Layer8 practical guide
Church and nonprofit audit preparation
Prepare a repeatable review of access, sensitive records, children's programs, continuity and accountable evidence.
Make the first discussion useful.
Turn a broad concern about security into a focused first review. Agree which systems, locations and activities to include, and discuss the U.S. and California requirements that may apply to your organization.
Prepare before the discussion
- A list of systems, locations, providers and program owners, without customer or participant records.
- An outline of record categories, important workflows and current policies.
- The decision leadership needs, available participants and a safe review window.
Work through the prompts.
Agree the boundary
Identify locations, tenants, networks, payment channels and programs in scope. Record what is outside the review and who can authorize changes.
Map the sensitive records
List donor, member, child, guardian, support-service and workforce record categories. Identify purpose, storage, exports, access and retention. Use redacted or synthetic examples.
Review identity and volunteer access
Identify administrative roles, MFA and approved recovery routes. Trace one synthetic join, role change and departure through all important systems.
Walk through children's handoffs
Document check-in, pickup authorization and exception ownership. Rehearse an authorized pickup, a disputed pickup and an outage using synthetic records away from a live program.
Check the working environment
Account for office devices, kiosks, donated equipment, personal devices, guest Wi-Fi and AV systems. Compare intended boundaries with an agreed verification plan.
Clarify payment responsibility
Identify payment providers and merchant responsibilities with the processor or acquiring bank. Record permitted handling and access; keep card numbers and security codes out of the assessment packet.
Review continuity and response
Identify essential services, secure ways to contact your team, recovery priorities and the people who can make decisions. Plan a safe recovery test and a short discussion of how you would handle an incident.
Resolve supplier ownership
Identify who owns each subscription, support relationship and administrative account. Clarify data exports, backups, incident notices and the exit process.
Confirm U.S. and California applicability
Ask qualified counsel which privacy, breach-notification, sector, grant and contract obligations apply. The California Attorney General states that CCPA generally does not apply to nonprofits; other duties need separate review. Record the applicability decision and its owner.
Agree evidence and the next decision
Separate observed controls, unknowns and gaps. Choose a small set of actions with an owner, a due date and a representative completion check. Review the result with leadership.
Agree the result and the next action.
Use these outputs to judge whether the preparation is useful:
- An agreed review plan, a list of systems and record types, and a named person to gather each item.
- A prioritized gap register with observation, impact, owner and next verification step.
- A leadership decision on remediation, responsibilities and the next review date.
Review prompt: Refresh before an assessment and after new programs, systems, locations or significant provider changes.
Record the next decision
Use your secure workspace to record the issue, what you know, who is responsible and what happens next. Add a due date and a way to check completion. The PDF includes a printable worksheet.
Use the guide within an agreed scope.
Edition 1.0 · Updated October 4, 2026
This preparation guide does not certify compliance or replace legal advice. Technical review of check-in systems complements the organization's safeguarding policy and trained staff.
Primary references for further reading
- NIST: small-business CSF quick-start guide
- California Attorney General: CCPA applicability FAQs
- California Attorney General: breach reporting
These are original Layer8 preparation prompts. The linked organizations do not endorse this guide.
Bring the question. Agree the work.
Cybersecurity can help scope this work. Assess the authorized scope, prioritize improvements and verify agreed safeguards.