MissionDefend Blog

Home Articles Get your free assessmentComing soon

Tag: planning

  • What $0, $50 and $500 a Month Actually Buy You

    What $0, $50 and $500 a Month Actually Buy You

    The finance team meets on a Tuesday evening in the fellowship hall — three people, a folding table, a printed budget, and the last of the cookies from Sunday.

    Someone read an article. The church should do something about cybersecurity. There’s a proposal on the table from a company that called last week: $600 a month, twelve-month minimum, for a bundle nobody present can fully describe.

    The treasurer asks the right question. Not is this any good? but is this the first thing?

    It almost never is. And that’s the most useful thing anyone can tell a church about security spending, because the order matters far more than the amount.

    The part nobody selling you something will say

    Most of the risk a church actually faces is closed by decisions, not purchases.

    The attacks that take money from churches arrive by email and by phone. They work by persuading a person, or by using a password that was stolen somewhere else. Neither one is stopped by a device you plug into a closet or a subscription you renew every year. They’re stopped by a second step at login and by a written rule about how money moves.

    Buying tools before doing the free work is the most common and most expensive mistake in this whole category. It’s paying for a monitored alarm while the key stays under the mat — and worse, it produces a feeling of safety that delays the actual fix by a year.

    So here are three honest tiers, in order. Do not skip a tier.

    Tier one: $0 a month

    This is where the majority of the protection lives. Every item below is free, and together they are a weekend of work at most.

    Turn on multi-factor authentication everywhere. Multi-factor authentication — MFA — is the extra step after your password: a code, a prompt on your phone, a tap. It means a stolen password by itself is not enough to get in. Microsoft’s own research finds that MFA blocks more than 99.2% of account compromise attacks. If you do one thing from this entire article, do this one, and start with email, then the bank, then the giving platform, then the church database.

    Write down the money rule. One sentence: any change to payment details is verified by voice, on a phone number you already had, before the payment goes out. Not the number in the email. Not a number the caller supplies. This single rule closes invoice fraud, payroll diversion, and most vendor impersonation at once.

    Remove access that should already be gone. The bookkeeper who left in 2021. The intern from two summers ago. The former board member who still gets the shared finance folder. Every dormant account is a door with a key still in it, and nobody is watching that door because nobody uses it.

    Give the important accounts their own passwords. You don’t need a password manager to start. You need the email account, the bank, the giving platform, and the member database to each have a password used nowhere else — because the way most passwords get stolen is a breach at some unrelated website where a staff member used the same one.

    Turn on the security features you’re already paying for. External-sender warning banners on inbound mail, controls on automatic forwarding to outside addresses, audit logging, and sane file-sharing defaults come with the Microsoft 365 and Google Workspace plans churches typically hold. Some are already on — Microsoft now blocks automatic external forwarding by default — and some are not: audit logging, for instance, is switched off out of the box on Microsoft’s small-business licenses and has to be enabled by an administrator. Either way it’s an afternoon of settings, not a purchase order.

    Apply to the nonprofit programme for your platform. Both major providers give qualifying nonprofits free or heavily discounted licensing, and a surprising number of churches are paying full commercial price without knowing.

    Google Workspace for Nonprofits is offered at no charge to qualifying organizations. New accounts can add up to 300 users and can request more through Google support, with 100 TB of storage pooled across the whole organization.

    Microsoft grants Microsoft 365 Business Basic free for up to 300 seats. Be aware of a change that caught a lot of nonprofits off guard: the free grants for Microsoft 365 Business Premium and Office 365 E1 were discontinued on July 1, 2025, and those licenses now expire at renewal rather than renewing. They remain available at nonprofit pricing instead — as of July 2026 Business Premium is listed at $5.50 per user per month on an annual commitment, against $22.00 commercially.

    Eligibility for both is broadly the same shape: recognized charitable tax-exempt status equivalent to a 501(c)(3), verified through the provider’s validation partner, plus agreement to the programme’s own terms. Read those terms before you apply rather than after — Google’s, for example, require that the organization does not discriminate in hiring and employment practices or in the administration of its programs and services, which is a question a church board should answer deliberately. Government bodies, schools, and most healthcare organizations are excluded from both programmes. Terms change; check the current page rather than trusting a summary, including this one.

    Tier two: about $50 a month

    Only once tier one is genuinely finished. Here’s a worked example for a church with six paid staff. Every price below is the US list price as published by the vendor in July 2026; check the current page before you build a budget on it.

    A password manager for everyone — roughly $24 a month. Bitwarden’s Teams plan is listed at $4 per user per month billed annually; six people is $24. The point isn’t the vault, it’s the shared vault: the Wi-Fi password, the giving platform login, and the utility account stop living on a sticky note and in one person’s memory, and when someone leaves you remove their access in one action instead of changing eleven passwords. The free personal tier is better than nothing and will share with one other person, but it doesn’t stretch to a staff team.

    Off-site backup for the things that would actually hurt to lose — roughly $17 a month. Backblaze’s computer backup is listed at $99 per year per computer; two machines is about $16.50 a month. Decide what genuinely matters: the financial files, the membership and giving records, the documents that only exist on the office desktop. And understand the distinction that catches people out — cloud sync is not backup. If a file is deleted or encrypted on the laptop, the synced copy dutifully deletes or encrypts too. Backup keeps versions you can go back to.

    Upgrade the licenses of the people who handle money and data — roughly $17 a month. You do not have to license everyone at the higher tier. Put the three people who touch banking, donations, and the member database on the paid plan that adds device protection and better admin controls — nonprofit-priced Business Premium at $5.50 each is $16.50 — and leave the rest on the free grant.

    That’s about $57 a month, all in, for a six-person staff — and every dollar of it is doing something you can name.

    Tier three: about $500 a month

    At this level you are buying human attention, which is the one thing the free tier can’t give you.

    Managed endpoint protection and monitoring. An endpoint is any device a person works on — laptop, desktop, phone. The software part is cheap: Microsoft Defender for Business is listed at $3 per user per month standalone, and is included with Business Premium. The expensive part, and the valuable part, is a company that watches the alerts at 2 a.m. and calls you. Ask any provider quoting you exactly that: who looks at an alert, how fast, and what do they do next.

    Or a few hours a month of a real IT provider’s time. For many churches this is the better buy. Rates vary enormously by region and by provider, so get three written quotes and compare like for like. Ask each one what they would do in the first month, and be encouraged rather than annoyed if the answer starts with multi-factor authentication and account cleanup — that’s a provider telling you the truth.

    Be clear-eyed about what tier three is not. It does not replace tier one. A competent provider’s first questions will be whether MFA is on and who still has accounts, and if the answer is no and everyone, you have paid $500 a month to be asked.

    What not to buy first

    A firewall appliance. Your losses are arriving as email in a cloud mailbox and as phone calls to the office. A box in the closet does not see either.

    Dark web monitoring. It tells you a password of yours appeared in a breach somewhere. The response is to change that password and turn on MFA — which you can simply do now, for free, without being told.

    Phishing simulation subscriptions, before MFA is on. Testing whether staff click is a reasonable thing to do eventually. Doing it while a single clicked link still hands over a whole mailbox is out of order.

    A cyber insurance policy as a substitute for controls. Insurance is worth having. But read your own application form before you sign it — the questions it asks about your controls are a free, well-informed checklist of what your insurer thinks matters, and answering them honestly is much easier after tier one.

    Anything with a twelve-month minimum sold on a first phone call. Sit with it a week. Nothing in this field is so urgent that it cannot survive seven days of thought.

    How to ask a board for the money

    Don’t lead with fear. Lead with arithmetic, and use one number.

    In 2025 the FBI’s Internet Crime Complaint Center logged 24,768 business email compromise complaints totalling $3,046,598,558 — an average of $123,005 per report. Set that against your annual budget and the request answers itself. Most churches are asking a board to approve a few hundred dollars a year against a category of loss that averages six figures per incident.

    Then do the thing that actually gets budgets approved: bring the completed free work with you. Here is what we did at no cost — MFA on every account, the payment verification rule in writing, eleven old accounts closed. Here is the specific $57 a month I’m asking for, and here is what each line buys. A board that can see the unpaid work already done says yes to the paid work far more readily than one being asked to fund a vague worry.

    What to do this week

    Two things, both under an hour.

    First, apply to the nonprofit programme for whichever platform you use. You’ll need your determination letter and about twenty minutes. If you’re already paying commercial rates, this pays for tier two by itself.

    Second, turn on multi-factor authentication for the two accounts that matter most — whoever handles money, and the administrator account for your email system. Not everyone yet. Just those two, properly, today.

    To find out which tier your own gaps actually sit in, MissionDefend’s free assessment asks plain-English questions about how your organization handles email, donations, member data, and accounts, then returns a baseline score and a ranked list of what to fix first — which, for most churches, turns out to be a list of free things.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: FBI Internet Crime Complaint Center, 2025 Internet Crime Report; Microsoft, mandatory multifactor authentication guidance; Microsoft, Microsoft 365 nonprofit plans and pricing; Microsoft, Microsoft 365 Business Premium; Microsoft, Microsoft for Nonprofits updates; Microsoft, nonprofit eligibility; Microsoft, turn auditing on or off; Microsoft, Defender for Business; Google, Google Workspace for Nonprofits edition; Google, Google for Nonprofits eligibility; Google, Google for Nonprofits Additional Terms of Service; Bitwarden, pricing; Bitwarden, business pricing; Backblaze, computer backup pricing.

  • The First 24 Hours: What to Tell Your Congregation

    The First 24 Hours: What to Tell Your Congregation

    It is 4:15 on a Thursday when the bookkeeper realizes something is wrong. That morning she got a notification about a sign-in to the church email account from a city none of you have visited, and now, in the mailbox settings, there is a forwarding rule she did not create.

    By 5:30 the person who helps you with computers has confirmed it: someone else has been in that mailbox for at least eleven days. It holds the counting team’s spreadsheets, scanned checks, the pastoral care list, and four years of correspondence.

    The pastor asks the question every leader asks at this moment, and it is the right one:

    What do we tell people?

    The answer that feels safest — wait until we understand it fully, then send something carefully worded — is almost always the wrong one. Not because the caution is unreasonable, but because of how congregations actually respond to bad news.

    People forgive the incident. They do not forgive the silence

    Congregations are generally forgiving about the incident itself. They understand that a church has two staff and a volunteer treasurer, that email accounts get compromised at corporations with security teams, that nobody was careless in a way that deserves punishment. Most members have clicked something they shouldn’t have.

    What they don’t forgive is finding out late, finding out from somewhere else, or reading a message obviously written to limit liability rather than to inform. A member who learns three weeks later that their giving records were exposed doesn’t think these things happen. They think they knew and didn’t tell me, and that attaches to the leadership permanently.

    The reputational damage from a slow, defensive, lawyer-flavored message is usually larger than the damage from the incident itself. The incident is a thing that happened to you. The silence is a thing you chose.

    What you must know before you speak, and what you can say anyway

    Twelve hours in, you will not know much. Not which records were accessed, not whether anything was downloaded, not whether member data will be misused. Those answers can take weeks.

    Here is the reframe that unlocks the whole problem. There are three things you can almost always say honestly within hours, and they are the three things people actually want:

    What happened, in the plainest terms. Not the technical mechanism — someone gained access to one of our email accounts is enough.

    What you are doing about it. You locked the account, brought in help, and are reviewing what was in there. All true within the first afternoon.

    What you want them to do. This is the part people scan for, and the part most notices bury.

    You don’t need the full scope to say those three things. What you should have before you speak is confirmation from someone competent that an incident occurred and that the immediate hole is closed. Announcing a breach that turns out to be a misconfigured setting is its own kind of damage.

    One constraint worth knowing. All 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have laws requiring notification when certain kinds of personal information are exposed — and what counts as personal information, what triggers the duty, how long you have, what the letter must say, and whether a state attorney general has to be told all differ materially from state to state. There is no single national deadline or rule. Ask your attorney what applies to you before the formal notice goes out. Nothing here is legal advice.

    Hours, then days: two different messages

    Separate the two communications in your mind and the timing problem largely dissolves.

    The holding statement goes out within about 24 hours: what happened, what you’re doing, what to watch for, and when they’ll hear from you next. Its job is to make sure nobody learns this from a rumor. The full notice goes out in days, once you know the scope — specific about what was and wasn’t affected, carrying any formal notification your attorney says is required.

    A holding statement you can adapt:

    Subject: An important notice from [Church Name] Dear friends, I’m writing about something that happened here this week, and I want you to hear it from us rather than anywhere else. On Thursday we discovered that an unauthorized person had access to one of our church email accounts. We have locked that account, changed the passwords, and brought in outside help to determine exactly what was accessed and when. We do not yet know the full extent of what was in that mailbox or whether any of it was taken. That review is underway, and I would rather tell you what we know today than wait until we know everything. What we’re asking you to do. Please be cautious about any message that appears to come from the church over the next several weeks — anything asking you to give, click a link, update payment details, or send money or gift cards. The church will never contact you asking for payment, gift cards, banking details, or a password. If you receive something like that, call the office at [number] before you act on it. We will not be offended by the call. This happens to organizations far larger than ours, and what matters now is how we respond. I will write again by [specific date] with what we’ve found. If you have questions before then, call me directly at [number]. [Name] [Role], [Church Name]

    Notice what it doesn’t do: speculate, promise nothing was taken, or apologize in a way that assigns fault to a person. And it sets a specific date for the next message — the easiest way to buy time honestly.

    The follow-up, several days later:

    Subject: Update on the email incident at [Church Name] Dear friends, On [date] I wrote about unauthorized access to one of our church email accounts. Here is what we now know. The account was accessed between [date] and [date]. The mailbox contained [describe plainly: correspondence, some giving records, and documents containing member names and addresses]. We have [no evidence that / evidence that] this information was copied or misused. If your information was affected, you are receiving a separate letter with specific steps, including [credit monitoring / what to watch for]. If you did not receive that letter, our review indicates your information was not in the affected account. What we have changed. Every church account now requires a second step to log in beyond the password, so a stolen password alone is no longer enough. We have reviewed every account for unauthorized forwarding rules, and our board adopted a written security policy on [date]. What we’re still asking of you. Keep treating unexpected messages about the church with suspicion — anything about giving, payments, or account details, and especially anything referring to this incident. Call the office to check. We would much rather field the call. We have reported this to [law enforcement / the appropriate authorities] and are following the notification requirements that apply to us. I’m grateful for the grace you’ve shown this week. If you’d like to talk, my number is [number]. [Name]

    Who speaks, and how it reaches the people least likely to read email

    Decide the voice before you need it. It should be the senior pastor or the board chair — one person, named, with a real phone number in the message. An unsigned notice from “the church office” reads as institutional distancing at exactly the wrong moment.

    Then use every channel, because they reach different people:

    Email, to everyone you have an address for. Fastest, and the record of what you said.

    The website. A short dated notice on the front page. This is where members send their adult children, and where anyone who hears a rumor will check.

    From the front, on Sunday. Two minutes, in plain language, not buried in announcements. Members who hear their pastor say it out loud experience it entirely differently than members who read it, and it visibly signals that the leadership is not hiding. Put a printed copy in the bulletin too.

    A phone tree. The one that gets skipped, and the one that matters most.

    Here is the uncomfortable arithmetic. The members most likely to be targeted by follow-on scams are your older members — the FBI logged 201,266 complaints from victims aged 60 and over in 2025, a 37% increase over 2024, and $7.748 billion in losses, which was up 59% in a single year. The members least likely to read an emailed notice are very often the same people. A written notice reaches the people who need it least.

    So build a short list of members who don’t use email reliably, split it among your deacons, elders, or care team, and call them. The script is three sentences: Something happened with the church’s email. Nobody needs to do anything. But if anyone contacts you claiming to be from the church and asks for money or account details, hang up and call the office.

    Twenty people making six calls each covers a congregation in an evening.

    The instruction that stops them being victimized twice

    Attackers who have been inside a mailbox for eleven days know your members’ names, your pastor’s writing style, your giving cycle, and the fact that you just announced a breach. The second wave is often more profitable than the first: a message that references the incident, expresses concern, and asks the member to “verify” something.

    So give the instruction in a form people can remember under pressure:

    The church will never contact you asking for money, gift cards, banking details, passwords, or account verification — by email, text, or phone. If anyone does, it isn’t us. Hang up or delete it, and call the office on the number in the bulletin.

    Put that sentence in the holding statement, the follow-up, the bulletin, and the phone script, and repeat it in the newsletter a month later. It’s permanent congregational hygiene that happens to be most urgent right now.

    What not to do

    Don’t minimize. “A minor issue with one of our systems” is the phrase that gets quoted back to you when the scope turns out to be larger. Describe it accurately, or as still under review — never smaller than it is.

    Don’t name the staff member. Not in the notice, not from the pulpit, not in conversation. That person is already carrying it, and naming them tells everyone else in your organization that reporting a mistake gets you publicly identified — precisely the behavior you cannot afford. If your board asks who, the answer is: a member of our team was targeted by a convincing message, and they reported it quickly, which is what limited this.

    Don’t promise it can never happen again. You can’t deliver it, and it’s what people remember if there’s a second incident. Say what you have changed instead — stronger, and true.

    Don’t go quiet because of legal advice. Counsel should review the wording of anything you send — that is what counsel is for, and formal notification has requirements you should not guess at. But there is a difference between have a lawyer read this before it goes out and say nothing until the lawyer is comfortable, and the second can run for weeks. Bring your attorney in on day one and give them a deadline. Saying nothing is not neutral; it is a choice, and its consequences compound daily.

    Don’t let the first Sunday pass in silence. If the congregation is in the building and nobody mentions it, you have communicated something.

    What to do this week

    You almost certainly are not in an incident right now, which is exactly why this is the week.

    Write two things and put them in a shared folder labeled clearly enough that a panicking person can find it: the name and mobile number of whoever will speak publicly if this happens, and a draft holding statement — adapt the one above in fifteen minutes by filling in the brackets.

    Then build the phone-tree list: which members don’t use email, and who calls them. On the worst day, that list is the difference between reaching your congregation and merely emailing it.

    Forty-five minutes, and the first 24 hours stop being improvised.

    The best time to work all of this out is before you need it. MissionDefend’s free assessment asks plain-English questions about how your church handles email, donations, member data, and accounts, then hands back a baseline score and a ranked list of what to fix first.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: Federal Trade Commission, Data Breach Response: A Guide for Business; National Conference of State Legislatures, Security Breach Notification Laws; FBI Internet Crime Complaint Center, 2025 Internet Crime Report.