MissionDefend Blog

Home Articles Get your free assessmentComing soon

Category: Foundations

Starting points for churches and nonprofits with no IT staff: what to secure first, what it costs, and how to think about risk without a security background.

  • The 10-Minute Security Talk to Give Every New Volunteer

    When something goes wrong with a church’s accounts, it is almost never a shadowy figure in a hoodie breaking down a digital door. It is usually someone kind. A volunteer who clicked because the email looked urgent. A staff member who wired money because the message seemed to come from the pastor. The Cybersecurity and Infrastructure Security Agency puts it plainly in its Secure Our World guidance: most of the everyday risk comes down to a handful of human habits, not exotic hacking. Which is actually good news. It means your best protection is not an expensive system. It is a short, warm conversation you have with every new person who joins.

    So let’s talk about that conversation. It takes about ten minutes, and you can give it to a new volunteer over coffee, at the same moment you hand them a building key. That timing matters, so let me come back to it. First, here is what you actually need to say.

    The few things worth saying

    You do not need a policy binder. You need five or six plain ideas, spoken like a person, not a compliance officer.

    Start with accounts. Ask them to use a strong, unique password for anything connected to the church — the giving platform, the email, the shared calendar — and to turn on the second sign-in step, the one that texts a code or pings an app when they log in. You can tell them the honest reason: that second step is the single thing that stops most stolen passwords from actually working. It feels like a small nuisance the first week and then you forget it is there.

    Then draw a gentle line around church accounts. The church login is for church work. It is not the place to reuse a personal password, and personal browsing habits do not need to ride along on the account that touches the congregation’s information. You can say this warmly. It is not a rule about their character. It is just keeping two rooms separate.

    Next, and this is the heart of it, teach them to be a little suspicious of urgency, especially anything about money or passwords. Almost every scam that lands on a church leans on the same trick: it makes you feel rushed. A text that looks like it is from the pastor asking for gift cards right now. An email saying an account will be closed unless you confirm your login today. Tell your new volunteer that the church will never operate that way, and that the fix is simple and free: when a request about money or credentials feels urgent, verify it through a second channel. If the “pastor” texts, call the number you already have. If the “bank” emails, log in the way you always do, not through their link. A real request survives a phone call. A scam usually does not.

    The most important sentence

    Here is the line I would have you repeat, maybe twice, so it sticks: when in doubt, ask — and asking is always the right call, never a bother. Say it and mean it. New people carry a quiet fear of looking foolish, of being the one who bothered a busy staff member over something that turned out to be nothing. That fear is exactly what scammers count on. So take it off the table on day one. Tell them that a forwarded “is this real?” email is not an interruption; it is the volunteer doing their job well. There is no such thing as a dumb question here, and the person who asks is the person we are grateful for.

    Then tell them who to ask. Give a name and a way to reach that person — the office manager, the tech-minded elder, whoever it is — so that “ask someone” is not an abstract instruction but a specific face. If something looks wrong, if a login screen seems off, if a message makes their stomach drop a little, they should know precisely who to tell and that telling that person early is always welcome, even at nine on a Saturday night.

    Why we frame it the way we do

    Somewhere in these ten minutes, say the thing underneath all of it. None of this is because you distrust them. You are handing them the keys precisely because you do trust them. All of these small habits exist to protect the people the church serves — the family whose giving records are in that system, the member who confided something in a pastoral email, the widow whose donation should reach the ministry and not a thief. Framed that way, security stops sounding like suspicion and starts sounding like care. People absorb it because it matches why they showed up to serve in the first place.

    Keep the tone warm the whole way through. A lecture makes people nod and forget. A friendly, human conversation makes them remember. The Federal Trade Commission’s small-business materials make the same point in a different key: the practices that protect an organization are ordinary and teachable, and they work best when they are part of the culture rather than a binder on a shelf.

    When to give it, and who gives it

    Give this talk during onboarding, folded into the same welcome where you show someone where the coffee is and hand over their key. Do not save it for a special training day that may never come. If a person is trusted enough to hold a key, they are ready for the ten minutes. As for who gives it — whoever welcomes new people already is the right person. It does not need to be the most technical staff member. It needs to be someone warm, because the warmth is what makes it land.

    Do this consistently, with every newcomer, and something quietly shifts. You build a team where asking is normal, where “this looks strange, can you check?” is a sentence people say without embarrassment. That culture — not any single tool — is your strongest defense. A congregation where people feel safe raising a hand is a congregation that catches problems while they are still small.

    If you want a simple, plain-English starting point for the rest of your posture, you can get first in line for our free assessment when it opens. But the ten-minute talk you can give this week, for free, before any of that.

    Sources

    • Cybersecurity and Infrastructure Security Agency (CISA), Secure Our World — cisa.gov/secure-our-world
    • National Institute of Standards and Technology (NIST), Small Business Cybersecurity Corner — nist.gov/itl/smallbusinesscyber
    • Federal Trade Commission (FTC), Cybersecurity for Small Business — ftc.gov/business-guidance/small-businesses/cybersecurity

  • How to Explain Cyber Risk to Your Board Without Scaring Them

    Somewhere between the budget line for the roof and the discussion about the fall fundraiser, you have to bring up cybersecurity. And you already know how it can go. Either eyes glaze over because it sounds like an IT problem for someone else, or you scare everyone with breach headlines and the room agrees it’s terrifying and then does nothing about it. Neither one gets you what you actually need, which is a decision.

    The good news is that a board doesn’t need to understand security. They need to understand risk, and risk is something a board already knows how to talk about. They weigh it every time they approve an insurance policy, sign a lease, or decide whether to run a capital campaign. Your job isn’t to turn them into technologists. It’s to translate a technical subject into the language of stewardship and decisions they already speak.

    Lead with what you’re protecting, not what you’re afraid of

    The mistake most people make is opening with the threat — hackers, ransomware, breaches. That puts the board in a defensive crouch, and frightened people tend to freeze rather than act. Open instead with what’s yours to protect.

    Your organization holds things people trusted you with. Members’ names, addresses, and family details. Donors’ giving records and, on the payment side, their financial information. Bank access. Sometimes counseling notes or benevolence requests that were shared in confidence. A board understands custody. So frame it that way: “We hold sensitive information about our members and donors, and part of our responsibility is keeping it safe. I want to spend ten minutes on how we’re doing that.” Now it’s a stewardship conversation, and stewardship is the board’s whole job.

    Translate the risk into terms a board already weighs

    Boards think in terms of likelihood and impact, even if they don’t use those words. You can meet them there without a single technical term.

    On likelihood, the honest and useful message is that small organizations are targeted precisely because they’re small. Attacks on churches and nonprofits are mostly automated and opportunistic — nobody is singling you out, but the internet is full of programs that knock on every door looking for one that’s unlocked. Being small and mission-focused doesn’t make you invisible; it often makes you an easier target than a bank with a security team.

    On impact, keep it concrete and local. The damage from an incident isn’t abstract “cyber” harm; it’s a diverted wire transfer that empties an account, a week where staff can’t get into email or files, member data exposed and a hard conversation with the people it belongs to, and the quiet erosion of trust that’s harder to measure than any dollar figure. You don’t need to inflate any of this. Stated plainly, it lands.

    Bring one number, not ten

    Resist the urge to build a slide of statistics. A board remembers one well-chosen figure and forgets a wall of them. Pick a single anchor that fits your point — for example, the FBI’s Internet Crime Complaint Center reports that business email compromise, the scam where an attacker impersonates a leader or vendor to redirect a payment, has driven billions in reported losses, with an average loss per incident well into the tens of thousands of dollars. One number like that, tied to a scenario your board can picture (a fake email from the pastor asking the bookkeeper to move money), does more than a dozen abstract percentages.

    Whatever figure you choose, use a real one from a named source and say where it came from. A board’s trust in you is the currency you’re spending; don’t spend it on a statistic you can’t back up.

    Ask for a decision, not a reaction

    Here’s the part that turns a scary presentation into a productive one. Don’t end with “so we should take this seriously.” End with a specific, bounded ask the board can actually approve. Boards are built to decide; give them something to decide.

    That might be approving a small annual line for security tools and training. It might be authorizing staff to spend a set number of hours getting basic protections in place. It might be as simple as endorsing a plan to turn on multi-factor authentication everywhere and adopt two short policies. The ask should be concrete, affordable, and clearly the next step — not a blank check against an unbounded fear.

    It also helps enormously to walk in already knowing where you stand. If you can say “we’ve checked our basics and here’s where we’re strong and where we have gaps,” the conversation shifts from vague anxiety to a clear-eyed plan. A board responds very differently to “the sky might be falling” than to “here are our three gaps and here’s what closing them costs.”

    Leave them calmer than you found them

    The goal of the whole conversation is not fear. It’s confidence that a responsible plan is in motion. Fear paralyzes and fades; a plan gets funded and followed. If your board leaves the room thinking “we know where we stand and we know our next step,” you’ve done exactly what good governance of any risk requires — the same thing they already do with the building, the budget, and the insurance.

    If you’d like to walk into that meeting already knowing your gaps, that’s what our free assessment is built to give you: a plain-language baseline you can put in front of a board without a translator. Get on the launch list and you’ll be first in line when it opens.

    Sources

    • Federal Bureau of Investigation, Internet Crime Complaint Center (IC3), Internet Crime Report — business email compromise loss figures, ic3.gov.
    • Cybersecurity and Infrastructure Security Agency (CISA), Cyber Guidance for Small Businesses — on the automated, opportunistic nature of attacks against small organizations, cisa.gov.
    • National Council of Nonprofits, guidance on cybersecurity as a governance and risk-management responsibility, councilofnonprofits.org.
  • The Under-100 Church Security Checklist

    The Under-100 Church Security Checklist

    It’s a Thursday evening and the pastor has a browser tab open on a cybersecurity framework. It has six functions, more than twenty categories, and just over a hundred subcategories. Somewhere around subcategory forty it becomes clear that this document was written for an organization with a security team.

    This church has three staff. Two of them are part-time. The budget has other plans this quarter, and most of them involve the roof.

    So the tab gets closed, and nothing changes, and the reason nothing changes is not indifference. It’s that almost everything written about security assumes an IT department, and a church of eighty people does not have one and is not going to get one.

    Here is the honest version.

    For an organization your size, about twelve things matter. The rest can genuinely wait.

    Not “wait until you feel guilty enough.” Wait. As in: they are lower-value uses of your very limited hours, and doing them before the twelve would be a mistake.

    What follows is those twelve, ordered by how much risk each one removes per hour you spend on it. Do them in order. Most cost nothing.

    The first four, which do most of the work

    If you only ever do part of this list, do this part. These four close the routes that actually take money out of churches.

    1. Turn on multi-factor authentication for email. Multi-factor authentication (MFA) means a second step after your password — a code from an app, or a tap on your phone — so a stolen password isn’t enough on its own. This is first because nothing else comes close: Microsoft’s own research finds it blocks more than 99.2% of account compromise attacks. Time: 15 minutes per person. Cost: nothing — it’s included in Microsoft 365 and Google Workspace.

    2. Turn it on for the giving platform and the bank, separately. Each system has its own setting, and turning it on for email does nothing for the others. Your donation processor and your online banking are the two accounts where a compromise costs real money the same day. Time: 10 minutes each. Cost: nothing.

    3. Write down the money rule and give it to whoever pays the bills. One sentence: any change to payment details — a vendor’s bank account, an employee’s direct deposit, a wire request — is verified by a phone call to a number we already had, before the money goes out. Not the number in the email. The number you already had. This single rule defeats the most expensive category of attack aimed at churches; in 2025 the FBI logged 24,768 business email compromise complaints totalling $3,046,598,558, an average of about $123,005 per report. Time: 10 minutes to write, 5 minutes to say at a staff meeting. Cost: nothing.

    4. Remove access for everyone who left. The youth intern from two summers ago. The treasurer who resigned in March. The volunteer who built the website. Make a list of every system — email, giving platform, church management software, website, social media, the bank — and go through it once. Departed people’s accounts are the most common quiet hole in a small organization, because offboarding is nobody’s job. Time: 60–90 minutes the first time, 15 minutes a year after. Cost: nothing, and it may reduce your software bill.

    The other eight

    Lower urgency, still genuinely worth the hour. Keep going in order.

    5. Get a real backup, and then test restoring from it. CISA’s guidance for small organizations is the 3-2-1 rule: “3 copies of important files, 2 different types of storage media (like a hard drive and the cloud), 1 copy stored off-site, away from your business location.” Then the part almost everyone skips — CISA also says to “test backup procedure to make sure your team can rapidly restore data both fully and partially.” An untested backup is a hope, not a backup. Restore one folder. Confirm it opens. Time: 60 minutes to set up, 20 minutes to test. Cost: often under $10/month, sometimes nothing if you already have cloud storage.

    6. Put every password in a password manager, and stop reusing them. A password manager is an app that generates and remembers a different long password for every account, so you only memorize one. The reason this matters: when any website you use gets breached, attackers try that password everywhere else. Reuse turns one company’s bad day into your bad day. Time: 45 minutes to set up, then a few minutes each time you log into something. Cost: free tiers exist; paid plans for a small team are typically a few dollars a month.

    7. Turn on automatic updates everywhere. Computers, phones, and — critically — the church website if it runs on WordPress or similar. Most successful attacks use a flaw that was fixed months earlier by an update nobody installed. Time: 20 minutes total. Cost: nothing.

    8. Check for mail rules and forwarding nobody set up. In each staff mailbox, look at the rules and forwarding settings. A rule you don’t remember creating — especially one that forwards mail elsewhere, or files anything containing “invoice” or “payroll” into a folder you never open — is one of the clearest signs an account has been compromised. Time: 5 minutes per mailbox, once a quarter. Cost: nothing.

    9. Limit who can reach the sensitive files. Background checks, payroll, counseling notes, giving records. For each category, name the two people who need access, and remove everyone else. Shared drives default to convenient rather than restrictive, which usually means “everyone with a login.” Time: 45 minutes. Cost: nothing.

    10. Turn on full-disk encryption on every laptop. Encryption means the drive is scrambled and unreadable without the password. It’s BitLocker on Windows — shown as device encryption on Windows Home — and FileVault on Mac, both built in. A laptop stolen from a car is one of the most common ways a small organization loses data, and in many states encryption changes what that theft legally means. Time: 10 minutes per machine. Cost: nothing.

    11. Get a second pair of eyes on the money. Two people see the bank statement every month, not one. Turn on transaction alerts so someone gets a text when money moves. This isn’t about distrust — it’s about making sure a fraudulent transfer is caught in hours rather than at the next quarterly report. Time: 20 minutes to set up, 10 minutes a month. Cost: nothing.

    12. Tell the congregation what you will never ask them for. One line in the newsletter and on the website: the church will never text or email you asking for gift cards, and will never call asking for your account details. Impersonation of the pastor is one of the most common attacks aimed at congregations, and older members are targeted hardest: the FBI logged 201,266 complaints from victims aged 60 and over in 2025, totalling $7.748 billion — complaints up 37% and losses up 59% in a single year. Time: 10 minutes. Cost: nothing.

    That’s the list. Total time if you did it all in one long push: about eight hours. Total cost: for most churches, somewhere between nothing and a hundred dollars a year.

    What you can honestly skip, for now

    This part matters as much as the list, because permission to skip is what makes a list like this get used. If everything is essential, nothing gets done.

    A phishing simulation platform. Monthly fake-phishing campaigns with dashboards are a real product with real value — for organizations with a hundred employees. With three staff, a five-minute conversation at a staff meeting accomplishes more, faster, and doesn’t cost per seat.

    A written information security policy. The forty-page kind. What you need instead is the money rule on one piece of paper and a written retention rule for sensitive records. Policy documents are how larger organizations communicate at scale. You can just talk to each other.

    Extra antivirus software. Windows includes antivirus protection built in and turned on. For a small church, adding a second paid product mostly adds cost and confusion. Keep the built-in one and let it update.

    A VPN. A VPN encrypts your internet traffic, and it’s genuinely useful in specific situations. It is not a general-purpose security upgrade, and buying one will not protect a mailbox with no MFA on it. Not on the critical path.

    A penetration test. A professional break-in attempt, priced accordingly. It’s a valuable exercise for an organization that has already done the twelve above. Paying for one before you’ve turned on MFA is like hiring a structural engineer to inspect a house with the front door propped open.

    Formal compliance frameworks. SOC 2, full NIST implementations, ISO certifications. These exist because large customers demand proof. Nobody is asking your church for a SOC 2 report.

    Encrypting routine email. Worth doing for specific sensitive attachments. Not worth the friction for everyday correspondence, and the friction is exactly why organizations that try it stop within a month.

    One thing that is not on the skip list: cyber liability insurance. That one costs money, so it doesn’t belong on a free checklist — but ask your broker what your existing policy covers, whether cyber coverage is available as an endorsement, and what it would cost. Five-minute email, potentially significant answer. Many churches discover they already have some coverage and nobody knew.

    A quarter, one item a week

    Twelve items, twelve weeks. That’s the sequencing that actually works, because it asks for twenty minutes on a Tuesday rather than a whole Saturday you’ll never find.

    Weeks 1–2: MFA on email, then on giving and banking.
    Week 3: write the money rule, and say it out loud at a staff meeting.
    Week 4: the departed-people access review.
    Weeks 5–6: set up the backup, then test the restore.
    Week 7: password manager.
    Week 8: automatic updates.
    Week 9: mail rules check.
    Week 10: file access cleanup.
    Week 11: laptop encryption.
    Week 12: bank alerts, and the newsletter line to the congregation.

    Put the twelve dates in a calendar today, with the item name in the subject line. That’s the difference between a good list and a finished one.

    And a note for the person reading this who feels behind: none of this is a failing. A church of eighty people running on volunteer hours was never resourced to do any of it, and the fact that it hasn’t been done says nothing about anyone’s diligence. It’s a consequence of how small organizations work. The list above is simply the shortest path from here to genuinely well-defended, and it is much shorter than the internet led you to believe.

    What to do this week

    Item one. Turn on multi-factor authentication for your email — every staff account, including the shared office mailbox. Fifteen minutes each, no cost.

    Then put the other eleven items in your calendar, one a week. Whichever way the quarter goes, you’ll have done more for your organization’s security than most churches your size manage in a decade.

    MissionDefend’s free assessment is built for exactly this situation. It asks plain-English questions about how you handle email, donations, member data, and accounts — no jargon and no IT knowledge assumed — and gives you a baseline score plus a ranked list of what to fix first, so you know which of the twelve to start with.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: Microsoft, Mandatory multifactor authentication guidance; Cybersecurity and Infrastructure Security Agency, Back Up Business Data; FBI Internet Crime Complaint Center, 2025 Internet Crime Report.

  • Church Cybersecurity: A Practical Guide for Ministries Without an IT Department

    Church Cybersecurity: A Practical Guide for Ministries Without an IT Department

    Nobody went into ministry to manage firewalls. You took the job to serve people, and somewhere along the way you also became the person who resets passwords, keeps the member database, and gets the email that says the online giving page is down.

    So when someone tells you that your church needs a cybersecurity program, the honest reaction is exhaustion. You do not have an IT department. You may not have an IT person. You have a volunteer who is good with computers and a budget that has other plans.

    Here is the encouraging part: the handful of things that actually protect a church are not expensive, and most of them are not technical. Attackers who target congregations are not breaking encryption. They are sending an email that looks like it came from your pastor. The defenses that stop them are ordinary, learnable, and largely free.

    This guide walks through what those defenses are, in the order that matters most.

    Why churches and nonprofits get targeted

    There is a persistent belief in small organizations that attackers only care about banks and hospitals. The opposite is closer to the truth. Attackers are running a numbers game, and they optimize for effort, not prestige. A church that holds bank account details, donor records, and a trusted mailing list — with no security staff and no mandatory training — is a far cheaper target than a bank.

    The FBI’s Internet Crime Complaint Center logged over a million complaints in 2025 and just under $20.9 billion in reported losses. Business email compromise alone — the category that covers fake invoices and impersonated leaders — accounted for 24,768 complaints and more than $3 billion. Phishing and spoofing generated 191,561 complaints, making it the single most-reported crime type. Almost none of that required technical sophistication. It required someone to believe an email.

    Three things make faith-based and nonprofit organizations particularly attractive.

    You hold data that is worth money and impossible to replace. Donor giving histories, member contact lists, background check results, counseling notes, children’s ministry records. Some of it is financially valuable. Some of it is simply devastating if it leaks.

    Your culture runs on trust and responsiveness. The instinct that makes a church good — assume the best, help quickly, do not interrogate the person asking — is precisely the instinct a social engineer exploits. An email that says “I’m in a meeting, can you handle this discreetly” works far better on a ministry team than on a procurement department.

    Money moves in ways that are hard to verify. Offerings, designated gifts, reimbursements, benevolence funds, vendor payments for a building project. Volume is low enough that a single fraudulent transfer does not look out of place, and controls are usually informal.

    None of this is a character flaw in your organization. It is a structural reality, and it is fixable.

    The order of operations

    If you do nothing else in this guide, do these things in this order. They are ranked by how much risk they remove per hour of effort, which is a very different ranking than what a security vendor will give you.

    1. Turn on multi-factor authentication everywhere

    Multi-factor authentication — the code from an app or a tap on your phone after you enter your password — is the single highest-value change available to you. Microsoft’s own research finds that MFA blocks more than 99.2% of account compromise attacks, which is why the company began enforcing it by default across its admin portals in 2024.

    Turn it on for email first, because email is the master key that resets every other password. Then online banking and your payment processor. Then the church management system and the donation platform. Then the domain registrar and website host, which are the accounts nobody thinks about until someone redirects the giving page.

    Expect friction. Staff and volunteers will find it annoying for about two weeks and then stop noticing. Roll it out to leadership first so the complaints land on people who understand why.

    2. Find out who has access to what

    Almost every organization we talk to has at least one surprise here: a former employee whose account is still active, a volunteer with full administrative rights they were given three years ago for one project, a shared login that half the office knows.

    Open your email admin console and list every account. Open your donor database and list every user. For each one, ask whether that person still serves in that role and still needs that level of access. Turn off what is no longer needed. This costs an afternoon and nothing else, and it routinely removes more risk than any product you could buy.

    While you are there, write down the answer to a question you should be able to answer instantly: who can see the donor database? If that list is longer than you expected, you have found your next project.

    3. Make impersonation hard to act on

    Since fake requests are the primary attack, build one rule that neutralizes them: any request to move money, change bank details, or buy gift cards is verified by voice before it is acted on. Not by replying to the email — by calling a number you already had.

    Write the rule down. Tell everyone who touches money, including volunteers. Tell them explicitly that they will never be criticized for verifying, even if the request really did come from the pastor. The failure mode you are protecting against is a bookkeeper who feels too junior to question leadership.

    This rule costs nothing and stops the most expensive category of attack outright.

    4. Get your backups right, then test one

    Ransomware is not the most common thing that will happen to you, but it is the one that stops a church cold. The recovery plan is backups, and backups only count if you have restored from them.

    Your member database, financial records, and shared documents should back up automatically, keep several weeks of history, and store at least one copy somewhere an attacker with your password cannot reach. Cloud platforms like Microsoft 365 and Google Workspace are more resilient than a server in the closet, but they are not a backup by themselves — a deleted or encrypted file syncs its deletion everywhere.

    Then do the part everyone skips: pick one file from a month ago and restore it. If you cannot, you do not have backups. You have hope.

    5. Train people on the specific scams aimed at them

    Generic security awareness training bores people and does not stick. What works is showing your team the actual scams that hit churches: the gift card request from the pastor’s name but the wrong address, the fake invoice from a vendor you really do use, the “your mailbox is full, click here” notice, the urgent wire change from a contractor mid-building-project.

    Fifteen minutes at a staff meeting, twice a year, focused on real examples beats an annual hour-long video. And make the point that matters most: the goal is not to never be fooled. The goal is to tell someone immediately when you think you might have been.

    6. Write down the few policies that matter

    You do not need a policy library. You need a small number of decisions recorded so they survive staff turnover: what devices may access church data, how passwords are handled, who may approve payments and at what threshold, what happens when someone leaves, and what you do if you suspect a breach.

    Five pages is plenty. The value is not the document. The value is that the decision has been made once, in calm conditions, rather than improvised during an incident.

    What tends to get skipped — and shouldn’t

    A few gaps show up again and again, and each is easy to close once you notice it.

    The domain registrar. Whoever controls your domain name controls your email and your website. This account is often registered to a volunteer’s personal address, secured with a password from 2017, and forgotten. Find it, secure it with MFA, and make sure at least two current leaders can access it.

    Shared logins. One password for the office computer, one for the giving platform, known to everyone who has ever worked there. Shared credentials mean you can never revoke access for one person and can never tell who did what. A password manager with proper sharing solves this for a small monthly cost, and several offer nonprofit pricing.

    Your church management software vendor. Your donor and member data lives on their servers. You are entitled to ask how it is protected, whether they support MFA, what happens if they are breached, and how you would get your data back. If the answer is evasive, that is information.

    Personal devices. Half your ministry runs from personal phones. That is not going to change, and forbidding it will only push it underground. Instead, require a screen lock and require that church email is accessed through the official app rather than forwarded to a personal Gmail account.

    Departures. The most common serious gap in small organizations is that nobody turns off accounts when someone leaves. Make it a line item on whatever checklist already exists for a departure.

    What a realistic first year looks like

    You are not going to do all of this at once, and you should not try.

    A reasonable first ninety days is MFA on email and financial accounts, an access review, the verify-by-voice rule written down and communicated, and one tested restore from backup. That is achievable by one person with a few afternoons, and it removes a large majority of the practical risk.

    The rest of the first year is the slower work: policies written, training delivered, vendors reviewed, an incident plan drafted, offboarding fixed. Then you are in the maintenance rhythm — a quarterly access review, twice-yearly training, an annual reassessment — which is what “having a security program” actually means for an organization your size.

    The goal is not perfection. The goal is that you know where you stand, you have fixed the things that matter most, and you can tell your board what has been done.

    Being honest about limits

    An assessment and a plan will not make you unbreachable. Nothing does. Organizations with enormous security teams still have incidents.

    What this work buys you is threefold. It removes the easy attacks, which are the overwhelming majority of what will actually be aimed at you. It means that when something does happen, you find out quickly and recover from a backup instead of a catastrophe. And it means you can demonstrate to a board, an insurer, or a grantmaker that you took reasonable care — which is a meaningfully different position to be in, legally and practically, than having done nothing.

    If your organization ever needs a formal audit or a penetration test — for a grant, an insurer, or a regulator — this groundwork is what makes that a manageable exercise instead of a painful one.

    Where to start this week

    Pick the smallest real thing. Turn on multi-factor authentication for your own email account today. Then list who has access to the donor database. Those two actions, done this week, put you ahead of most organizations your size.

    When you are ready to see the whole picture rather than one piece at a time, MissionDefend’s free assessment will walk you through plain-English questions about how your organization uses email, handles donations, stores member data, and manages accounts — then give you a baseline score and a ranked list of what to fix first. It takes about thirty minutes and requires no technical knowledge.

    We’re finishing it now. Leave your email and we’ll tell you the moment it opens.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live, plus a short list of steps you can take in the meantime.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or a compliance certification.

    Sources: FBI Internet Crime Complaint Center, 2025 Internet Crime Report; Microsoft, mandatory multifactor authentication guidance.