By Brent Lacy
A church does not need a full-time technology director to take cybersecurity seriously. It does need someone who knows what the church stores, who can reach it, how it is backed up, and whom to call when something looks wrong.
That responsibility is pastoral as well as administrative. Church records may include giving details, employee information, counseling notes, prayer requests, children's information, and credentials for email, banking, and online services. Those records are not just files. They are entrusted information about people.
The Federal Trade Commission recommends that organizations understand what information they hold, keep only what they need, protect what they keep, dispose of what is no longer needed, and plan for incidents. Its small-business guidance also recommends practices such as multifactor authentication, software updates, backups, staff training, and an incident response plan. A congregation can adapt those practical safeguards to its size and ministry setting.
These three priorities are a working framework for this guide, not a score or a claim that risk can be eliminated.
Start with the information your church actually holds
Before buying a security product or rewriting a policy, make a simple inventory. Ask ministry leaders and office staff where important information lives. Check the church office computer, shared drives, cloud storage, church email, bookkeeping and giving platforms, website forms, phones, removable drives, paper filing cabinets, and any device used by a volunteer to perform church work.
Do not collect passwords in the inventory. Record the service name, the church purpose, the person responsible, the account owner, whether multifactor authentication is available, and where recovery instructions are kept. A list of systems is useful; a spreadsheet of reusable passwords is a new risk.
Include less obvious records. A church may have old membership lists exported to a personal laptop, a list of children on a volunteer's phone, or prayer requests forwarded to an account that several people share. Ask where the information goes after it is collected and whether it is copied into other places.
There is a reason to take records seriously beyond technology. The IRS says exempt organizations must keep books and records showing activities, income received, and expenses incurred, even when no annual return is filed. That does not mean every ministry note should be kept forever. It means the church should distinguish required financial and organizational records from sensitive information that no longer has a clear ministry or operational purpose.
Make the inventory manageable
Start with the systems that could interrupt essential work or expose private information: email, online giving, bookkeeping, payroll, member records, children's ministry records, and the church website. Add other systems as you identify them. You are building a useful map, not conducting a forensic audit.
Keep less, and set a retention practice
When a form asks for information the church does not need, do not collect it. When a file has outlived its legitimate purpose, decide how it should be securely deleted or destroyed. The FTC recommends limiting collection and retention to what is needed and properly disposing of information that is no longer necessary. Before deleting tax, payroll, financial, employment, child-safety, or legal records, confirm applicable retention duties with a qualified adviser. This article is operational guidance, not legal or tax advice.
Write down the church's basic categories: records to retain for financial or legal reasons, records with a defined ministry purpose and review date, and information that should not be retained. Apply the same thinking to paper. Locked cabinets, controlled keys, and a clear shredding process are ordinary protections, not expensive technology.
Protect accounts before an incident forces the issue
Turn on multifactor authentication for high-value accounts
Begin with church email, banking, payroll, bookkeeping, online giving, website administration, and cloud storage. Multifactor authentication asks a person to prove their identity with an additional method beyond a password. The FTC recommends it for protecting access to sensitive information, and the Cybersecurity and Infrastructure Security Agency includes MFA among its core steps for small organizations.
Use each provider's strongest reasonable authentication option and follow its official setup instructions. Assign a named church administrator to manage access, and document a recovery path that does not depend on one person's memory or personal phone remaining available forever. Keep recovery codes in an approved, access-controlled location, not in an open shared folder.
Give people their own accounts and least necessary access
A shared login may feel convenient when several volunteers rotate through a role. It also makes it harder to know who changed a setting, and harder to remove one person's access without disrupting everyone else. Where the service permits it, create individual accounts and grant only the access each person needs.
When a treasurer, staff member, or ministry leader steps down, transfer the role carefully: confirm that the successor can perform the work, update account ownership and recovery information, and remove the former worker's access. Do this with gratitude and consistency. Access reviews are normal stewardship, not an accusation.
Use unique passwords and keep software current
Do not reuse the same password for church email, banking, and unrelated websites. A reputable password manager can help authorized users create and store unique credentials. The FTC advises using strong passwords, avoiding reuse, and enabling automatic software updates where possible. CISA likewise recommends installing software updates to address security risks.
Make someone responsible for confirming that church-owned computers, phones, routers, and key applications receive updates. Set automatic updates where appropriate, and do not keep using equipment that no longer receives security updates for sensitive church work. If your church lacks technical support, ask the provider or a trusted local professional for a clear, written recommendation before purchasing or changing systems.
Make backups that can actually help you recover
A backup matters only if it contains the information the church needs and can be restored when needed. The FTC advises organizations to back up important files regularly. CISA's guidance for small businesses goes further: assign responsibility for backups and test restoration, because a scheduled backup that cannot be recovered will not restore ministry operations.
List the essential data and services: bookkeeping, payroll, membership or contact records, shared ministry documents, website content, and any locally stored files that cannot be replaced. For each one, write down who manages its backup, how often it runs, where the copy is stored, who can access it, and how the church would restore it.
Use the backup options provided by the service, and ask what is included, how long deleted files can be recovered, and whether backups are protected separately from ordinary user accounts. Keep at least one recovery option from being continuously exposed to the same account or device that holds the live data. Do not assume that cloud synchronization is the same as a recoverable backup; confirm how deleted, changed, or encrypted files are handled.
Test one small restoration
Choose a low-risk folder or sample file. Have the person responsible restore it to a separate location, then confirm that the file opens and is usable. Record the date and result. A successful test gives you evidence that the recovery steps work; a failed test gives you a fix to make before a crisis.
Prepare a calm response before trouble appears
Write a one-page incident plan and keep it somewhere leaders can reach if email is unavailable. Name a primary coordinator and backup. Include contact information for the church's technology provider, bank, insurer if applicable, website and giving vendors, legal or privacy adviser, and relevant denominational support. List the first steps: whom to call, how to protect affected accounts, how to preserve important information, and who is authorized to communicate with staff, members, or donors.
Make clear that someone who clicks a suspicious link or sends money to the wrong account should report it quickly, without fear of shame. Early reporting gives the church a better chance to limit further harm. Tell people not to delete suspicious messages or make public statements before the response coordinator has assessed the situation.
If you suspect an account or device is compromised
Use a known-good phone number or device to contact the affected service provider and the church's bank if financial access may be involved. Follow their incident guidance. Do not use a phone number or link supplied in the suspicious message. If a computer may contain evidence, avoid experimenting with cleanup steps before getting qualified help. Preserve relevant messages and write down what happened and when.
The FTC recommends having a response plan for protecting data, keeping operations running, and notifying affected people. CISA recommends that small organizations maintain an incident response plan and practice how they will use it. A church does not need a dramatic simulation. During a staff meeting, talk through a realistic situation: the treasurer receives a convincing request to change a vendor payment account, or the office manager cannot open shared files. Who verifies the request? Who contacts the bank or provider? Who keeps worship and pastoral care functioning while the issue is handled?
Be careful with pastoral and children's information
Do not place sensitive counseling notes, abuse disclosures, health details, or children's information in a general-purpose shared folder just because it is convenient. Identify who genuinely needs access, use the protections available in the selected service, and follow church safeguarding and recordkeeping policies. For sensitive disclosures or suspected abuse, follow the church's safeguarding procedures and applicable reporting requirements promptly; cybersecurity is not a substitute for those duties.
Set a simple boundary for prayer requests. Tell people who can see a request, where it will be shared, and whether it may appear in a printed or online list. Ask before publishing personal details. That practice honors the person as well as reducing unnecessary exposure of information.
Build a routine the congregation can sustain
Small churches rarely have the spare capacity for a complicated compliance program. Assign clear ownership instead. The pastor or board should approve the basic policy and provide time for it. One administrator can maintain the system inventory and access review. A technology provider can advise on settings and recovery. Ministry leaders can make sure volunteers know how to report a concern.
Review the plan when a key staff or volunteer role changes, when the church adopts a new service, and at a regular point in the year. Keep the review short: check who has administrator access, confirm MFA is enabled on priority accounts, verify backup status, update vendor contacts, and practice one response scenario. Record decisions so the next volunteer does not have to reconstruct the process from scattered emails.
Do not let a desire for perfect security prevent basic progress. Start with email and financial accounts, use individual logins, turn on MFA, update devices, and test one backup restoration. Then address the next risk you found in the inventory. If a system holds information the church cannot protect or no longer needs, consider whether the church should stop collecting it or move to a better-supported service.
A first-month plan
- Name a responsible leader and a backup contact.
- List the church's email, financial, giving, website, and recordkeeping systems.
- Enable multifactor authentication on priority accounts and remove unnecessary access.
- Confirm what is backed up, then test a small restoration.
- Write and discuss a one-page response plan.
This is a practical starting sequence, not a certification or guarantee. Adapt it to your church's size, systems, and legal obligations.
Cybersecurity is one part of caring well for a congregation. It will not prevent every mistake or attack, and a policy cannot replace good judgment or qualified help. But a church that knows what it holds, limits access, keeps usable backups, and responds without blame is better prepared to protect the people and ministry entrusted to it.
Frequently Asked Questions
Does a small church really need a cybersecurity policy?
Yes, but it can be brief. A one-page policy can identify who is responsible, which accounts need extra protection, how access is granted and removed, where backups are kept, and how people should report a concern. The goal is shared clarity, not paperwork for its own sake.
What should we secure first if we have limited time?
Start with church email, banking, payroll, online giving, bookkeeping, and cloud storage. These accounts can provide access to money, communications, and records. Use unique accounts, turn on multifactor authentication, and confirm recovery contacts. Then work through the rest of your system inventory.
Can volunteers use their personal phones or computers?
Sometimes, but the church should set expectations before sensitive work begins. Keep devices updated and protected with a screen lock, avoid storing more information locally than needed, and remove church access when a role ends. For especially sensitive records, use a church-managed device or a system with appropriate access controls.
What should we do after a suspicious email or payment request?
Do not reply, click, or use contact details in the message. Verify requests for money or account changes using a separate, previously known phone number. Report the message to the designated church contact. If credentials or payment details were shared, contact the relevant provider or bank promptly and follow its instructions.
Do cloud services automatically protect our church data?
No service removes the church's responsibility to understand access, account recovery, retention, and backups. Ask the provider what security and recovery controls are included, who can administer the account, and how you can restore information. Choose services that your church can manage consistently and responsibly.
Browse related resources: Our Church Leadership collection has 356 tools and guides to support the work of church leaders and administrators.
Sources
- Cybersecurity for Small Business – Federal Trade Commission. Guidance on access controls, multifactor authentication, software updates, backups, staff training, and response planning.
- Protecting Personal Information: A Guide for Business – Federal Trade Commission. Guidance on taking stock, limiting retention, protecting records, and planning for incidents.
- Cyber Guidance for Small Businesses – Cybersecurity and Infrastructure Security Agency. Guidance on leadership, MFA, response planning, and backup restoration practice.
- Recordkeeping requirements for Exempt Organizations – Internal Revenue Service. Recordkeeping requirements for exempt organizations.