Church security: a welcoming building that is not a defenseless one

01

What church security means, and what the rules actually require

Church security covers everything a congregation does to protect its people, property and activities: the parking lot, the front doors, the sanctuary, the children's ministry wing, the office where the offering is counted, and the fellowship hall rented out on a Saturday. It covers medical emergencies and fire as well as violence, which is why many congregations speak of church safety and security, and call their team a safety team. The same principles apply to a synagogue, mosque, temple or any other house of worship.

The federal starting point is the Cybersecurity and Infrastructure Security Agency (CISA). Its Mitigating Attacks on Houses of Worship Security Guide (December 2020) compiled 37 incidents of targeted violence at US houses of worship from 2009 to 2019, in which 64 people died and 59 were injured, and it is careful about balance: "a welcoming environment, however, does not mean a defenseless one." It recommends a layered strategy: clear roles, a vulnerability assessment, community readiness, physical security, safety for children, and cybersecurity.

No federal law requires a church to have a security program or a security team, and CISA's Physical Security Performance Goals for Faith-Based Communities (December 2023) describe themselves as voluntary: they "do not place any obligation on a house of worship." But several rules still reach a church building:

• Workplace safety. A church with employees is an employer. OSHA's exit route standard, 29 CFR 1910.36, says "employees must be able to open an exit route door from the inside at all times without keys, tools, or special knowledge." Where an OSHA standard requires an emergency action plan, 29 CFR 1910.38 sets its minimum contents. In the 21 states (plus Puerto Rico) that run OSHA-approved State Plans covering private employers, the State Plan's own rule applies instead.
• Fire and building codes. A sanctuary is an assembly occupancy under whichever fire and building codes the city or county has adopted, with local amendments. The authority having jurisdiction, usually the fire marshal, decides occupant loads, exit locking and what the fire alarm and sprinklers need. No security measure may override them.
• Security licensing. In most states, a paid guard or a contract security company is licensed by the state. Volunteers are treated differently from state to state. In Texas, for example, Occupations Code section 1702.333 says the private security chapter does not apply to a person providing volunteer security services, without compensation, on "the premises of a church, synagogue, or other established place of religious worship," but such a volunteer may not wear a uniform or badge that contains the word "security" or gives the appearance of a peace officer or security officer. Check your own state's licensing board before paying anyone, even a stipend, and before choosing what the team wears.

Weapons law, use of force and liability insurance vary widely by state and are outside this guide. Take them to your attorney, your insurer and your local police before the team is formed.

02

What church security covers in practice

CISA's guide divides a property into three zones and suggests planning from the outside in. The zones make a useful map for any church, whatever its size:

• The outer perimeter: the parking lot and its lighting, the drop-off lane, grounds, walkways and the building's outside face.
• The middle perimeter: anything on campus outside the main building, and that building's walls, doors and windows, along with a school, rectory, playground or picnic area.
• The inner perimeter: the lobby, sanctuary, offices, classrooms, fellowship hall and nursery. CISA found that 43 percent (16 of the 37 incidents) took place in this zone, where people gather in the greatest numbers.

Within those zones, a church security program usually has to deal with:

• Services and events: weekend services, weddings, funerals, and holiday services with crowds far larger than usual.
• Children and youth: check-in and pickup, who may collect a child, classroom doors and playgrounds. CISA suggests written policies for drop-off and pickup, for guardians other than a parent, and for domestic disputes.
• Access and money: which doors are open when, who holds keys and access cards, locked offices, IT closets and electrical rooms, and how the offering is counted and leaves the building.
• Medical emergencies, fire and weather: first aid kits, AEDs, trained people, evacuation routes and shelter locations.
• The weekday building: staff working alone, contractors, deliveries, rentals to outside groups, and the building empty at night.

A small church may cover all of this with a handful of volunteers and a checklist; a large campus may add paid officers or an off-duty police detail. Either way, CISA calls a vulnerability assessment "the first step in the planning process": build the program from the church's own risks, not a neighboring church's program, and have church leadership agree to it.

03

Who does what: the coordinator, the planning team and the safety team

CISA recommends three layers of people. A security coordinator is "responsible for implementing the security strategy." A security planning team supports the coordinator with planning and carrying it out; security experience is preferred but not required. A wider safety team "includes greeters and volunteers as the first line of defense in identifying and reporting suspicious activity," and brings in ushers and maintenance staff too, down to "identifying who is responsible for locking doors when there are no activities occurring."

The Performance Goals add advice on forming the team: pick one lead for security decisions, ideally a staff member or engaged volunteer with relevant experience, and "screen prospective team members with basic background checks and a brief interview," with a standard waiting period before a new volunteer serves in a key role. They also recommend building "a strong relationship with law enforcement" and sharing facility floor plans with local police, so officers answering a call know the building.

Greeters and ushers matter more than any camera. The Performance Goals recommend "greeters at every entry point and parking lot to identify early warning signs of potential violence." CISA's Power of Hello program trains this in four steps: Observe, Initiate a Hello, Navigate the Risk, and Obtain Help.

A workable division of duties for a typical Sunday looks like this:

• Team lead on duty: runs the pre-service walk, assigns posts, makes the call on anything unusual, and closes the day's record.
• Parking lot team: traffic, lighting, vehicles and people that do not belong, and help for members who need it.
• Greeters and ushers: welcome and notice at each open door, seat people, and evacuate their section.
• Children's ministry: check-in, pickup, classroom doors and head counts.
• Medical team: first aid kit, AED, and who calls 911.
• The custodian or facilities volunteer: doors, lights, alarms and the building after everyone has gone.

Write each post down: what the person does, where they stand, who they report to and what to do in an emergency, as a security company writes post orders. Volunteers change; a written post survives the change.

04

The routine checks: before, during and after services

Most of what keeps a church safe is dull and repeated. The Performance Goals list physical measures that translate directly into checks a team can walk every week:

• "Place photocell (for dusk to dawn) and motion-activated LED lighting throughout the exterior perimeter."
• "Lock and install alarms on windows and doors, ensuring they can be unlocked for emergency escape."
• "Ensure doors work properly and lock from the inside. Do not prop doors open."
• "Keep landscaping trimmed. Avoid tree branches below six feet and prevent bushes from growing above two feet to prevent hiding places."
• "Ensure fences and gates are maintained and in working order."
• "Incorporate access control for critical areas such as IT/electrical rooms, finance offices, and children's ministries."

CISA's guide adds that first aid kits and AEDs should be "regularly checked to ensure supplies are fully stocked and unexpired," and that fire and smoke alarms "should be inspected annually." That inspection is a qualified contractor's job under the local fire code; the team's weekly job is to notice a trouble light, a blocked extinguisher or a missing AED.

A sensible pre-service walk, done by a named person 30 to 60 minutes before doors open:

1. Parking lot and walkways: lights working, nothing left that should not be there, drop-off lane clear.
2. Exterior doors: each one that should be locked is locked; each exit opens from the inside and is not chained or blocked.
3. Exit signs lit and exit routes clear, including the corridors behind the sanctuary and the stairs from the balcony.
4. Restrooms, closets and unused rooms looked into.
5. Children's wing: classroom doors working, check-in station ready, windows secured.
6. First aid kit stocked, AED present and showing ready, radios charged.
7. Fire alarm panel showing normal, with any trouble reported.
8. Anything wrong reported to the team lead before doors open, not after.

The weekday building needs its own routine: who opens and locks up for a midweek Bible study, a rental group or a funeral, and who checks the doors afterward. CISA notes that most of the arson cases it studied happened after business hours, which is when exterior lighting and locked doors do their work.

05

Plans, drills and reviewing what happened

Checks keep the building ready; a plan tells people what to do when something happens. CISA's Performance Goals ask for documented procedures: a security plan "outlining key steps staff and volunteers should take to improve security" and "threat-specific emergency operations plans" covering response and recovery. FEMA's Guide for Developing High-Quality Emergency Operations Plans for Houses of Worship (June 2013) sets out six steps: form a collaborative planning team, understand the situation, determine goals and objectives, develop the plan, prepare, review and approve it, then implement and maintain it.

Its advice on keeping the plan alive is specific: "at least once a year, hold a meeting to educate all parties on the plan"; post evacuation routes and shelter-in-place locations where congregants, including those with disabilities, can find them; and exercise the plan, from a tabletop discussion to a drill on the actual grounds, then functional exercises with partners. How often is up to the planning team, and quality matters more than frequency. After every exercise, "develop an after-action report that evaluates results; identifies gaps or shortfalls; and documents lessons learned."

On review, the guide says: "Many organizations review their plans on an annual basis. In no case should any part of the plan go for more than two years without being reviewed and revised." Review it also after a real emergency, a change in staff or facilities, or a new threat.

Where the church employs staff and an OSHA standard requires an emergency action plan, 29 CFR 1910.38 requires at least procedures for reporting a fire or other emergency, evacuation and exit route assignments, accounting for all employees after evacuation, and contacts for questions. The plan must be in writing, kept in the workplace and available to employees, although an employer with 10 or fewer employees may communicate it orally. A church's emergency operations plan can cover this, as long as the staff part is explicit.

Record incidents while they are fresh: what happened, where, when, who was involved, who was called and what was done. Near misses count too, such as an exit found chained. The Performance Goals ask churches to "conduct after-action reviews to identify any lessons learned and areas for improvement; document findings in an improvement plan."

Funding exists for some of the physical work. FEMA's Nonprofit Security Grant Program "provides funding support for target hardening and other physical security enhancements and activities to nonprofit organizations that are at high risk of terrorist attack," and houses of worship can apply; FEMA lists $300 million for fiscal year 2026. FEMA's program page sets out how to apply. CISA's Protective Security Advisors also offer vulnerability assessments and training at no cost.

06

Where church security fails in practice, and where SiteClara fits

The plan is in a binder in the church office. The pre-service checklist hangs on a clipboard by the side door, every box for the month ticked in the same pen. Nobody can say who walked the parking lot last Sunday, and the exit found chained three weeks ago was mentioned to whoever was passing and never written down. When the coordinator changes, or an insurer asks what the team does, there is nothing to show.

SiteClara turns the checks a church already writes down into a record made at the place they are done. A printed QR poster, with an optional NFC tag behind it, goes at each checkpoint: the side exit, the children's wing door, the AED cabinet, the parking lot light pole, the alarm panel. The team member scans the code or taps the tag on their own phone, with no app to install, sees the checks due at that point and marks each one done, or says what stopped them, such as a door that would not latch. The time and the named person are recorded as it happens, with a photo when one is asked for. A problem found on the walk is reported there and stays on the team's list of jobs until someone closes it, and one that needs the building's owner or manager can be escalated to them.

The coordinator sees what was due, done and missed, with the reason given, and each day can review the totals and photos, add a note and approve a report that goes to nominated contacts, such as the pastor or the facilities committee, at 8 a.m. the next morning, showing, for example, that 12 of 12 pre-service checks were done and what is still open.

07

Questions people ask

What does church security do?

It spots and reports trouble early, keeps doors, exits and the building in order, and knows what to do in an emergency. CISA's Mitigating Attacks on Houses of Worship Security Guide puts a security coordinator in charge of "implementing the security strategy," a planning team behind them, and a wider safety team that "includes greeters and volunteers as the first line of defense in identifying and reporting suspicious activity," down to who locks the doors when nothing is going on.

What is required to have a church security team?

No federal law requires one or sets its membership. CISA's Physical Security Performance Goals for Faith-Based Communities are voluntary and "do not place any obligation on a house of worship," but recommend a single lead for security decisions, a team of staff and volunteers, and screening "prospective team members with basic background checks and a brief interview," with a standard waiting period before a volunteer serves in a key role. Paid guards need a license in most states, and weapons, uniforms and insurance depend on your state and your insurer.

Do churches hire security guards?

Some do, and many rely on volunteers instead. CISA's Mitigating Attacks on Houses of Worship Security Guide asks whether a house of worship uses "contract security personnel, either armed or unarmed," whether their presence fits current security concerns, and whether they "meet all state and local licensing, training, and insurance requirements." Among its case studies, an off-duty police officer working security at a Jewish community center in 2014 confronted an attacker in the parking lot.

08

Further reading, and a list to take away

CISA's Protecting Houses of Worship page collects its security guide, the Performance Goals, a free Houses of Worship Security Self-Assessment and a fact sheet on six steps against targeted violence. FEMA's houses of worship planning guide remains the clearest walk-through of writing an emergency operations plan. OSHA publishes the exit route and emergency action plan standards, and your state licensing board, fire marshal, insurer and local police department fill in the rest.

Before next Sunday, check that your church:

• has a named security coordinator and a screened team with written roles;
• has a documented vulnerability assessment of its outer, middle and inner perimeters;
• has greeters at each open entrance and in the parking lot who know how to raise the alarm;
• walks the building before every service and locks it up after, with a named person each time;
• keeps every exit able to open from the inside, never chained or blocked;
• checks first aid kits, the AED, exit signs, exterior lighting and the fire alarm panel on a schedule;
• has an emergency operations plan, briefed yearly, exercised, and reviewed at least every two years;
• records incidents and near misses, and knows what its state and insurer expect of its security team.