Church cybersecurity check: Start here
You have 0 of 15 practices in place. A few simple steps will protect your people a great deal. Begin with the fixes below.
Your most important fixes
- Every staff account uses two-step sign-in. Turn it on for email first, then giving, church management, and social media accounts.
- You use a password manager, and never share passwords on paper or in group chats. Choose one password manager for the whole team, and share access through it, not in messages.
- Giving runs through an established payment provider, so card details never touch your own systems. Use your giving provider’s secure forms, and never write down or store card numbers yourselves.
- Children’s and safeguarding records are stored securely, with access limited. Keep them in one secure system, never in personal inboxes or spreadsheets, and record who can open them.
- Important files are backed up automatically, and you have checked you can restore them. Turn on automatic backup for shared files, and try restoring one file every few months.
Also worth doing
- Your team knows how to spot phishing, such as urgent requests for gift cards or new bank details
- Any change to bank or payment details is confirmed by a phone call
- Each person has their own login, with no shared accounts
- When someone leaves, their access is removed the same week
- Only the people who need them can see giving records and pastoral notes
- Computers and phones install updates automatically
- Church devices lock with a passcode and can be wiped if lost
- Guest Wi-Fi is separate from the office network
- Someone is named to call if something goes wrong
- Your website, domain, and key accounts belong to the church, not to one person
Already in place
- Nothing ticked yet.
From Rejoice (rejoice.global/resources). A simple checklist, not a security audit: for anything serious, talk to a qualified security professional.