It’s a Thursday evening and the pastor has a browser tab open on a cybersecurity framework. It has six functions, more than twenty categories, and just over a hundred subcategories. Somewhere around subcategory forty it becomes clear that this document was written for an organization with a security team.
This church has three staff. Two of them are part-time. The budget has other plans this quarter, and most of them involve the roof.
So the tab gets closed, and nothing changes, and the reason nothing changes is not indifference. It’s that almost everything written about security assumes an IT department, and a church of eighty people does not have one and is not going to get one.
Here is the honest version.
For an organization your size, about twelve things matter. The rest can genuinely wait.
Not “wait until you feel guilty enough.” Wait. As in: they are lower-value uses of your very limited hours, and doing them before the twelve would be a mistake.
What follows is those twelve, ordered by how much risk each one removes per hour you spend on it. Do them in order. Most cost nothing.
The first four, which do most of the work
If you only ever do part of this list, do this part. These four close the routes that actually take money out of churches.
1. Turn on multi-factor authentication for email. Multi-factor authentication (MFA) means a second step after your password — a code from an app, or a tap on your phone — so a stolen password isn’t enough on its own. This is first because nothing else comes close: Microsoft’s own research finds it blocks more than 99.2% of account compromise attacks. Time: 15 minutes per person. Cost: nothing — it’s included in Microsoft 365 and Google Workspace.
2. Turn it on for the giving platform and the bank, separately. Each system has its own setting, and turning it on for email does nothing for the others. Your donation processor and your online banking are the two accounts where a compromise costs real money the same day. Time: 10 minutes each. Cost: nothing.
3. Write down the money rule and give it to whoever pays the bills. One sentence: any change to payment details — a vendor’s bank account, an employee’s direct deposit, a wire request — is verified by a phone call to a number we already had, before the money goes out. Not the number in the email. The number you already had. This single rule defeats the most expensive category of attack aimed at churches; in 2025 the FBI logged 24,768 business email compromise complaints totalling $3,046,598,558, an average of about $123,005 per report. Time: 10 minutes to write, 5 minutes to say at a staff meeting. Cost: nothing.
4. Remove access for everyone who left. The youth intern from two summers ago. The treasurer who resigned in March. The volunteer who built the website. Make a list of every system — email, giving platform, church management software, website, social media, the bank — and go through it once. Departed people’s accounts are the most common quiet hole in a small organization, because offboarding is nobody’s job. Time: 60–90 minutes the first time, 15 minutes a year after. Cost: nothing, and it may reduce your software bill.
The other eight
Lower urgency, still genuinely worth the hour. Keep going in order.
5. Get a real backup, and then test restoring from it. CISA’s guidance for small organizations is the 3-2-1 rule: “3 copies of important files, 2 different types of storage media (like a hard drive and the cloud), 1 copy stored off-site, away from your business location.” Then the part almost everyone skips — CISA also says to “test backup procedure to make sure your team can rapidly restore data both fully and partially.” An untested backup is a hope, not a backup. Restore one folder. Confirm it opens. Time: 60 minutes to set up, 20 minutes to test. Cost: often under $10/month, sometimes nothing if you already have cloud storage.
6. Put every password in a password manager, and stop reusing them. A password manager is an app that generates and remembers a different long password for every account, so you only memorize one. The reason this matters: when any website you use gets breached, attackers try that password everywhere else. Reuse turns one company’s bad day into your bad day. Time: 45 minutes to set up, then a few minutes each time you log into something. Cost: free tiers exist; paid plans for a small team are typically a few dollars a month.
7. Turn on automatic updates everywhere. Computers, phones, and — critically — the church website if it runs on WordPress or similar. Most successful attacks use a flaw that was fixed months earlier by an update nobody installed. Time: 20 minutes total. Cost: nothing.
8. Check for mail rules and forwarding nobody set up. In each staff mailbox, look at the rules and forwarding settings. A rule you don’t remember creating — especially one that forwards mail elsewhere, or files anything containing “invoice” or “payroll” into a folder you never open — is one of the clearest signs an account has been compromised. Time: 5 minutes per mailbox, once a quarter. Cost: nothing.
9. Limit who can reach the sensitive files. Background checks, payroll, counseling notes, giving records. For each category, name the two people who need access, and remove everyone else. Shared drives default to convenient rather than restrictive, which usually means “everyone with a login.” Time: 45 minutes. Cost: nothing.
10. Turn on full-disk encryption on every laptop. Encryption means the drive is scrambled and unreadable without the password. It’s BitLocker on Windows — shown as device encryption on Windows Home — and FileVault on Mac, both built in. A laptop stolen from a car is one of the most common ways a small organization loses data, and in many states encryption changes what that theft legally means. Time: 10 minutes per machine. Cost: nothing.
11. Get a second pair of eyes on the money. Two people see the bank statement every month, not one. Turn on transaction alerts so someone gets a text when money moves. This isn’t about distrust — it’s about making sure a fraudulent transfer is caught in hours rather than at the next quarterly report. Time: 20 minutes to set up, 10 minutes a month. Cost: nothing.
12. Tell the congregation what you will never ask them for. One line in the newsletter and on the website: the church will never text or email you asking for gift cards, and will never call asking for your account details. Impersonation of the pastor is one of the most common attacks aimed at congregations, and older members are targeted hardest: the FBI logged 201,266 complaints from victims aged 60 and over in 2025, totalling $7.748 billion — complaints up 37% and losses up 59% in a single year. Time: 10 minutes. Cost: nothing.
That’s the list. Total time if you did it all in one long push: about eight hours. Total cost: for most churches, somewhere between nothing and a hundred dollars a year.
What you can honestly skip, for now
This part matters as much as the list, because permission to skip is what makes a list like this get used. If everything is essential, nothing gets done.
A phishing simulation platform. Monthly fake-phishing campaigns with dashboards are a real product with real value — for organizations with a hundred employees. With three staff, a five-minute conversation at a staff meeting accomplishes more, faster, and doesn’t cost per seat.
A written information security policy. The forty-page kind. What you need instead is the money rule on one piece of paper and a written retention rule for sensitive records. Policy documents are how larger organizations communicate at scale. You can just talk to each other.
Extra antivirus software. Windows includes antivirus protection built in and turned on. For a small church, adding a second paid product mostly adds cost and confusion. Keep the built-in one and let it update.
A VPN. A VPN encrypts your internet traffic, and it’s genuinely useful in specific situations. It is not a general-purpose security upgrade, and buying one will not protect a mailbox with no MFA on it. Not on the critical path.
A penetration test. A professional break-in attempt, priced accordingly. It’s a valuable exercise for an organization that has already done the twelve above. Paying for one before you’ve turned on MFA is like hiring a structural engineer to inspect a house with the front door propped open.
Formal compliance frameworks. SOC 2, full NIST implementations, ISO certifications. These exist because large customers demand proof. Nobody is asking your church for a SOC 2 report.
Encrypting routine email. Worth doing for specific sensitive attachments. Not worth the friction for everyday correspondence, and the friction is exactly why organizations that try it stop within a month.
One thing that is not on the skip list: cyber liability insurance. That one costs money, so it doesn’t belong on a free checklist — but ask your broker what your existing policy covers, whether cyber coverage is available as an endorsement, and what it would cost. Five-minute email, potentially significant answer. Many churches discover they already have some coverage and nobody knew.
A quarter, one item a week
Twelve items, twelve weeks. That’s the sequencing that actually works, because it asks for twenty minutes on a Tuesday rather than a whole Saturday you’ll never find.
Weeks 1–2: MFA on email, then on giving and banking.
Week 3: write the money rule, and say it out loud at a staff meeting.
Week 4: the departed-people access review.
Weeks 5–6: set up the backup, then test the restore.
Week 7: password manager.
Week 8: automatic updates.
Week 9: mail rules check.
Week 10: file access cleanup.
Week 11: laptop encryption.
Week 12: bank alerts, and the newsletter line to the congregation.
Put the twelve dates in a calendar today, with the item name in the subject line. That’s the difference between a good list and a finished one.
And a note for the person reading this who feels behind: none of this is a failing. A church of eighty people running on volunteer hours was never resourced to do any of it, and the fact that it hasn’t been done says nothing about anyone’s diligence. It’s a consequence of how small organizations work. The list above is simply the shortest path from here to genuinely well-defended, and it is much shorter than the internet led you to believe.
What to do this week
Item one. Turn on multi-factor authentication for your email — every staff account, including the shared office mailbox. Fifteen minutes each, no cost.
Then put the other eleven items in your calendar, one a week. Whichever way the quarter goes, you’ll have done more for your organization’s security than most churches your size manage in a decade.
MissionDefend’s free assessment is built for exactly this situation. It asks plain-English questions about how you handle email, donations, member data, and accounts — no jargon and no IT knowledge assumed — and gives you a baseline score plus a ranked list of what to fix first, so you know which of the twelve to start with.
No spam and no sales calls — just one email when it’s live.
Related reading
- how to actually do item one this afternoon
- the reasoning behind the order of these items
- what each tier of spending really gets you
MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.
Sources: Microsoft, Mandatory multifactor authentication guidance; Cybersecurity and Infrastructure Security Agency, Back Up Business Data; FBI Internet Crime Complaint Center, 2025 Internet Crime Report.
