MissionDefend Blog

Home Articles Get your free assessmentComing soon

Tag: getting started

  • The Under-100 Church Security Checklist

    The Under-100 Church Security Checklist

    It’s a Thursday evening and the pastor has a browser tab open on a cybersecurity framework. It has six functions, more than twenty categories, and just over a hundred subcategories. Somewhere around subcategory forty it becomes clear that this document was written for an organization with a security team.

    This church has three staff. Two of them are part-time. The budget has other plans this quarter, and most of them involve the roof.

    So the tab gets closed, and nothing changes, and the reason nothing changes is not indifference. It’s that almost everything written about security assumes an IT department, and a church of eighty people does not have one and is not going to get one.

    Here is the honest version.

    For an organization your size, about twelve things matter. The rest can genuinely wait.

    Not “wait until you feel guilty enough.” Wait. As in: they are lower-value uses of your very limited hours, and doing them before the twelve would be a mistake.

    What follows is those twelve, ordered by how much risk each one removes per hour you spend on it. Do them in order. Most cost nothing.

    The first four, which do most of the work

    If you only ever do part of this list, do this part. These four close the routes that actually take money out of churches.

    1. Turn on multi-factor authentication for email. Multi-factor authentication (MFA) means a second step after your password — a code from an app, or a tap on your phone — so a stolen password isn’t enough on its own. This is first because nothing else comes close: Microsoft’s own research finds it blocks more than 99.2% of account compromise attacks. Time: 15 minutes per person. Cost: nothing — it’s included in Microsoft 365 and Google Workspace.

    2. Turn it on for the giving platform and the bank, separately. Each system has its own setting, and turning it on for email does nothing for the others. Your donation processor and your online banking are the two accounts where a compromise costs real money the same day. Time: 10 minutes each. Cost: nothing.

    3. Write down the money rule and give it to whoever pays the bills. One sentence: any change to payment details — a vendor’s bank account, an employee’s direct deposit, a wire request — is verified by a phone call to a number we already had, before the money goes out. Not the number in the email. The number you already had. This single rule defeats the most expensive category of attack aimed at churches; in 2025 the FBI logged 24,768 business email compromise complaints totalling $3,046,598,558, an average of about $123,005 per report. Time: 10 minutes to write, 5 minutes to say at a staff meeting. Cost: nothing.

    4. Remove access for everyone who left. The youth intern from two summers ago. The treasurer who resigned in March. The volunteer who built the website. Make a list of every system — email, giving platform, church management software, website, social media, the bank — and go through it once. Departed people’s accounts are the most common quiet hole in a small organization, because offboarding is nobody’s job. Time: 60–90 minutes the first time, 15 minutes a year after. Cost: nothing, and it may reduce your software bill.

    The other eight

    Lower urgency, still genuinely worth the hour. Keep going in order.

    5. Get a real backup, and then test restoring from it. CISA’s guidance for small organizations is the 3-2-1 rule: “3 copies of important files, 2 different types of storage media (like a hard drive and the cloud), 1 copy stored off-site, away from your business location.” Then the part almost everyone skips — CISA also says to “test backup procedure to make sure your team can rapidly restore data both fully and partially.” An untested backup is a hope, not a backup. Restore one folder. Confirm it opens. Time: 60 minutes to set up, 20 minutes to test. Cost: often under $10/month, sometimes nothing if you already have cloud storage.

    6. Put every password in a password manager, and stop reusing them. A password manager is an app that generates and remembers a different long password for every account, so you only memorize one. The reason this matters: when any website you use gets breached, attackers try that password everywhere else. Reuse turns one company’s bad day into your bad day. Time: 45 minutes to set up, then a few minutes each time you log into something. Cost: free tiers exist; paid plans for a small team are typically a few dollars a month.

    7. Turn on automatic updates everywhere. Computers, phones, and — critically — the church website if it runs on WordPress or similar. Most successful attacks use a flaw that was fixed months earlier by an update nobody installed. Time: 20 minutes total. Cost: nothing.

    8. Check for mail rules and forwarding nobody set up. In each staff mailbox, look at the rules and forwarding settings. A rule you don’t remember creating — especially one that forwards mail elsewhere, or files anything containing “invoice” or “payroll” into a folder you never open — is one of the clearest signs an account has been compromised. Time: 5 minutes per mailbox, once a quarter. Cost: nothing.

    9. Limit who can reach the sensitive files. Background checks, payroll, counseling notes, giving records. For each category, name the two people who need access, and remove everyone else. Shared drives default to convenient rather than restrictive, which usually means “everyone with a login.” Time: 45 minutes. Cost: nothing.

    10. Turn on full-disk encryption on every laptop. Encryption means the drive is scrambled and unreadable without the password. It’s BitLocker on Windows — shown as device encryption on Windows Home — and FileVault on Mac, both built in. A laptop stolen from a car is one of the most common ways a small organization loses data, and in many states encryption changes what that theft legally means. Time: 10 minutes per machine. Cost: nothing.

    11. Get a second pair of eyes on the money. Two people see the bank statement every month, not one. Turn on transaction alerts so someone gets a text when money moves. This isn’t about distrust — it’s about making sure a fraudulent transfer is caught in hours rather than at the next quarterly report. Time: 20 minutes to set up, 10 minutes a month. Cost: nothing.

    12. Tell the congregation what you will never ask them for. One line in the newsletter and on the website: the church will never text or email you asking for gift cards, and will never call asking for your account details. Impersonation of the pastor is one of the most common attacks aimed at congregations, and older members are targeted hardest: the FBI logged 201,266 complaints from victims aged 60 and over in 2025, totalling $7.748 billion — complaints up 37% and losses up 59% in a single year. Time: 10 minutes. Cost: nothing.

    That’s the list. Total time if you did it all in one long push: about eight hours. Total cost: for most churches, somewhere between nothing and a hundred dollars a year.

    What you can honestly skip, for now

    This part matters as much as the list, because permission to skip is what makes a list like this get used. If everything is essential, nothing gets done.

    A phishing simulation platform. Monthly fake-phishing campaigns with dashboards are a real product with real value — for organizations with a hundred employees. With three staff, a five-minute conversation at a staff meeting accomplishes more, faster, and doesn’t cost per seat.

    A written information security policy. The forty-page kind. What you need instead is the money rule on one piece of paper and a written retention rule for sensitive records. Policy documents are how larger organizations communicate at scale. You can just talk to each other.

    Extra antivirus software. Windows includes antivirus protection built in and turned on. For a small church, adding a second paid product mostly adds cost and confusion. Keep the built-in one and let it update.

    A VPN. A VPN encrypts your internet traffic, and it’s genuinely useful in specific situations. It is not a general-purpose security upgrade, and buying one will not protect a mailbox with no MFA on it. Not on the critical path.

    A penetration test. A professional break-in attempt, priced accordingly. It’s a valuable exercise for an organization that has already done the twelve above. Paying for one before you’ve turned on MFA is like hiring a structural engineer to inspect a house with the front door propped open.

    Formal compliance frameworks. SOC 2, full NIST implementations, ISO certifications. These exist because large customers demand proof. Nobody is asking your church for a SOC 2 report.

    Encrypting routine email. Worth doing for specific sensitive attachments. Not worth the friction for everyday correspondence, and the friction is exactly why organizations that try it stop within a month.

    One thing that is not on the skip list: cyber liability insurance. That one costs money, so it doesn’t belong on a free checklist — but ask your broker what your existing policy covers, whether cyber coverage is available as an endorsement, and what it would cost. Five-minute email, potentially significant answer. Many churches discover they already have some coverage and nobody knew.

    A quarter, one item a week

    Twelve items, twelve weeks. That’s the sequencing that actually works, because it asks for twenty minutes on a Tuesday rather than a whole Saturday you’ll never find.

    Weeks 1–2: MFA on email, then on giving and banking.
    Week 3: write the money rule, and say it out loud at a staff meeting.
    Week 4: the departed-people access review.
    Weeks 5–6: set up the backup, then test the restore.
    Week 7: password manager.
    Week 8: automatic updates.
    Week 9: mail rules check.
    Week 10: file access cleanup.
    Week 11: laptop encryption.
    Week 12: bank alerts, and the newsletter line to the congregation.

    Put the twelve dates in a calendar today, with the item name in the subject line. That’s the difference between a good list and a finished one.

    And a note for the person reading this who feels behind: none of this is a failing. A church of eighty people running on volunteer hours was never resourced to do any of it, and the fact that it hasn’t been done says nothing about anyone’s diligence. It’s a consequence of how small organizations work. The list above is simply the shortest path from here to genuinely well-defended, and it is much shorter than the internet led you to believe.

    What to do this week

    Item one. Turn on multi-factor authentication for your email — every staff account, including the shared office mailbox. Fifteen minutes each, no cost.

    Then put the other eleven items in your calendar, one a week. Whichever way the quarter goes, you’ll have done more for your organization’s security than most churches your size manage in a decade.

    MissionDefend’s free assessment is built for exactly this situation. It asks plain-English questions about how you handle email, donations, member data, and accounts — no jargon and no IT knowledge assumed — and gives you a baseline score plus a ranked list of what to fix first, so you know which of the twelve to start with.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: Microsoft, Mandatory multifactor authentication guidance; Cybersecurity and Infrastructure Security Agency, Back Up Business Data; FBI Internet Crime Complaint Center, 2025 Internet Crime Report.

  • Social Engineering: Why Attackers Target Your People, Not Your Firewall

    Social Engineering: Why Attackers Target Your People, Not Your Firewall

    The email arrived at 8:52 on a Tuesday morning. It was from the pastor — his name, right there in the sender line — and it was short.

    Are you at your desk? I need you to handle something for me. I’m in a meeting so I can’t take calls.

    The office administrator wrote back that yes, she was at her desk. What did he need?

    Nothing about that exchange involved breaking into anything. No password was cracked. No virus was installed. No firewall was bypassed. And yet, ninety minutes later, the church was out $1,800 in gift cards.

    This is social engineering, and it is the single most common way churches and nonprofits lose money and data. Not because your organization is careless. Because it is the way the overwhelming majority of attacks now work, everywhere, and because the things that make a ministry good at being a ministry are the same things that make social engineering effective.

    What “social engineering” actually means

    The phrase sounds like jargon, and it is — but the idea underneath it is simple.

    Social engineering is persuading a person to do something, rather than forcing a computer to do it.

    That’s the whole definition. An attacker who breaks encryption is doing technical work. An attacker who convinces your bookkeeper to change a vendor’s bank details is doing social work. The second is dramatically easier, dramatically cheaper, and requires no special skill beyond patience and a plausible story.

    It helps to think of it the way you’d think about a con artist in any other era. The technology is new. The technique is not. Someone is establishing a reason you should trust them, creating a situation where checking feels rude or slow, and asking for something that seems small in the moment.

    You’ll see a lot of specific names for these attacks, and the vocabulary can feel like a wall. Here is the map, in plain terms:

    Phishing is social engineering delivered by email — a message designed to get you to click, log in, or reply. The name is a play on “fishing,” because early versions cast a wide net and waited.

    Spear phishing is the same thing aimed at one specific person, using details about them. A spear instead of a net.

    Vishing is voice phishing — the scam arrives by phone call.

    Smishing is SMS phishing — it arrives by text message.

    Pretexting is the invented backstory that makes the request feel routine. “I’m calling from your insurance carrier about the annual audit” is a pretext.

    Business email compromise, usually shortened to BEC, is the category where someone impersonates a leader or a vendor to redirect a payment.

    Every one of those is a flavor of the same thing. Someone is talking to a human being and asking them to act.

    The numbers, and why they matter to a small office

    It’s tempting to read all this and assume it’s a problem for banks. The federal data says otherwise.

    The FBI’s Internet Crime Complaint Center — the government’s clearinghouse for reported cybercrime, usually called IC3 — logged 1,008,597 complaints in 2025, with just under $20.9 billion in reported losses. Within that, phishing and spoofing generated 191,561 complaints, making it the single most-reported crime type in the country.

    Business email compromise accounted for 24,768 complaints and more than $3 billion. Divide those out and the average reported loss per BEC report was about $123,005.

    Now hold that number against a church budget. For most congregations, a single successful impersonation email costs more than a quarter’s giving. And note what didn’t appear anywhere in that description: malware, hacking tools, technical sophistication. It required someone to believe an email.

    There’s one more figure worth sitting with, because it touches your congregation rather than your office. IC3 recorded 201,266 complaints from victims aged 60 and over in 2025, with $7.748 billion in losses — a 59% increase over the prior year, and an average loss of $38,500 per victim. The people in your pews are being targeted, and many of them will hear about it from you before they hear about it from anyone else.

    The six levers

    Every social engineering attack pulls on at least one of six psychological levers. Once you can name them, you start noticing them, and noticing is most of the defense.

    Authority. The request appears to come from someone you don’t question — the pastor, the executive director, the board chair, the bank, the IRS. Authority short-circuits the instinct to verify, because verifying feels like doubting your boss.

    Urgency. There’s a deadline, real or invented. Before noon. Before the wire cutoff. Before the account is suspended. Urgency exists to prevent you from doing the one thing that would defeat the attack: pausing.

    Familiarity. The message uses the right names, the right tone, the right details. It mentions the building project by name. It knows your treasurer is called Deb, not Deborah. Familiarity is why these messages feel real — and it’s cheap to manufacture, because your staff page, bulletin, Facebook posts, and public filings are all free research material.

    Fear. Something bad will happen. Your mailbox will be deleted. Your account is compromised. There’s a legal problem. Fear narrows attention to the threat and away from the oddities in the message.

    Curiosity. An unexpected invoice. A shared document. A photo from the retreat. Curiosity is the lever behind most malicious attachments, because opening something to find out what it is feels harmless.

    The wish to be helpful. This is the one that matters most in ministry, and the one nobody wants to hear. Churches and nonprofits are staffed by people whose whole disposition is to help quickly, assume the best, and not interrogate someone who asks for something. That disposition is a virtue. It is also, precisely, the surface an attacker aims at.

    That last point deserves care. The lesson is not that your team should become suspicious of everyone. A congregation that treats every request as a threat has lost something more valuable than the money. The lesson is narrower and much more manageable: for a very small number of specific actions, verification becomes automatic and impersonal — not a judgment about the person asking, just the way that particular thing is always done.

    Why small organizations get chosen

    Three structural facts make churches and nonprofits attractive, and none of them are about carelessness.

    You hold valuable, irreplaceable data. Donor giving histories, member contact lists, background check results, counseling notes, children’s ministry records. Some of it has resale value. Some of it is simply devastating if it becomes public.

    Your money moves in ways that are hard to verify. Offerings, designated gifts, benevolence funds, reimbursements, contractor payments during a building project. Transaction volume is low enough that one fraudulent payment doesn’t stand out, and approval processes are usually informal because the team is small and trusts each other.

    And your information is public by design. A business hides its org chart. A church publishes it — with photos, titles, email addresses, and often direct phone numbers — because that’s how people find their pastor. An attacker doesn’t need to breach anything to learn who your finance person reports to.

    What actually stops it

    Because the attack targets people, the defense has to work at the level of people. Three things carry most of the weight, and none cost money.

    One rule, written down, about money. Any request to move funds, change bank details, or buy gift cards is verified by voice, using a phone number you already had — not a number in the message. Not by replying to the email. The attacker controls the email thread; they do not control the number in your directory. Write this rule down, tell everyone who touches money, and state plainly that nobody will ever be criticized for following it. The failure this prevents is a bookkeeper who feels too junior to question leadership.

    Permission to be wrong. The most expensive incidents are not the ones where someone got fooled. They’re the ones where someone got fooled and then waited three days to say so, hoping it would resolve itself. A misdirected payment caught in twenty minutes is often recoverable — the FBI’s Recovery Asset Team froze over $507 million across 3,574 domestic cases in 2025, and that process depends almost entirely on speed. The same mistake caught on Friday afternoon usually is not. Tell your team, in words, that reporting a mistake immediately is the desired behavior and will never be held against them.

    Fifteen minutes, twice a year, on real examples. Not an hour-long generic video. Show your actual staff the actual scams aimed at churches: the gift card request, the fake invoice from a vendor you really use, the “your mailbox is full” notice. Recognition is trainable. Familiarity with the specific shape of these messages is what makes someone pause.

    The rest of this series

    Over the coming weeks we’re going to take these apart one at a time — the gift card scam, business email compromise, payroll diversion, phone and text scams, AI voice cloning, and the rest. Each post explains one attack in plain language, shows what the message actually looks like, and ends with what to do about it.

    The goal isn’t to make you afraid of your inbox. It’s to make these attacks boring — familiar enough that when one arrives, someone on your team recognizes the shape of it and doesn’t have to guess.

    What to do this week

    Pick one thing. Write down the verify-by-voice rule for money requests, send it to everyone who touches a payment, and say explicitly that following it is never rude. That single paragraph, circulated once, closes the most expensive category of attack aimed at organizations like yours.

    MissionDefend’s free assessment will walk you through plain-English questions about how your organization handles email, donations, member data, and accounts, then give you a baseline score and a ranked list of what to fix first. It’s launching soon — leave your email and we’ll tell you the moment it opens.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or a compliance certification.

    Sources: FBI Internet Crime Complaint Center, 2025 Internet Crime Report.