Someone in the office asks a simple question: where do we keep the allergy list for the kids?
Four answers come back. It’s in the check-in system. It’s also on a printed sheet in the nursery binder. Sarah keeps a copy on her phone because the tablet is slow on Sunday mornings. And there’s a spreadsheet somebody emailed around before the fall kickoff, which is still sitting in maybe nine inboxes.
All four answers are true. That’s the problem.
This isn’t a story about carelessness. It’s what happens when a small organization runs on goodwill and improvisation for a decade. Nobody decided to keep four copies of children’s medical information. It accumulated, the way things accumulate in a building that’s been used by a lot of people for a long time.
You cannot protect what nobody has written down. Every other security decision you’ll make — who gets multi-factor authentication first, what to back up, what to shred, what to tell people if something goes wrong — depends on knowing what you’re holding and where it lives. That knowledge almost never exists in one place. Building it takes an afternoon.
Why this is the first job, not the fifth
Most security advice starts with a control: turn on this setting, buy this tool, write this policy. Those are all reasonable, and they’re all guesses until you know what you have.
The Federal Trade Commission’s guide for businesses puts inventory first, before locks and disposal, in a single sentence: know what personal information you have in your files and on your computers. Not because it’s exciting, but because everything downstream is unanswerable without it.
Consider what you can’t decide today. Is your backup adequate? Depends what needs backing up. Should the giving system have stricter access than the calendar? Obviously — but who has access to the giving system right now? If a laptop went missing tonight, what would be on it? If you had to notify people that their information was exposed, which people, and how would you reach them?
Every one of those is a lookup against a list you don’t have yet.
The four questions, and a table to hold them
For each thing you find, you’re answering four questions. That’s the whole method.
What is it? In plain words. Not “member records” — names, home addresses, phone numbers, birthdays, and marital status for about 340 households. Be specific enough that a stranger reading the line understands the sensitivity.
Who can reach it? Not who should. Who actually can, today, if they tried. This includes anyone who knows a shared password, anyone whose account was never turned off, and the person who has a key to the cabinet.
Where does the copy live? Plural, almost always. The system of record, plus the export somebody made, plus the printout, plus the backup, plus the attachment in the email thread.
Do we still need it? The most useful question on the list, and the one that shrinks the problem fastest. Data you deleted cannot be stolen.
Put the answers in a table — one row per thing. A single shared document, or a printed sheet on a clipboard. Either works.
| What it is | Where the copies live | Who can reach it | Sensitivity | Still need it? |
|---|---|---|---|---|
| Member directory — names, addresses, phones, birthdays, ~340 households | ChMS; export on office PC desktop; printed pictorial directory (2021) | 3 staff logins; 1 shared “office” login; anyone with the printed copy | High | Yes — but delete the desktop export |
| Children’s check-in, allergies, emergency contacts | Check-in system; nursery binder; volunteer’s phone photo; emailed spreadsheet | 6 volunteers via shared tablet login; ~9 email recipients | Very high | Yes — one copy only |
| Background check results, 2016–present | Vendor portal; paper files, unlocked cabinet | Vendor login shared by 2 people; anyone in the office | Very high | Check retention rule with counsel |
| Giving and pledge records | Giving platform; QuickBooks; annual statement PDFs on shared drive | Treasurer, bookkeeper, pastor; shared drive is open to all staff | High | Yes — restrict the drive folder |
| Old laptop, closet | Unknown | Anyone who opens the closet | Unknown | No — wipe and dispose properly |
The sensitivity column is a judgment call, and a coarse one is fine. High, medium, low. What you’re really flagging is: how bad would it be if this ended up somewhere public, or in the hands of someone who wanted to harm one of these people? A birthday list is not the same as a benevolence file.
Now go find the rows.
Walk the building
Do this part physically. Take a legal pad and actually open the doors.
The office. Filing cabinets — including the one nobody has a key for, which you should note as an open item rather than skip. Look for personnel files, background check results, old giving envelopes, offering count sheets, contribution statements, and applications from volunteers who came and went years ago.
The children’s and youth area. Check-in records, allergy and medical information, emergency contacts, permission slips, incident reports. This is usually the most sensitive paper in the building and the least locked.
The pastor’s study and the counseling room. Care notes, benevolence applications, correspondence. Handle this category with particular seriousness — it deserves its own conversation, and we’ll cover it separately.
The closet, the storage room, the attic over the fellowship hall. Old computers. Old phones. A retired copier — the FTC’s guidance for businesses is blunt about this: the hard drive in a digital copier stores data about the documents it copies, prints, scans, faxes, or emails, and deleting or reformatting doesn’t actually remove it. Boxes of paper somebody meant to sort.
The counters and desks. The sticky note with the Wi-Fi password is a minor issue. The sticky note with the login for the giving platform is not.
Walk the accounts
Now sit down and list the online services. This is harder, because there’s no door to open. Start from three places: the bank statement (what are you paying for?), the office computer’s saved passwords or bookmarks, and the memory of whoever has been around longest.
Expect to find: the church management software, the giving or donation platform, the payroll provider, the accounting system, the email and file storage (Microsoft 365 or Google Workspace), the website and its hosting, the domain registrar, the email newsletter tool, the event registration tool, the background check vendor, the livestream and video accounts, the social media pages, and the survey tool somebody used once for a stewardship campaign.
For each one, the question that matters most is the second one: who can reach it? Log in and look at the user list. Do not rely on memory.
And then the category that catches everyone: the personal accounts holding church data. The volunteer who built the directory in her own Google Sheets. The worship leader whose personal Dropbox has every service recording. The former treasurer’s home computer, where the QuickBooks file lived. These are not violations of trust — they’re what happens when someone volunteers to help and uses the tools they already have. But that data is outside anything you control, and it walks out the door when they do.
What you will find, because everyone finds it
Three discoveries happen in nearly every inventory. Name them in advance so nobody feels caught out.
The shared login. One username and password for the giving platform, or the check-in tablet, or the Facebook page, used by five people, three of whom no longer serve. It exists because it was easier, and because individual accounts sometimes cost money per seat. The cost of it is that you can never tell who did what, and you can never remove one person without disrupting everyone.
The departed volunteer who still has access. The youth intern from two summers ago whose account was never disabled. The former board member still in the shared drive. Offboarding is the single most commonly skipped step in small organizations, because there’s rarely a formal offboarding at all — people just stop coming.
The spreadsheet that was emailed around. Somebody exported the directory to help with a mailing, attached it to a message, and sent it to eleven people. Every one of those copies is now permanent, sitting in eleven mailboxes, four of which are personal accounts with no multi-factor authentication — MFA, the extra code or tap after the password. If any one of those accounts is ever compromised, your directory goes with it.
None of these are failures of character. They’re the predictable result of a small staff doing a large job. Write them down without commentary, and fix them in order.
Turning the list into decisions
The inventory is only worth the afternoon if it changes something. Three immediate moves come almost free.
Delete. Go down the “still need it” column and act on every no. Old exports, duplicate spreadsheets, applications from people who never served, printed directories from four years ago. Paper goes in a shredder, not a recycling bin. Devices need to be properly wiped, not just deleted from — get help with that if you’re unsure.
Reduce copies. For anything marked very high, drive it toward a single authoritative copy with controlled access. The nursery binder and the phone photo and the emailed spreadsheet all go away; the check-in system stays.
Fix the access list. For the three or four most sensitive systems, remove everyone who shouldn’t be there, and put individual logins in place of shared ones where you can.
Two things to note but not solve today. Records retention — how long you’re required to keep giving records, personnel files, and background checks — has real legal and tax dimensions, and the answer differs by state and by what kind of organization you are. And if information about people is ever exposed, notification requirements exist in all fifty states, the District of Columbia, and several territories, and they vary considerably in who they cover and what they require. Both of those are questions for your attorney, with your inventory in hand. The inventory is what makes that a thirty-minute conversation instead of a three-hour one.
What to do this week
Block ninety minutes. Take a legal pad and walk the building — office, children’s area, closets, storage. Write down every place you find information about a person, and note who can reach it. Don’t fix anything yet; just list it.
Then open the two systems that hold your most sensitive data — usually the check-in system and the giving platform — and look at the user list. Remove anyone who has left.
That’s it for week one. You’ll have more of a security program than most organizations twice your size.
Once you know what you hold, the next question is how well it is protected. MissionDefend’s free assessment asks plain-English questions about how your organization handles email, donations, member data, and accounts, then returns a baseline score and a ranked list of what to fix first. An inventory like this makes those answers much easier to give.
No spam and no sales calls — just one email when it’s live.
Related reading
- deciding what to keep and what to destroy
- the care records you will find in the drawers
- the fuller guide to safeguarding member and donor records
MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.
Sources: Federal Trade Commission, Protecting Personal Information: A Guide for Business; Federal Trade Commission, Digital Copier Data Security: A Guide for Businesses; National Conference of State Legislatures, Security Breach Notification Laws.