Church Cybersecurity Basics: Accounts, Access and Common Scams
A manageable starting plan for protecting church accounts, devices, data and the people who rely on them.
A church holds contact details, giving records, staff accounts and sometimes highly sensitive conversations. Security is therefore part of caring for people and keeping ministry running. A small church does not need an elaborate programme to improve its first line of defence.
Secure important accounts
Identify the owners of the domain, website, email, payments, social channels and church database. Use unique passwords and a password manager where appropriate. Turn on strong multi-factor authentication for important accounts and keep recovery methods with authorised leaders, not a single volunteer.
Remove access when roles change
Use individual accounts rather than shared logins where possible. Give people only the access their role requires. Review permissions when workers change teams or leave. An old administrator account is an avoidable risk.
Back up what the church needs
List the data and content needed to operate after a device failure or account compromise. Keep suitable backups and practise restoring a sample. A backup that nobody has tested may not help when it is needed.
Prepare for common scams
Teach teams to verify unexpected payment or account-change requests through a separate known channel. Be cautious with urgent domain renewal notices and login links. Make it easy to report a suspicious message without embarrassment.
Keep a small response plan
Write down who can disable access, contact providers, inform leaders and communicate with affected people if something goes wrong. The National Cyber Security Centre has practical guidance for small organisations. Start with these basics, assign owners and review them regularly.