Quarterly Faith Community Hardening

Every 90 days, with a trend line on every check.

What it is

Runs eighteen checks on this computer, the network it is on, the smart devices on it and the domains you declare, asks your congregation's questions once, and maps everything to NIST CSF 2.0 in one report. Nothing is changed.

The scams aimed at a congregation wear the clergy's name: a gift-card request to a volunteer, a changed account for a contractor, a hijacked livestream. This bundle gathers what one office can show: its computers and Wi-Fi, the smart devices on the network, your giving page, website and domain, the clergy's public footprint, the doors donor records could leave through, and your own answers.

This is the quarterly form of the Faith Community Hardening Bundle (IND-FAITH-89): the same 18 checks, run four times a year, each report showing what changed since the last.

The framework

Mapped to NIST CSF 2.0 — with CISA's Performance Goals and PCI DSS by reference. The report maps what the scan observed on this computer, this network and the domains you declare to that framework's expectations and shows where each finding sits. It is a map of findings to the framework, not a ruling on whether you meet it, and it is not a risk analysis; your industry's expectations stand beside the findings, never in place of them.

Who it is for

A church, synagogue, mosque, temple, parish or the small office of a diocese or regional body, with its own computers and domain. A denomination's headquarters or a diocese with many parishes is measured across every office and is the human-delivered engagement's customer; this bundle is one congregation's first look.

A denomination's headquarters or a diocese is measured across every parish office, every shared system and every giving platform it runs for its congregations. That is the work of the human-delivered ThreatVector engagement. This report is still correct about the office computer it ran on and is a useful first look for the administrator who ran it.

What runs (18 checks)

• Windows Security Health Check (ENDPOINT-01)
• Ransomware Readiness Check (RANSOM-READY-03)
• Credential Hygiene Check (PW-HYGIENE-11)
• Out-of-Date Software Scan (EOL-16)
• Startup & Persistence Check (PERSIST-24)
• Wi-Fi & Home Network Check (WIFI-LAN-02)
• Router & Wi-Fi Settings Checklist (ROUTER-22)
• Email Spoofing & BEC Check (BEC-08)
• Breach & Identity Exposure Check (BREACH-10)
• Industry Readiness Questionnaire (READINESS-91)
• Business Impersonation & Typosquat Sweep (IMPERSON-19)
• Digital Footprint Report (FOOTPRINT-12)
• Website & Storefront Checkup (STOREFRONT-07)
• Certificate & Encryption Check (TLS-09)
• Domain & DNS Security Check (DNS-63)
• Smart Device Exposure Scan (IOT-04)
• Cloud Storage Exposure Check (BUCKET-28)
• Removable Media & Cloud Sync Check (DATAEXIT-76)

Before it runs: one question you can say no to

• May the Removable Media & Cloud Sync Check also read which cloud-sync clients are installed on this computer and which of your folders they hold? It never signs in to any account and never reads a file. Optional. Say no and the report records that this check was skipped at your request.

Price

$399 a year, four runs, one every 90 days, with a trend line on every check from the second run. One run on its own is $299: the Faith Community Hardening Bundle (IND-FAITH-89).

What it never does

It never changes a setting, installs anything, tries a password or signs in to an account. Where a check reads inside files it reports counts only — never a value, a file name or a path. Nothing is exploited and no credential is guessed. Your own answers are recorded as yours and never upgraded into something the scan observed.