A structured cybersecurity audit of your church’s people, processes, and technology. We identify observed weaknesses, explain their ministry impact, and build a practical plan to address them.
Churches that need a clear baseline, an independent review, or priorities for their next security investment.
Remote evidence review, an on-site assessment, or a coordinated multicampus engagement.
A leadership scorecard, prioritized findings, and an actionable 30/60/90-day roadmap.
Within your selected package, we examine the agreed systems and available evidence across these areas. Unverified controls are marked as unknown, with the next evidence needed.
Microsoft 365 or Google Workspace accounts; MFA methods and coverage; administrative roles; account recovery; external guests; joiner/leaver processes; and third-party app permissions. Where available, review sign-in policies and relevant audit evidence.
SPF, DKIM, and DMARC configuration; authorized email senders; forwarding rules; delegation; suspicious-message reporting; and administrator recovery. Identify where spoofing protection or risky mailbox settings need attention.
An agreed sample of managed devices, patch status, endpoint protection, disk encryption, screen locks, local administrator access, and lost-device procedures. Document unsupported systems and ownership gaps.
Firewall and remote-access settings; separation of guest, staff, children’s check-in, production, cameras, and other connected systems where applicable. Review management access and maintenance responsibility.
How bank-detail changes, urgent requests, reimbursements, vendor payments, and giving-platform administration are verified and approved. Look for single-person dependencies and opportunities for impersonation fraud.
Permissions and sharing rules around donor, employee, children’s, and pastoral information in the agreed systems. Examine access and handling practices using redacted evidence wherever possible.
Ownership, administrator access, account recovery, hosting responsibility, update processes, and third-party access for selected ministry platforms. Review church-controlled settings without testing a vendor’s infrastructure.
Backup coverage, separation of administrative access, retention, failure reporting, and restore evidence. Define recovery priorities for giving, communications, check-in, and other essential ministry functions.
Phishing reporting, identity verification, finance safeguards, and guidance on approved AI tools. Review which information staff may share with AI services and who can authorize connected apps or automated actions.
Named control owners, escalation contacts, leadership decision rights, vendor responsibilities, and existing incident procedures. Organize findings using NIST CSF 2.0 functions, with scope and evidence limits made clear.
Scope is measured by systems, accounts, and complexity. Every level produces a leadership readout and a prioritized plan.
A clear starting point for smaller churches.
A deeper look at your church’s security.
A coordinated plan for a more complex ministry.
Every assessment includes a leadership readout and one verification of priority fixes submitted within 60 days. Final scope is confirmed before you commit. Travel, hardware, subscriptions and applicable taxes are additional. Repairs are optional and priced separately.
| Included scope | Essentials | Comprehensive | Multicampus |
|---|---|---|---|
| Purpose | Establish a focused baseline | Examine a broader environment and validate selected controls | Coordinate security across locations and leadership teams |
| Delivery | Remote evidence and configuration review | Remote preparation + one on-site labor day | Custom engagement plan |
| Campuses / email environments | 1 / 1 | 1 / 1 | Agreed in proposal |
| Staff & privileged volunteer accounts | Up to 15 | Up to 40 | Agreed in proposal |
| Managed endpoints | Up to 20 | Up to 60 | Agreed in proposal |
| Firewall / wireless access points | 1 / up to 4 | 1 / up to 10 | Agreed in proposal |
| Domains / critical applications | 1 / up to 5 | 2 / up to 8 | Agreed in proposal |
| Approved vulnerability checks | Not included | Selected church-owned assets | Agreed in proposal |
| Backup validation | Evidence review | Approved sample restore | Agreed in proposal |
| Incident exercise / staff briefing | Recommendations | Leadership tabletop + short staff briefing | Agreed in proposal |
| Leadership report & roadmap | Included | Included, with technical appendix | Included, with coordinated technical appendix |
| Priority-fix verification | One pass within 60 days | One pass within 60 days | One pass within 60 days |
One email environment means one Microsoft 365 or Google Workspace tenant. Schools, extra tenants, server infrastructure, and complex access arrangements may require additional scope. The Comprehensive briefing is an introduction; a full on-site staff training engagement is separate.
Confirm systems, contacts, evidence requests, access permissions, schedule, and operational constraints.
Examine configuration and process evidence; perform only the checks included in the agreed scope.
Explain likelihood, ministry impact, urgency, and dependencies. Separate observations from assumptions.
Agree on next steps. Review submitted evidence of priority original fixes within the included window.
“Audit” describes this scoped review; it is not an attestation or certification. Active checks require written authorization, named assets, agreed methods, and suitable work windows. Standard assessments exclude exploitation, third-party platform testing, and incident forensics. Your report belongs to your church, and you choose who performs the fixes.
Start with a clear view of your risks, a practical plan, and the right preparation for your people.