A practical governance guide for church councils, trustees, office-holders and volunteers.

Churches are entrusted with more than buildings, bank accounts and Sunday services. We also look after personal information, financial records, email accounts, websites and the digital systems that help our communities function.

Much of this technology is managed by volunteers, external providers or whoever happened to know how to set it up in the first place. That can work remarkably well — until someone leaves, an account is compromised or an important system stops working.

Cyber security isn’t simply a technical responsibility. It’s also a matter of governance, stewardship and organisational continuity.

The good news is that church leaders don’t need to become cyber-security specialists to ask useful questions.

Where do these ten questions come from?

New Zealand’s National Cyber Security Centre (NCSC) publishes a Cyber Security Framework and ten Minimum Cyber Security Standards.

The Standards were developed primarily for government agencies, but other organisations can adopt the guidance voluntarily.

We’ve translated their ten areas into questions relevant to churches. This isn’t a compliance assessment or a substitute for professional security advice. It’s a starting point for identifying what your church knows, what it doesn’t know, and what might need attention.

The ten questions

1. Do we know what our cyber-security risks are?

NCSC standard: Risk Management

Consider what would happen if your church lost access to its email, financial systems, website or membership records. Which interruptions would be inconvenient, and which could seriously affect ministry, finances or people’s privacy?

The council or trustees should understand the significant risks, even where someone else manages the technology.

Ask: Who is responsible for identifying these risks, and when were they last discussed?

2. Do our people recognise common cyber-security threats?

NCSC standard: Security Awareness

A convincing email requesting an urgent bank payment can be more dangerous than a sophisticated technical attack.

Staff, officeholders and volunteers need enough awareness to recognise suspicious messages, questionable links and unusual requests. People handling payments or sensitive information may need additional guidance.

Ask: Would our people know what to do if they received a suspicious request — and feel comfortable checking before acting?

3. Do we know which digital systems and information we depend on?

NCSC standard: Assets and their Importance

Make a basic inventory of your church’s important digital assets: email, website, domain names, banking, accounting, cloud storage, social media, membership databases and other services.

Record who manages each system, who owns the account, and how access can be recovered.

Ask: If our main technology volunteer became unavailable tomorrow, could someone else identify and access our essential systems?

4. Are our systems configured securely?

NCSC standard: Secure Configuration of Software

Software and online services often provide security settings that aren’t enabled automatically.

Review how important accounts and systems are configured. Remove unnecessary access, disable unused services and follow the security recommendations of reputable providers.

Ask: Has anyone checked the security settings of our important systems, rather than simply accepting the defaults?

5. Are our devices and software kept up to date?

NCSC standard: Patching

Security updates help close weaknesses that attackers may exploit.

Church computers, website software, routers, mobile devices and other connected equipment all need appropriate maintenance. This includes systems managed by outside suppliers.

Ask: Who is responsible for updates, and how do we know they’re happening?

6. Do we use multi-factor authentication?

NCSC standard: Multi-factor Authentication (MFA)

Multi-factor authentication adds another verification step when someone signs in, reducing the risk that a stolen password alone will give an attacker access.

Prioritise important services such as email, banking, cloud storage, website administration and domain registration.

Ask: Which important accounts still rely on a password alone?

7. Would we notice suspicious activity?

NCSC standard: Detect Unusual Behaviour

Some services can alert administrators to unusual sign-ins, account changes or other potentially suspicious activity.

These alerts are only useful if they reach someone who knows what to do with them.

Ask: If someone gained unauthorised access to an important account, how would we find out — and who would receive the warning?

8. Does everyone have only the access they need?

NCSC standard: Least Privilege

Not everyone needs administrator access to everything.

Give people the permissions required for their responsibilities, and review access when roles change. Avoid sharing personal logins between multiple people.

Pay particular attention to former staff, ministers, officeholders, contractors and volunteers.

Ask: Do we regularly review who can access our systems, and remove access when it’s no longer needed?

9. Could we recover our important information?

NCSC standard: Data Recovery

Backups matter, but a backup that nobody knows how to restore may provide little comfort.

Consider financial records, membership information, important documents and website content. Understand which services are backed up, where copies are held and how recovery would work.

Cloud storage or an external service provider doesn’t automatically guarantee that everything can be recovered.

Ask: Have we confirmed that our essential information can actually be restored?

10. Do we know what to do when something goes wrong?

NCSC standard: Response Planning

Even well-managed organisations experience incidents.

A simple response plan should identify who needs to be contacted, who can make decisions, how affected systems can be secured and how essential activities will continue.

It should also consider when to contact a service provider, the NCSC, affected individuals or other appropriate authorities.

Ask: If our church email account were compromised on a Friday afternoon, who would take charge?

What should our church do next?

You don’t need to solve all ten questions at the next council meeting.

Start by discussing them with the people who understand your current arrangements. Record what you know, identify significant gaps and agree who will follow up.

A useful first review might establish:

• Which systems are essential to the church’s operations.
• Who is accountable for them and who manages them day to day.
• Whether access, backups and recovery arrangements are documented.
• Which risks need attention first.
• When the council or trustees will review progress.

The aim isn’t to produce a perfect technical system overnight. It’s to ensure that responsibility is understood, important arrangements are documented, and the church isn’t dependent on one person’s memory or availability.

Further reading

National Cyber Security Centre

• NCSC Cyber Security Framework — an overall framework for organising cyber-security responsibilities.
• NCSC Minimum Cyber Security Standards — the ten standards underlying this guide, with supporting technical guidance.

Related d|c|t article

Who’s Got the Keys to the Church? — our November 2026 Touchstone column exploring why control of church digital systems is a governance responsibility.

---

This Digital Toolbox guide provides general information and discussion prompts for churches. It is not a formal cyber-security audit, certification or legal compliance assessment. Refer to the NCSC and suitably qualified advisers for guidance appropriate to your organisation’s circumstances.