1. Domain and Platform Administration
The Conference owns and administers the domain name(s) registered for the Church. This structure ensures continuity and reliability: the Church always has a dependable path to regain access to its domain, even if a point of contact becomes unavailable or a staffing change occurs. The Conference is also responsible for monitoring domain renewals and routine maintenance, protecting the Church against service lapses.
The same principle applies to email platform administration: when at least two authorized individuals hold administrative access, the Church is protected against a single point of failure. The Church should ensure that no single person has exclusive administrative control over any email service used with the Church domain.
Because administrative credentials grant the ability to reset or change any account, they should be treated as the most sensitive credentials in the Church's digital environment. Every individual with administrative access should have MFA or a passkey enforced (per Section 2), use a unique and strong password, and should not share credentials.
2. Authentication, Training, and Enforcement
Multi-factor authentication or a passkey is mandatory for every email account created under the Church domain, whether hosted by the Conference or by a third-party provider. A password alone is not sufficient for any account. The Church should ensure that each user has either:
- MFA (e.g., authenticator app, SMS-based verification, hardware security key), or
- A passkey (e.g., platform-native passkey such as Windows Hello, Touch ID, a FIDO2-compatible security key, or a password manager with passkey support)
enabled and active before the account is considered compliant. The Church should configure and enforce this at the platform level where possible (e.g., requiring MFA or passkey at the organizational/admin policy level rather than relying on individual user opt-in).
The Church agrees to maintain MFA or passkey enforcement across all accounts. If this term is breached, the Conference may remove the MX record pointing for the Church domain.
Every individual who uses an email account under the Church domain should complete cybersecurity training provided by the Conference. Training will be ongoing, not one-time. The Church should ensure all users complete the training.
We trust the Church to be a faithful and responsible steward of the digital resources entrusted to it, guarding the data and communications of God's people with the same care and diligence that Scripture calls us to in all things.
3. Account Creation Standards
Email accounts created under the Church domain should meet the following criteria:
- Necessity: Only accounts that are genuinely required for Church operations should be created.
- Generic Naming: Accounts should use a role or department name (e.g., clerk@, elder@, info@). Accounts named after individuals (e.g., jane.smith@) are strongly discouraged, as they create a larger target for phishing and make it harder to maintain continuity when personnel change.
- Member-Wide Accounts: The Church is strongly discouraged in creating personal email accounts for every congregation member. This practice is a significant security liability and a foreseeable breach vector.
4. Third-Party Email Platforms
Some email providers, such as Google Workspace for Nonprofit (opens in a new tab), have anti-discrimination policies that may conflict with the Church's doctrinal positions on certain matters. It is up to the Church to ensure that it abides by the third-party email provider's policies.
The Church acknowledges the following risks:
- The provider may suspend or terminate the account if it determines a terms-of-service violation.
- Suspension may be immediate, with limited or no recourse.
- Loss of email access would disrupt Church operations.
The Church is encouraged to either (a) use a paid tier of the email platform that does not carry the nonprofit non-discrimination restrictions, or (b) select an alternative platform whose terms are compatible with the Church's beliefs. The Church's decision to proceed with a nonprofit-tier service is made with full awareness of the above risks.
5. Default Account Requirements
If the Church chooses to point the MX record of its Conference-owned domain to a third-party email platform (e.g., Google Workspace, Microsoft 365, or another provider), the following conditions apply:
Default Accounts: The Conference requests that the Church create and maintain the following three accounts on the third-party platform immediately after the MX record is pointed:
- info@[Church Domain]
- clerk@[Church Domain]
- elder@[Church Domain]
These accounts serve as the Church's primary points of contact and ensure continuity of communication regardless of staffing changes. By maintaining these three accounts, the Church upholds a consistent, conference-wide standard. Communication should be actively managed on all three accounts to ensure no messages go unanswered.
6. Compliance and Enforcement
The Conference strongly encourages the Church to maintain full compliance with the terms outlined in this agreement. If any of these terms are not met, the Conference may need to temporarily discontinue the MX record pointing to the third-party email provider.
We trust the Church to guard these resources and the communications of God's people with the care they deserve.
7. Acknowledgment
By signing below, the Church's authorized signatory acknowledges that they have read, understood, and agree to be bound by all terms above.
