside
- Weighted criteria across editorial control, fundraising and donor data, reach and discoverability, AI readiness and governance, and security, reliability, and cost
- Vendor questions, phrased to be answered in a demo rather than in a brochure
- A scoring sheet for three shortlisted platforms.
- A five-year total cost worksheet that goes past licence fees
- A six-question fit test to run before you shortlist anything, including when a simpler platform is the better use of your budget
- Eight pages. It is a working document, not a white paper
Who it's for
Communications, fundraising, and technology leads at nonprofits and NGOs who are replacing an ageing CMS, consolidating country or campaign sites onto one platform, or writing an RFP and wanting the requirements right before it goes to market.
Vardot is a Drupal Diamond Certified Partner and has delivered more than 200 enterprise projects for organizations including UNHCR, UNRWA, MSF, UNICEF, and Education Cannot Wait. The Drupal donations platform we built for UNHCR has processed more than US$67 million across 35+ markets, with campaign launch times down to 15 minutes, as of December 2025.
Download Now
FAQs
Several things, weighted by how much they cost to fix later: role-based ease of use, campaign launch speed, layout control without a rebuild, native fundraising, form building, CRM integration, data ownership and exit rights, multilingual and multi-market scaling, structured content for search and AI visibility, WCAG 2.2 Level AA accessibility, AI in the editorial workflow, AI governance, security and compliance, support SLAs and detection speed, and five-year total cost of ownership.
Open source removes licence fees and per-campaign charges. It does not remove cost. Implementation, hosting, support, and maintenance are real line items, and the platforms that fail are usually the ones nobody budgeted to maintain. The honest comparison is five-year total cost of ownership at your expected scale, not licence cost at signature.
Fast enough to matter during a crisis. Roughly one third of all giving for a disaster is complete within one to four weeks of the event, and giving has largely stopped by six months, according to a Center for Disaster Philanthropy estimate cited by the University of Pennsylvania Center for High Impact Philanthropy. On UNHCR's Drupal donations platform, campaign launch time is down to 15 minutes across 35+ markets. Ask each vendor for a realistic number using only your own staff.
Four. Who publishes security advisories for this platform, and on what cadence. Who applies them to our site, and within what window. Can you show role-based access control, SSO, two-factor authentication, and audit logging in the admin interface. What was the timeline from detection to resolution in your last incident. The variable you can most affect is detection speed: IBM's Cost of a Data Breach Report 2024 put the average time to identify and contain a breach at 258 days.
It needs governed ones. The useful test is AI-first versus AI-adjacent. AI-adjacent means a separate tool your team copies text out of. AI-first means the assistance lives inside the editorial workflow, with a review state, a named approver, an audit trail, and a data boundary set per content type so sensitive material never reaches a hosted model. If you publish into the EU, note that EU AI Act Article 50 transparency obligations apply from 2 August 2026, with a deferral to 2 December 2026 for systems placed on the market before that date.
The checklist is the layer underneath an RFP. It defines what to require and how to score the answers. If your RFP is already drafted, the fastest use is to check it against the 15 criteria and see which ones you have specified with numbers rather than adjectives.
