Faith community preparedness ยท Security
Security Without Abandoning Hospitality
Protect people through clear roles, a trained welcome, reporting based on behavior and practiced plans.
A house of worship keeps its doors open to strangers on purpose, and it also has children, older members and an empty building to look after. This guide shows how to do both. It covers who decides, what a greeter says and notices, and how to report a concern in facts. It also walks the property in three layers and names the plans to write with your police and fire departments.
General U.S. guidance. Coordinate with local public safety and qualified security professionals. This guide contains no weapons or intervention guidance.
By Dan Whelan, founder of New World Survival
Researched from government agencies, university extension services, and other published sources. See our sources
The five-minute answer
Make the welcome do the security work.
A house of worship is open on purpose. People who have never been inside are supposed to feel they can walk in. Any security plan that makes a stranger prove they belong has damaged the thing it was meant to protect.
The federal security agency that advises houses of worship, CISA, makes the same point in its summary of the guide: tailor your security while ensuring the inherent open and welcoming values are maintained.[1]
The practical answer is a trained greeter. Someone who says hello to every person who arrives is offering hospitality and is also the first person to notice when something is wrong. Most of this guide is about giving that person a script, a way to get help, and limits.
Realistic effort: a one-hour greeter training, a walk around the property at dusk, a meeting each with your police and fire departments, and a few evenings to write it down. After that, about one hour a year for a tabletop review.
A visible welcome
Greeters people can recognize, one obvious entrance, and a place to ask for help.
Attention to behavior
What a person does and says. Never who they appear to be, what they wear or whether anyone knows them.
One way to report
Every greeter knows how to reach the safety lead in seconds, by a saved phone number or a handheld radio, and that anyone may call 911.
Actions everyone can take
Alerts that can be heard and seen, exits that open from inside, and help for people who need it.
The whole plan
Begin with roles and risks, not with equipment.
CISA's summary of its guide lists seven things for a house of worship to consider, on the right. It adds an honest caution: these options will not deter every threat.[1] No plan removes all risk.
Notice what leads the list. Roles, plans and an assessment come before cameras and locks. A small congregation can do the first four with a notebook.
Help exists. CISA's Protective Security Advisors assist with infrastructure protection and vulnerability mitigation,[3] and you can consult one for help developing an emergency action plan.[2] CISA also publishes a security self-assessment for houses of worship.[3] Your police department can walk the building with you.
The sequence, start to finish
Name who decides
A safety lead, a backup and the leader who can close an event, call the police or change who has keys.
Walk the property in three layers
The edge and parking, the grounds up to the door, and the inside. Note what is dark, hidden, unlocked or blocked.
Train the greeters
A welcome, a few questions, what to notice, and one way to reach the safety lead.
Write the emergency actions with responders
Evacuation, shelter-in-place and lockdown, written with your fire department and police, and usable by everyone present.
Practice and review
Walk through the plan with the team each year and after any change to the building, the leadership or the program.
CISA's seven recommendations
- A multi-layered security plan with clear roles and responsibilities
- Emergency action, continuity and incident response plans that are communicated and exercised with the safety team
- A vulnerability assessment, so that measures follow the actual risks
- A culture of caring, where members and visitors are supported and credible threats are reported through known channels
- Physical security for the outer, middle and inner perimeters that respects the purpose of each area
- Safety measures around childcare, daycare and schools
- Cybersecurity practices that protect important information
Summarized from CISA's summary page for the guide.[1]
Assess your own building
List what actually happens on your property: services, weekday programs, a preschool, tenants, a food pantry, evening meetings, online accounts. A plan copied from a congregation across town will miss the features that shape both your risk and your welcome.
If you rent or share the building, the owner may control the locks, alarms and lighting. Invite the owner to the walk-through and agree in writing who handles each item.
Greeters
The power of saying hello.
CISA's guide for houses of worship is built on one idea: simply saying hello can start a conversation with someone you do not know, and gives you a chance to observe and to connect. A kind greeting, a welcoming tone and eye contact can change how a person responds, even one who arrived angry or upset.[2]
Open this sectionClose this section: Greeters
It gives the approach four steps: observe, initiate a hello, navigate the risk, obtain help.[2] Nearly always the second step ends it, because the person wanted the restroom, the pantry or a seat near the back.
Approaching a stranger who seems unsettled feels awkward for most volunteers. The openers on the right are there so nobody has to improvise.
CISA is also clear about the limit. Approaching someone has risks, and in some situations it is better to report to those with the authority and training to intervene.[2] A greeter welcomes, notices and reports. A greeter does not investigate, confront, search or block anyone.
What to say
CISA's suggested openers[2]
- Hello, how are you?
- Welcome. Is this your first time here?
- How can I assist you today?
- Are you looking for someone in particular?
Then listen to the answer. CISA calls active listening the key.
What to notice
- a person who needs help finding the entrance, a seat or a toilet
- an access barrier: a blocked ramp, a dead door opener
- a bag or package left with nobody near it
- a door propped open that should be shut, or locked that should be open
- anything said that sounds like a threat
CISA asks staff to watch for unattended bags and doors in the wrong state.[2] The first two lines are ours.
Ask yourself
CISA's four questions for the "navigate" step[2]
- Is anything out of the ordinary?
- Do they seem to need assistance?
- Is there something concerning about this situation?
- Is there a potential for danger?
Behavior, not identity
Unfamiliar is not suspicious.
CISA's perimeter guide carries this caution: behavior should be reported only when there are concrete facts to support a rational conclusion that the behavior is suspicious. Do not report based solely on protected activities, race, religion, gender, sexual orientation, or a combination of such factors.[3]
Open this sectionClose this section: Behavior, not identity
We go further for a house of worship. The list on the right is ours. Every item on it describes someone your community exists to welcome.
Treat a person in visible distress as someone who may need help, and train greeters to offer it first.
Never a reason for concern
- race, ethnicity, religion or national origin
- clothing, including religious dress
- language or accent
- disability, or behavior related to one
- appearing poor or homeless
- being new, alone or unknown to anyone
- crying, praying aloud or asking for help
Report promptly
CISA lists indicators that warrant prompt reporting, including[2]
- expressed or implied threats to commit violence or destruction
- abusive language a reasonable person would find threatening
- statements about harming others, or about harming oneself
A statement about self-harm is a person in crisis. Stay with them and get help. The 988 line is in our spiritual care guide.
Report facts with five questions
When you report to the safety lead or to authorities, CISA suggests five W's: who, what, when, where and why.[2] We change the last one, and that change is ours: say why it concerns you, and leave out what you guess about motive. Say what you saw and heard. CISA also advises writing down every such encounter, because without a record it is hard to show later that anything happened.[2]
An example in that shape: “This is Sam at the north door. A man in a blue jacket has walked the office hallway three times and said he does not need help. He is by the side exit now, and it started about ten minutes ago. It concerns me because the offices are closed today.”
Three layers
Outer, middle and inner, without hidden barriers.
CISA frames a property as three perimeters and lists low-cost and no-cost measures for each.[3] The definitions matter, because most congregations think of security as starting at the front door. Two of the three layers are outside it.
Open this sectionClose this section: Three layers
Outer
The property edge and parking
CISA's definition: surface parking and the outline of the buildings at the property border.[3]
- Trim brush that hides the building from the street or hides a person from view.
- Dusk-to-dawn and motion lighting, kept working.
- Clear signs for parking and pathways.
- Identified greeters or volunteers managing traffic at busy times.
Middle
The grounds up to the door
CISA's definition: anything on the property but outside the main building.[3]
- Greeters stationed beyond the front doors, so welcome begins outside.
- Solid, thick doors with appropriate locking hardware, and careful control of keys among current and former members.
- Windows that lock and can still be opened for escape.
- A way to make an announcement that is heard across the site.
Inner
Inside the buildings
CISA's definition: the interior of the main building and any outbuildings.[3]
- Doors that work properly and lock from the inside.
- Fewer open entry points during events.
- First aid, CPR and bleeding-control training for staff and volunteers, with life-saving equipment in clearly marked locations.
- Fire alarms and smoke detectors, tested each year with local responders.
The three lists are adapted from CISA's perimeter guide.[3] Where CISA says security team, we say greeters.
The accessibility test
Every measure above can shut someone out if applied carelessly. Before you lock a door or close an entrance, check that the step-free route is still open and that a person arriving by it meets a greeter too. Also check that every door people may need in an emergency opens from the inside without a key. The U.S. Fire Administration asks for locks that everyone, including children and people with disabilities, can open from inside.[5] Our rule: never chain or block an exit.
Emergency actions
Decide who does what in the first minute.
The federal planning guide for houses of worship recommends that every plan include five annexes: evacuation, lockdown, shelter-in-place, recovery and security.[4] Three of them are things a room full of people may have to do at once.
Open this sectionClose this section: Emergency actions
Write the lockdown annex with your local law enforcement agency. This guide does not supply one, and contains no weapons or intervention guidance. The planning guide describes the aim of a lockdown as securing people quickly in rooms away from immediate danger.[4] How your building does that is a conversation for you and your police department, in your building.
CISA's advice on the relationship is practical: invite local police to tour the facility so they know the layout, and give them floor plans and access to locked areas.[2]
Answer these in advance
CISA's notification questions[2]
- What should the first greeter who becomes aware of a problem do?
- Who helps the greeter, and who warns the clergy, the leaders and the congregation?
- Who calls law enforcement?
- Who locks the doors?
- Who guides people to safety, and how?
Calling 911
In an emergency, dial 911 immediately. Be ready to give the location, your phone number and what is happening, and stay on the line until the call-taker tells you to hang up.[6]
Post the street address and the name of each entrance beside every phone and at the welcome desk. Visitors and new volunteers will not know them.
Alerts everyone receives
An alarm only the hearing can hear, or an instruction only the sighted can read, leaves people behind. The Department of Justice asks public agencies to pair audible and visual alerts.[7] Decide how your announcement will be both heard and seen, and who assists people who need help moving.
Shelter-in-place rooms
CISA suggests choosing shelter-in-place locations in advance, with solid walls and lockable doors, few interior windows and a first aid kit, and making sure people can find them through training and signs.[3] CISA's criteria are for security. For severe weather, your fire department and emergency manager choose the rooms.
Children's areas
The rooms that need the firmest rules.
CISA singles out one group in its seven recommendations: focus on the safety of children, with measures around childcare, daycare and schools.[1] It also asks that annual training include children's care staff.[3]
Open this sectionClose this section: Children's areas
This is where hospitality and control point the same way. Parents trust a nursery that checks who is collecting a child.
The practices on the right are common safeguarding measures and are ours, not CISA's. Your own safeguarding policy, your insurer and your denomination set the actual rules.
Drop-off and pickup
- a sign-in sheet with the adult's name and phone
- a matching tag or code for pickup
- a child is released only to the adult who signed in, or one they named
- one door in use, with an adult at it
In the room
- two screened adults, never one alone with a child
- a window in the door, or the door open
- a toilet procedure the parents know
- a roll that goes with the group if the building is cleared
Getting children back to their adults
After any evacuation the hardest task is reuniting children with the right adult. The federal planning guide asks that evacuation plans cover children who are not with a parent or guardian.[4] Our practice: choose a reunification point away from the building, bring the sign-in sheet, and release each child against it, one at a time, however long the line is.
The empty building
Most of the week, nobody is there.
The U.S. Fire Administration reports an average of 1,300 fires a year in places of worship from 2020 to 2022. Cooking was the leading cause at 33 percent, and intentional acts accounted for another 15 percent.[5]
Open this sectionClose this section: The empty building
Most of its advice for protecting an unoccupied building is ordinary and cheap. It notes that a simple locked door can be the deterrent that saves a congregation from arson.[5]
The Fire Administration's list
- Light the exterior and the entrances, with motion-activated lights near doors and interior lights on timers.
- Trim or remove shrubbery that blocks the view of the building from the street, and clear leaves and excess vegetation from around it.
- Install smoke alarms and a fire sprinkler system.
- Keep doors locked when the building is empty, and limit and track who holds keys and alarm codes.
- Keep windows locked.
- Clear out unneeded paper, trash, cleaning supplies and paint cans that could fuel a fire.
From the U.S. Fire Administration.[5] It also suggests asking your police department to help identify weak points, and a clean-up day to deal with what they find.
The rest of the building check is in the facility assessment guide.
Information, accounts and money
Share what people need. Guard what could be misused.
CISA's seventh recommendation is cybersecurity: protect important information and prevent a cyberattack.[1] For most congregations that means the email account, the giving platform, the member database and the social media pages.
Open this sectionClose this section: Information, accounts and money
Public
Which entrance to use, service times, accessibility details, how to report a concern and what to do in an emergency.
Restricted
Key and alarm details, camera access, children's records, private reports, security findings and passwords. Named roles only.
Accounts
Two named administrators for each account, a unique password for each, a second sign-in step turned on, and access removed the day someone leaves a role.
Funding and training
CISA points to the federal Nonprofit Security Grant Program, to its tabletop exercise package for faith-based organizations and to bleeding-control training.[3] Ask your state emergency management agency how the grant is run locally.
Do not publish detailed floor plans, camera locations or the findings of a security review to show that you are prepared. Give those to your police and fire departments directly.
Practice and stop conditions
Security fails when suspicion replaces a plan.
CISA asks that plans be exercised with the safety team and that training happen every year, including for people with access and functional needs.[1][3] For most congregations that is a one-hour tabletop: read a scenario aloud and ask each role what they would do.
The federal planning guide adds two rules for any exercise: tell people in advance to avoid confusion and concern, and include local emergency management officials and community partners.[4]
A four-part tabletop
- Arrival: a first-time visitor in a wheelchair finds the right door and a greeter.
- Report: a greeter passes an observation to the safety lead in facts.
- Action: leaders choose and announce an evacuation or shelter-in-place.
- Recovery: everyone is accounted for and children are reunited.
Next step: review the plan on paper
The review sheet covers roles, the three layers, greeters, reporting, emergency actions and recovery. Then return to the faith community preparedness guide.
Questions leaders ask
Settle these with your police and fire departments.
How do we make our house of worship safer without making it unwelcoming?
Train greeters. A person who says hello to everyone offers hospitality and is also the first to notice a problem. CISA's guidance for houses of worship is built on that idea, and asks that open and welcoming values be maintained.
What should a greeter do if something seems wrong?
Say hello and offer help first. If concern remains, tell the safety lead what was seen and heard, in facts. If the greeter feels threatened, CISA's instruction is to walk away calmly, lock the doors, note a description and call 911.
What counts as suspicious behavior?
Actions and statements, such as a threat or abusive language a reasonable person would find threatening. Never race, religion, clothing, language, disability, housing status or simply being new. CISA says not to report on protected characteristics alone.
Do we need a lockdown plan?
The federal planning guide recommends that every house of worship plan include a lockdown annex. Write it with your local law enforcement agency for your own building. This guide does not supply one.
Should we lock the doors during services?
CISA suggests considering fewer open entry points and locked doors during events. Before you do, confirm that the step-free entrance stays staffed and that every exit opens from the inside without a key.
Where can we get help with a security assessment?
Your local police department can walk the building with you. CISA's Protective Security Advisors assist with infrastructure protection and vulnerability mitigation, and you can consult one for help developing an emergency action plan. CISA also publishes a security self-assessment tool.
Is there funding for security improvements?
CISA points to the federal Nonprofit Security Grant Program. Ask your state emergency management agency how and when applications are taken.
How do we protect the building when it is empty?
The U.S. Fire Administration's list: exterior lighting, trimmed vegetation, locked doors and windows, tracked keys and alarm codes, smoke alarms and sprinklers, and no piles of paper or trash.
Primary sources
Planning references
Each source below was opened and read on October 12, 2026. For the CISA security guide, only its summary page was read, not the full guide. The CISA documents also cover attacks on houses of worship, including armed attacks. This page uses only their guidance on roles, greeting, reporting, layers and planning, and leaves protective response to you and your local law enforcement agency.
- CISA, Mitigating Attacks on Houses of Worship Security Guide, summary page. Accessed October 12, 2026.
- CISA, The Power of Hello Guide for Houses of Worship (May 2025). Accessed October 12, 2026.
- CISA, Protecting Houses of Worship: Perimeter Security Considerations. Accessed October 12, 2026.
- FEMA and federal partners, Guide for Developing High-Quality Emergency Operations Plans for Houses of Worship (June 2013). Accessed October 12, 2026.
- U.S. Fire Administration, Protecting Houses of Worship Against Arson (last reviewed May 6, 2024). Accessed October 12, 2026.
- 911.gov, Calling 911. Accessed October 12, 2026.
- U.S. Department of Justice, ADA.gov, Emergency Planning. Accessed October 12, 2026.
This guide is educational and contains no weapons or intervention guidance. Use local public-safety, safeguarding, accessibility, insurance and legal review. No security measure removes all risk.
Continue reading
What’s next
Faith community
House of Worship Emergency Plan Guide
Write an emergency operations plan for a house of worship using the six federal steps: team, hazards, goals, actions, a basic plan with annexes, and practice.
Faith community
Church Tabletop Exercises and Drills
How a house of worship can test its emergency plan: tabletop exercises, short drills, safe practice rules, a ten-minute debrief and a yearly readiness audit.
Faith community
Should a Church Be a Disaster Shelter?
A decision guide for houses of worship asked to shelter people overnight: the four honest roles, FEMA's space figures, the gates to pass and when to say no.