It would certainly be permissible for a nonprofit corporation to enter into individual agreements with people it wanted to indemnify, without putting anything in the bylaws about it.  Nonprofit corporation laws normally make indemnification permissive (except in certain cases such as a complete victory in litigation where it may be mandatory) and do not require any provisions in the corporate bylaws.  Therefore, an organization could make a commitment in an ordinary agreement if it so desired.

As a prospective director, however, I would much rather see a mandatory indemnification provision in the bylaws of the organization.  (See Ready Reference Page: Bylaws Function as ‘Constitution’ of Nonprofit Corporations”)  I would not want to be subject to selective determinations on whether or not I would be covered. If the organization is really committed to indemnification, it should not be too cumbersome to amend the bylaws.  If it is too cumbersome, one can only question whether the organization is really committed.