1 of 3

Not long ago, a locked file cabinet was all the data security a church needed. Now, it's a different world. While the use of computers and church management software (CMS) programs greatly eases administrative burdens, it also presents new risks. Software modules and files contain sensitive data, such as information about congregation members, church financial transactions, credit card and bank information, and facility access and use. Church leaders must insure that the "electronic file cabinet" is kept safe.

"As we talked with end users or prospective customers for our church management software, security, risk management, and methods to track transaction processing haven't been high priorities," says Bill Terrill, chief technical officer of Parsons Church Group. "But now security and data integrity have a higher profile." One reason is that there are multiple users handling data, even in small churches.

Church leaders must decide who will be allowed to enter new information, who can change existing information, and who will have read-only access. Nearly all CMS programs are password-protected and require a user ID. The system administrator controls access, so someone has to be designated and trained for that role. "The system administrator can define an area of a program to which a user is given access," says Wes Haystead, president of Logos LBE. "So if a volunteer comes in to do a particular job, all they'll see is what they have [been given] access to."

All CMS products enable restrictions on specific functions with passwords and user names. "Each user in our system is assigned privileges in each module," notes Carla Bracalente, operations manager at Power Church Software. "Someone can enter in donations, but not see financial records in accounting. Or they can view member information, but not change it." Similar protection is offered in Computer Helper's Church Windows. Some products, such as Church Office, from Parish Data Systems, have a confidentiality feature in membership records. Certain information or comments can be marked as general and others as confidential, and only those with specific authorization can view the confidential information.

A related issue is data integrity when different people work within the same fields doing data entry for contributions, Sunday attendance, and small group participation. One may enter a contributor's name as "Bob Smith," while another enters "Robert Smith" for the same person. Avoiding these errors involves something called "update rights." Ed Newman, president of ServantPC Resources, says that update rights ensure data integrity in basic matters, such as spelling of names, but also names of categories, like small group names (is it "Bob's Small Group" or "Small Group #1?") or Sunday school class names ("Defenders," or "Debaters?"). "Governing who can add or make changes can help to keep data more accurate," he says.

Chris Imrie, vice president for software development at EventPro, notes that conflicts over facility use can be avoided through data access restrictions. For example, one person can see whether a room is booked, while another can actually book the room, change a price, or purge and retrieve data. "It's also important to decide how to show a status level for a room booking—who can make a preliminary reservation and who can place a hold on the room."

next page... |  1 of 3

share this page