Church Security Planning in Arizona: A Welcoming, Layered Approach

1. Establish leadership and decision ownership

Begin with a small safety and security planning group authorized by the organization’s governing body. Representation may include executive or clergy leadership, administration, facilities, children’s ministry, ushers/greeters, medical or accessibility expertise, communications, legal/insurance contacts, and professional security.

The group should answer:

• Who approves security policies and spending?
• Who maintains the risk assessment and emergency plan?
• Who selects, screens, trains, and supervises volunteers?
• Who directs professional security and approves post orders?
• Who contacts police, fire, EMS, the insurer, counsel, and families?
• Who can suspend an activity, close an entrance, evacuate, shelter, or cancel?
• Who stores sensitive maps, contact lists, keys, codes, reports, and footage?
• Who communicates with congregants, media, and the broader community after an incident?

Avoid making the program dependent on one enthusiastic volunteer or one officer. Assign backups and preserve institutional knowledge when leaders change.

2. Understand the risks without planning from fear

A useful assessment considers hazards, threats, vulnerabilities, existing safeguards, and consequences. It should include common safety and operational problems—not only extreme violence.

Review:

• fire, medical emergencies, severe weather, heat, and utility loss;
• slips, falls, blocked exits, lighting failures, and facility hazards;
• theft, vandalism, arson, burglary, and vehicle incidents;
• domestic or interpersonal disputes that may carry into the facility;
• disruptive, threatening, or targeted behavior;
• hate incidents, threats, or suspicious communications;
• children’s-area access and custody concerns;
• offerings, donations, records, computers, and sensitive personal information;
• public events, food distribution, counseling, recovery groups, schools/daycare, and facility rentals; and
• emergency access, evacuation, shelter, lockdown, reunification, and continuity.

Use credible local information. CISA and the FBI recommend connecting with local law enforcement, the local FBI field office, fusion-center or other appropriate public-safety partners, nearby houses of worship, and CISA Protective Security Advisors to better understand risks and available support.[2]

Security planning should be behavior- and information-based, not based on race, ethnicity, religion, disability, dress, language, housing status, or another protected or irrelevant characteristic. Train people to report specific behavior, communications, objects, or circumstances.

3. Understand the space through layers

CISA’s house-of-worship guidance describes outer, middle, and inner layers.[1] The labels matter less than understanding how a concern could be noticed, communicated, delayed, or managed before it reaches people or critical functions.

Outer layer: grounds and approaches

Review property boundaries, parking, neighboring lots, sidewalks, vehicle approaches, rideshare, drop-off, landscaping, lighting, signs, fences, gates, playgrounds, utility areas, and emergency access.

Questions include:

• Can people identify the correct public entrance without wandering into private areas?
• Are parking and walking routes visible and appropriately lit?
• Could a vehicle unintentionally or deliberately enter a dense pedestrian area?
• Are trees, shrubs, storage, or structures creating concealed areas?
• Can fire, police, and EMS reach the building without delay?
• Who checks the grounds before opening and after closing?

Middle layer: building perimeter and entrances

Review doors, windows, roof or service access, locks, alarms, cameras, public entrances, child check-in, offices, deliveries, and the point where a greeter or officer first interacts with a visitor.

An “open door” culture does not require every door to remain unlocked and unattended. Many communities designate a small number of welcoming public entrances while preserving code-compliant emergency egress. Facility and fire-code professionals must approve door and locking practices; never block an exit or use a security measure that creates a life-safety hazard.

Inner layer: people and critical spaces

Identify worship areas, children’s rooms, classrooms, counseling spaces, offices, money handling, audiovisual/control rooms, kitchens, and locations used for shelter or medical response.

Use access based on legitimate roles. Not every volunteer needs keys, alarm codes, camera access, children’s records, or emergency contact lists. Plan how leaders communicate discreetly if a concern moves inside.

4. Make the entrance welcoming and prepared

Greeters and ushers are often the first people to notice that someone is confused, distressed, agitated, or seeking help. Their primary role should remain hospitality unless the organization formally assigns and trains additional responsibilities.

An entrance plan can include:

• a clearly marked public entrance;
• calm greeting and wayfinding;
• a method to request assistance without escalating the interaction;
• an accessibility process for people who need another entrance or support;
• a child check-in and release process separate from general security judgments;
• instructions for deliveries, contractors, and after-hours visitors;
• objective behavior-based reporting;
• a discreet method to notify the safety lead or officer; and
• clear thresholds for calling 911.

Security should not rely on improvised confrontation. Define who may approach a person, what they may ask, how they disengage, who makes a decision about entry or removal under the organization’s authority, and when police are needed.

5. Define volunteer and professional roles

Greeters and ushers

They can welcome, observe, direct, maintain clear aisles and exits, communicate concerns, and support orderly movement. They should not be expected to perform security enforcement or medical tasks without selection, training, policy, and insurance review.

Volunteer safety or security ministry

Volunteers may support awareness, communication, evacuation, medical response, child check-in, and other approved functions. Leadership should screen them in a manner appropriate to their duties, verify qualifications they claim, train them, establish a chain of command, and document boundaries.

Do not give volunteers search, restraint, detention, firearms, investigative, or physical-removal duties based on good intentions alone. Those areas require legal and insurer review, qualified instruction, supervision, and written policy.

Professional security officers

Professional officers can provide a defined security role, licensing accountability, supervision, site-specific post orders, reporting, and a consistent point of coordination. Possible assigned duties include entrance observation, parking or perimeter patrol, communication with leadership, incident documentation, and emergency notification.

In Arizona, the Department of Public Safety regulates security guards and security guard agencies. Armed guards have additional training and registration requirements.[3] Private guards do not become police officers because they are uniformed or armed.[4]

Local police, fire, and EMS

Build relationships before an emergency. Invite appropriate agencies to understand the location, public entrances, emergency access, naming conventions, key contacts, and the organization’s emergency plan. Do not assume an agency can provide routine coverage or approve the plan without direct coordination.

6. Volunteer team, professional officers, or both?

A combined model often allows volunteers to remain focused on hospitality, awareness, communication, and care while trained professionals perform defined protective duties. The right model follows assessment, not a presumption that volunteers always replace professionals or that every service requires a guard.

7. Armed or unarmed security?

There is no universal answer. Consider credible threats, prior incidents, attendance, facility layout, children’s areas, police response, expected duties, congregation culture, leadership policy, insurance, legal advice, and the risks introduced by firearms.

Unarmed officers may provide visible presence, entrance observation, parking patrol, de-escalation, reporting, and emergency communication. Armed coverage may be appropriate when a qualified assessment identifies a significant violent-threat risk, but it adds requirements for firearms credentials, training, supervision, use-of-force policy, identification, storage or carry practices, and coordination.

Armed volunteers, off-duty law enforcement, and armed private security are different legal and operational models. Counsel and the insurer should review the actual arrangement, identification, coordination, and policy. Do not publish sensitive tactical details.

Armed status is one decision within a layered plan. It does not replace working doors, controlled keys, child safeguards, communications, medical readiness, exercises, or relationships with public safety.

8. Protect children and vulnerable people

Everyday safeguarding and emergency preparedness should work together.

Define:

• approved check-in and release procedures;
• authorized pickup and custody-exception handling;
• volunteer/employee screening and supervision;
• who may enter children’s areas;
• classroom attendance and accountability;
• communication with parents or guardians;
• evacuation, shelter, lockdown, and reunification appropriate to age and needs;
• medication, mobility, sensory, language, and other access and functional needs;
• procedures for missing or separated children; and
• protection of rosters, contact information, and incident records.

CISA’s physical-security performance goals for faith-based communities recommend access control for children’s ministries and, for schools/daycares on the property, limited access, authorized visitor entry, and parent/guardian communication procedures.[5] Childcare licensing, school, fire-code, and other requirements may apply depending on the program; obtain qualified review.

9. Plan for money, records, and technology

Use dual control, prompt secure handling, and limited access for offerings and donations; do not publish routes, storage, keys, schedules, or amounts. Protect membership, counseling, donor, children’s, and camera data with role-based access, unique credentials, multifactor authentication where available, updates, former-user removal, and retention/deletion rules. Physical and cybersecurity plans overlap when doors, cameras, alarms, check-in, or communications depend on connected systems.

10. Build an all-hazards emergency operations plan

FEMA’s guide for houses of worship recommends a basic plan with purpose, operations, responsibilities, coordination, information, training, logistics, and plan maintenance, plus functional annexes such as evacuation, lockdown, shelter-in-place, recovery, and security, and hazard-specific annexes based on the assessment.[6]

At minimum, define:

• who recognizes and reports an emergency;
• who calls 911 and what location information is provided;
• who can order evacuation, shelter, lockdown, or cancellation;
• how people are warned when the PA system or power fails;
• primary and backup communication methods;
• responder access and the person who meets them;
• assistance for children, older adults, and people with disabilities or access and functional needs;
• accountability and reunification;
• first aid, CPR/AED, and bleeding-control resources delivered by qualified providers;
• continuity of critical community and pastoral services;
• family, congregant, and media communication; and
• recovery, documentation, insurance, and after-action review.

Keep the public-facing plan simple, but control detailed maps, access information, vulnerabilities, medical information, and tactical procedures.

11. Train and exercise without causing harm

People need to understand their roles before an emergency. Progress from leadership review to staff/volunteer orientation, a tabletop scenario, and functional practice of communications, accountability, or evacuation. Use more involved exercises only when justified, safely designed, and coordinated.

Violence exercises can be distressing. Give appropriate notice, accommodate trauma and disability needs, avoid surprise simulations, use qualified facilitators, protect children, coordinate with responders, and provide alternatives when appropriate. The objective is readiness, not realism for its own sake.

After each exercise or real incident, record what worked, what failed, who owns each improvement, and when the plan will be updated.

12. Large services, holidays, and special events

Reassess the plan when attendance, entrances, traffic, programming, publicity, offerings, vendors, or community tensions change.

For a major service or event, update the risk review and attendance/overflow plan; map parking, pedestrian, rideshare, and emergency access; identify entrance types; build posts from duties rather than a generic ratio; brief clergy, volunteers, officers, facilities, medical personnel, and public-safety contacts; test communications; address Arizona heat and monsoon conditions; protect restricted areas and offerings; and plan reunification, dispersal, and an after-action review.

Book professional services early enough for a site walk, written post orders, staffing, and relief planning, and confirm current lead times and availability for the specific dates.

House-of-worship self-assessment worksheet

Use this as a first-pass discussion tool, not a substitute for a detailed professional assessment. CISA also offers a dedicated Houses of Worship Security Self-Assessment and user guide.[7]

A practical first 90 days

Days 1–30: organize and assess

Obtain governing-body authorization, assign the team and backups, gather existing plans and incident history, walk the property during services and after dark, connect with public-safety partners where feasible, and complete the CISA self-assessment or another qualified assessment.

Days 31–60: prioritize and document

Correct urgent life-safety problems, rank remaining risks, write roles and procedures, define volunteer/professional boundaries, obtain qualified legal/insurance/life-safety review, and phase the budget around priorities.

Days 61–90: train, test, and improve

Orient staff, volunteers, and officers; test communications and accountability; run a tabletop exercise; assign corrective actions; and schedule recurring checks plus updates after incidents or material changes.

Frequently asked questions

Should a church use armed or unarmed security?

Only after a documented assessment and review of threats, duties, layout, children’s areas, police response, congregation culture, insurance, and law. Whichever model is selected, integrate it into the wider plan and document roles and coordination.

Can a volunteer safety ministry replace professional officers?

Not automatically. Volunteers can provide important hospitality, awareness, communications, medical, and evacuation support. Professional officers bring licensing accountability, supervision, post orders, and role-specific experience. Some communities use a combined model; the decision should follow assessment and legal/insurance review.

Can the same officer be assigned every week?

A consistent primary officer can improve familiarity, but a permanent individual guarantee is unrealistic. A stronger model uses a core assignment with trained relief personnel who receive the same orientation, post orders, contacts, and children’s-area rules. Ask the provider to document its staffing and relief practices.

How can security remain discreet and welcoming?

Match the posture to the community, keep roles clear, use calm greetings and wayfinding, define discreet communication, and avoid improvised confrontation. Preparation and consistent boundaries are usually less disruptive than reacting without a plan.

Should houses of worship provide active-violence and bleeding-control training?

They should evaluate relevant emergency training as part of an all-hazards plan. Use qualified programs and instructors, adapt delivery to the facility and participants, consider trauma and accessibility, and follow training with plan updates and appropriate exercises. Verify the course name, instructor credentials, format, scope, and availability before enrolling participants.