Beyond Simply Compliant

Where the session starts.

Adam spent more than fifteen years at the Department of Defense, taking the same mandatory course every year. It barely changed from the first time he took it in 2004. On the Air Force network the animation took forever to load, so he turned it off, muted the sound, switched to the transcript and searched his way to the answers. The only thing he learned was how to finish it faster. Higher education had a nicer version, with a dashboard, seasons, episodes with a plot and actors who aren't terrible. He pressed play, muted it, and let it run on his second monitor while he kept working.

The cybersecurity guy muted the cybersecurity training. His record still said compliant.

The argument, in two lines.

In the session we put two emails from the same vendor on screen and asked which one was fake. Most rooms pick B. It could be neither, and it could be both. Finding the fake was never the goal, so we asked a different question. Not whether it's fake. Who are you going to call?

1. Vendor email

   "We've changed banks. Use the new payment details on this invoice." Call the vendor at the number already on file. The bank change and the payment both wait.

2. Payroll change

   "Can you update my direct deposit before Friday's payroll? New account attached." Check with the employee in person or on a known number. The account change waits until it's confirmed and approved.

3. Unexpected sign-in

   You aren't signing in. Your phone asks you to approve a sign-in. Don't approve it. Call IT the usual way.

4. New volunteer

   "I start with the youth team Sunday. Pastor asked me to email you so you can add me to the leaders group." Call the youth leader at a number you already trust. Adding them waits until they're confirmed and approved. This one isn't about money. A leaders' group means the youth, their parents and how to reach them.

Different requests, different contacts, the same three steps. Agree which requests trigger the plan, who gets called for each, and what waits. Write it on a card, one card for each kind of request, and practice it with your people.

The fuller list we work from →

Every room has somebody who thinks this isn't about them.

We are too small. Nobody would bother with us. That happens to hospitals and banks. That's a fair read, because the losses that make the news are the big ones.

Nothing in the attack is looking at your size. It's looking for money it can move, access it can be given, a name worth borrowing, and somebody who can say yes to one of those. A ninety-member congregation has all four. So does a village office with two staff. Redirecting a payment is the same work either way, and the person being asked is the same person.

Most of it never becomes a story, with no breach notice, no filing and no reporter, so "nothing like that has happened around here" is what you'd expect to hear either way.

And it doesn't always land on the institution.

At First Presbyterian Church of Royal Oak, in Michigan, members received requests for gift cards from other members' real email accounts, according to the pastor. At least four bought the cards and sent them to the attacker. The church's own accounts were never touched. The people lost their own money, and there was nothing in those messages for them to catch, because the addresses were genuine. Reported by FOX 2 Detroit.

Nobody in that story missed a clue. There wasn't one. The addresses were real. With a card, the gift-card request is the stop. Call the member on the number on the card, and if they don't answer, the church office. Then wait. You don't have to prove the email is fake. You don't even have to suspect it. You don't get a say in whether somebody tries. You do get a say in which requests nobody handles alone, and you get it before anything arrives.

The compliance half of the title.

The standards check three things: that training covered social engineering, who got it, and when. Social engineering means tricking a person rather than a computer. One of them goes further and names behaviors. CJIS, the FBI's security policy for anyone who touches criminal justice information, asks for training on recognizing social engineering and on reporting it. But not one of them requires that your staff become accurate at telling real from fake, and not one measures them on it. So they leave you room on the goal, and a program built on stopping, calling and waiting sits inside it rather than against it.

Meet the requirements that apply. But don't stop at a record that says "trained." Make sure the training you already provide leaves people with a plan they can follow. That's what Beyond Simply Compliant means.

The standards, with who they reach and when they applied →

What you can take with you.

Both are yours to use, with no form and no email address to leave. Use them in your own church or the churches you support, and change them to fit how they work. And if your people have heard it from you for years, bring us in to say it in person.

• The slides The session as delivered, including the response card and three worked examples.
• The response card The card from the session. In Stop, write one kind of request that triggers the plan. In Call, the names and trusted numbers of your primary contact and a backup. Wait has nothing to fill in: the request waits until the person you called says go.