Cybersecurity Audit for Nonprofit for Dummies?

I work for a small nonprofit and we basically have no cybersecurity protocols.

There are two employees and everyone else is a volunteer. We don't have our own server at work, but share one (I think?) on a semi-private vendor wifi. This building also has a public one, but even the semi-private one we use is shared by other small businesses in the building. Sometimes we work remotely from coffee shops and whatnot. What kind of data can be stolen …

audit building cybersecurity cybersecurity protocols don employees nonprofit own private protocols public semi server share vendor volunteer wifi work