The Cybersecurity Clinic provides students with hands-on experience conducting cybersecurity risk assessments while helping nonprofit organizations better understand and improve their cybersecurity posture.
With the guidance of a course instructor, student teams work with organizations to identify sources of cybersecurity risk and recommend practical, cost-effective measures that improve data protection. Using widely adopted industry standards and frameworks, students produce a formal cybersecurity risk assessment report and provide educational materials that support recommended safeguards.
The security risk assessment project for a client organization gives security students an opportunity to put into practice what they have learned in the classroom. The real-world experience that students gain from the project on problem-solving, verbal and team communication, and information security prepares them for professional work. In exchange, participating organizations gain an objective assessment of cybersecurity risks and actionable recommendations for strengthening their security posture.
The Clinic focuses on identifying effective free or low-cost improvements, including policies, operational procedures, system configuration changes, AI governance and risk management practices, and employee security awareness training recommendations and resources. Students can achieve course objectives without directly accessing personal client information or organizational networks. However, organizations may request that cybersecurity students review client-provided system logs to identify potential security weaknesses and opportunities for security improvement.
In addition to risk assessments, the Clinic provides cybersecurity policy review, policy development, compliance reviews, security awareness training, and cybersecurity program development support.
Student risk assessments and recommendations are informed by these widely-recognized cybersecurity frameworks, industry standards, and platform-specific security guidance:
We provide pro bono cybersecurity risk assessments and training in exchange for a limited investment of organizational time. Participating organizations gain greater awareness of cybersecurity risks, practical recommendations for reducing vulnerabilities, and guidance for improving security practices.
Because many nonprofit organizations and small businesses have limited cybersecurity resources, the Clinic emphasizes recommendations that are realistic, affordable, and capable of producing meaningful security improvements. Organizations also benefit from helping prepare the next generation of cybersecurity professionals through experiential learning.
The Cybersecurity Clinic welcomes both new and returning organizations interested in cybersecurity risk assessments, security improvement recommendations, and cybersecurity training. While the Clinic primarily serves nonprofit organizations, small businesses are also welcomed to request services.
We seek partnerships with nonprofit organizations in the Chicago area that are geographically accessible for student visits from DePaul University's Loop Campus. The Clinic is particularly well suited for organizations that have established operations, rely on technology to support their mission, maintain sensitive information, and have a need to better understand and manage cybersecurity risk. A physical office location is helpful but not required. Organizations may request multiple cybersecurity projects that can be completed concurrently or sequentially, depending on student availability and project scope.
Successful projects require collaboration between students and organizational representatives. Participating organizations are asked to:
Meet with a member of the Clinic leadership team before the project begins to confirm project scope and expectations.
Designate a primary organizational representative who can meet with students weekly throughout the engagement.
Facilitate limited meetings with IT staff or technology service providers, when applicable.
Discuss project findings, ask questions, and provide clarification when needed.
Provide timely feedback to support project progress.
Participate in project kickoff and final presentation sessions when the engagement is part of an academic course.
Complete brief pre-project and post-project surveys to help measure Clinic impact and support continuous improvement.
Organizations may request Clinic services by completing an application. Completed applications are reviewed monthly to verify eligibility. Eligibility is based on factors such as organizational mission, cybersecurity needs, geographic accessibility, the organization's ability to participate in a student-led engagement during an academic quarter, and the potential for the proposed project to support meaningful student learning through engagement with real-world cybersecurity challenges and organizational constraints. After reviewing an application, Clinic staff will notify the applicant of the review outcome.
A one-hour meeting will be scheduled with applicants who meet the Clinic's general eligibility requirements. The purpose of the meeting is to discuss the organization's mission, operational context, cybersecurity concerns, course logistics, and a project scope tailored to its needs. Following the meeting, eligible projects are evaluated for educational fit, scope, and available student capacity before a final participation decision is made.
Accepted projects are scheduled based on student availability and the academic calendar. Course-based projects typically span eleven weeks. All Clinic engagements have a defined beginning and end; the Clinic provides project-based services rather than ongoing managed services. Once a project is approved, it becomes active when a student team is assigned and ready to begin work.
Request Clinic services for an organization by completing the application.
Organizations that participate in Cybersecurity Clinic projects understand that students are still developing their cybersecurity knowledge and professional skills. While students work under faculty guidance, clients are encouraged to use their own judgment and, when appropriate, seek additional advice from qualified cybersecurity, information technology, or other subject matter experts before implementing recommendations.
Students participating in Clinic projects are required to sign non-disclosure agreements and are expected to maintain the confidentiality of client information. The Clinic makes reasonable efforts to safeguard sensitive information and emphasizes quality, professionalism, effectiveness, and security throughout all projects.
Although the Clinic holds students to high standards of conduct and performance, errors or omissions may occur. By participating in Clinic activities, clients acknowledge that recommendations and services are provided for educational purposes and that DePaul University, its students, faculty, staff, administrators, and representatives shall not be liable for any loss, damage, or adverse consequences arising from the use of, reliance upon, or implementation of student work, recommendations, or deliverables.