(And we’re not talking about the front door!)
Somewhere in most churches there’s a person who knows where all the keys are kept. They know who has a key to the hall, who can open the vestry, and which mysterious key on the enormous bunch hasn’t fitted anything since 1987.
Well, we hope somebody knows.
But what about the other keys? Who can access the church’s email accounts, website, Facebook page, banking, membership records and cloud storage? Who has the passwords, and who decides when someone should no longer have access?
And, perhaps more importantly, what happens if the person who knows all these things suddenly isn’t available?
The keys we can’t see
Churches increasingly depend on digital systems, often without thinking of them as part of the church’s infrastructure.
Our records may live in somebody’s personal Google account. The website might be managed by a volunteer who moved away three years ago. The treasurer’s laptop may contain the only working copy of an important spreadsheet.
Usually, everything works. Until it doesn’t.
None of this necessarily means anyone has been careless. Churches depend on volunteers, inherited arrangements and people generously doing what needs to be done. The problem arises when arrangements that worked perfectly well for years become invisible to everyone except the person maintaining them.
And that’s not primarily a technology problem. It’s a governance problem.
But we’ve got someone who looks after that!
Perhaps your church has a professional IT provider. Perhaps a denominational office manages your email, or a local web developer looks after your website.
Excellent. Having competent people doing specialist work is generally much better than expecting the property steward to become a cyber-security engineer between fixing the leaking tap and organising the working bee.
But engaging someone to manage a system doesn’t mean church leaders can stop asking questions about it.
Who is responsible for deciding who gets access? What information are we storing? How is it protected? What happens if something goes wrong? And how do we know that the arrangements we’ve made are actually working?
We don’t expect church trustees to service the fire alarm themselves. We do expect them to know that someone is responsible for servicing it, and that the work has been done.
Digital systems deserve much the same attention.
Five things worth thinking about
New Zealand’s National Cyber Security Centre (NCSC) has developed a Cyber Security Framework covering five areas: governing security, understanding what needs protection, preventing problems, detecting incidents, and recovering when things go wrong.
It’s a framework developed for serious organisational use, but the underlying questions are relevant even to a small congregation.
Do we know what digital systems we rely on, and who is responsible for them?
Do we understand who can access our information, particularly sensitive pastoral, financial and personal records?
Are appropriate protections in place, and have we asked someone competent to check?
Would we recognise a problem, and would we know whom to contact?
And if a critical system failed tomorrow, could the church continue functioning while it was restored?
These aren’t questions that require a computer science degree. They require a little curiosity, some organisational memory, and a willingness to acknowledge that even the most faithful volunteer won’t be around forever.
Not another committee, please!
The answer isn’t necessarily a new policy manual, another committee, or an expensive security assessment.
For many congregations, a useful beginning might be a conversation at the next parish council or leadership meeting.
Identify the systems that matter. Establish who is responsible for them. Ask whether the arrangements are documented somewhere accessible to the right people. Make sure there’s a plan for handing over responsibilities when people move on.
And where technical questions arise, seek competent advice rather than improvising.
The NCSC publishes a Cyber Security Framework and Minimum Cyber Security Standards to help organisations understand and manage these risks. They’re available at ncsc.govt.nz.
For a church-specific starting point, we’ve also prepared Church Cyber Security: Ten Questions Worth Asking in the d|c|t Digital Toolbox. It translates the NCSC standards into questions church councils and trustees can use to review their own arrangements.
Churches have always had to care for things entrusted to them: buildings, money, records, and, most importantly, people.
Increasingly, that stewardship includes digital systems and information.
So perhaps it’s time to ask a familiar question in a slightly different way.
Who’s got the keys to the church?
And does anybody else know where they are?
Illustrations created using AI image-generation tools for d|c|t.