Recommended Free Tools
If your church or nonprofit may have exposed personal information, first contain the incident without destroying evidence. Then bring in qualified technical and legal help, establish what information and people may be affected, and assess notification duties before communicating specifics. The steps below are U.S.-focused; the right response depends on the incident, the data, and the jurisdictions involved.
What should you do first?
Put people in charge and limit further access
Activate an incident-response team promptly. Even a small organization should assign clear responsibility for technology, operations, legal decisions, communications, and leadership. The Federal Trade Commission (FTC) says the right mix of experts depends on the breach and the organization. CISA recommends maintaining and exercising incident-response and communications plans.
As an Amazon Associate I earn from qualifying purchases.
If the intrusion may still be active, work with qualified technical responders to contain it. Avoid making changes that could erase evidence or complicate the investigation; the safest action depends on what systems are affected and how the incident is unfolding.
Free tools Windows power users keep installed
One-click scans. No signup required.
Preserve evidence while containing the incident
The FTC advises taking affected equipment offline, but not turning machines off until forensic experts arrive. It emphasizes: “Do not destroy evidence.” In a ransomware incident, CISA guidance calls attention to highly volatile evidence, such as system memory and short-retention logs, where relevant. Follow incident-specific expert advice so containment does not erase information needed to determine the cause or scope.
#1 Best Overall
- Hardware encrypted drive
- Simple to use pin access. RPM-5400
- Administrator password feature
- Bus powered
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
Who should you bring in?
Digital-forensics or incident-response specialists
If your organization lacks in-house incident-response expertise, consider qualified outside help. Forensic and response specialists can investigate how access occurred, identify affected systems and information, preserve and analyze evidence, and recommend remediation. A provider’s assurance that a problem is fixed should be verified rather than accepted without checking.
Legal counsel
Consult legal counsel, potentially someone with privacy and data-security experience, to assess federal and state obligations. Notification decisions can depend on the organization’s activities, the information involved, and where affected people live; this article cannot determine whether a particular church or nonprofit is covered by a particular law.
How do you find out what happened?
Work with investigators to build a fact-based picture before deciding whom to notify or what to say. Establish, as far as the evidence allows:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Which devices, systems, accounts, and services were affected, and whether unauthorized access may still be occurring.
- What kinds of information may have been accessed or exposed, how many people may be affected, and whether the data was encrypted or otherwise secured.
- What relevant logs and other evidence remain available, and whether a service provider or its accounts had access to affected systems or data.
- How the intrusion occurred and whether the proposed fix addresses the actual access route.
Keep a record of what is known, what remains uncertain, and how investigators reached their conclusions. That helps leadership make decisions without presenting assumptions as established facts.
Rank #2
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
How should you close the access route?
Base remediation on the investigation and expert recommendations. Depending on what happened, that may include changing compromised credentials, reviewing service-provider permissions, correcting the weakness that enabled access, and reviewing network segmentation and account access. Ask providers to explain what they changed and verify that the remediation worked.
If personal information was exposed on a website, remove it and check whether copies remain elsewhere. Removing a page from your own site does not by itself establish that other copies are gone.
Who must be notified, and when?
Map potential duties with counsel before settling on notice details. The FTC says every U.S. state, the District of Columbia, Puerto Rico, and the Virgin Islands has breach-notification legislation involving personal information. State requirements differ, and other rules may apply depending on the information involved. The affected people’s locations matter, so identify where they reside as well as what data was involved.
There is no single notice deadline in this guidance that applies to every church or nonprofit breach. Exact state-law deadlines and notice contents depend on the organization, affected residents, data categories, and incident facts. The FTC’s Data Breach Response: A Guide for Business summarizes the response process and state-law landscape; use counsel for a fact-specific decision.
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Check whether a health-data rule applies
Do not assume that a church is a HIPAA-covered entity or that pastoral counseling records are protected health information under HIPAA. Confirm the organization’s status, the role it played, and the nature of the records. HIPAA breach notification applies to covered entities and business associates after breaches of unsecured protected health information. The FTC Health Breach Notification Rule may also be relevant in some circumstances; counsel should assess whether it applies.
HHS’s Breach Notification Rule summary, last reviewed July 26, 2013, describes these thresholds for covered entities:
| HIPAA notice | HHS summary |
|---|---|
| Notice to affected individuals | Without unreasonable delay and no later than 60 days after discovery of the breach. |
| Notice to the Secretary of HHS | For breaches affecting 500 or more individuals, within 60 days. For breaches affecting fewer than 500 individuals, annual reporting is permitted, no later than 60 days after the calendar year in which the breach was discovered. |
| Notice to the media | Required when a breach affects more than 500 residents of a state or jurisdiction. |
These are HIPAA rule thresholds, not universal deadlines for every nonprofit incident. Because the HHS summary is dated, verify the current rule and applicable requirements with counsel before relying on it during a live incident.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteShould you report the incident to law enforcement?
Consider contacting local law enforcement and the FBI’s Internet Crime Complaint Center (IC3), the FBI-run central hub for reporting cyber-enabled crime. Contact affected businesses or service providers when their accounts or entrusted data are implicated. For ransomware, CISA’s #StopRansomware Guide directs organizations to consider applicable state notification laws and relevant health rules.
Rank #4
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
What should you tell affected people?
Use one designated spokesperson or contact and a reliable channel for questions and updates. Explain what is known and unknown without speculating. When notice is appropriate, tailor it to the information involved and tell people what practical steps they can take.
- If Social Security numbers were exposed, the FTC identifies credit freezes and fraud alerts as possible protective steps.
- People who suspect identity theft can use IdentityTheft.gov for recovery guidance.
- If financial information or Social Security numbers were involved, consider whether credit monitoring or identity-restoration support would help affected people.
Do not announce a cause, scope, or resolution as certain until the evidence supports it. If facts change, use the same contact channel to provide accurate updates.
What should the organization do after the immediate response?
Use the incident to improve the response plan: record what decisions were made, what evidence and expertise were needed, and where communication or access controls should change. CISA recommends maintaining and exercising incident-response and communications plans so that responsibilities and channels are clear before another incident occurs.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
