Diocesan Security: A 90-Day Roadmap

Most diocesan security initiatives stall in the same place: leadership wants action, the operations team is stretched, and there is no clear sequence. Three months later the conversation repeats itself with no progress.

This roadmap is the sequence we recommend when a diocese asks us where to start. It assumes the bishop or chancellor is the executive sponsor, one to two diocesan operations staff who can dedicate roughly half their time, and willingness to fund a starting investment in the range of $25,000-75,000 across the first quarter. Larger diocesan portfolios will scale up from there.

Week 1: Establish a baseline

Before any procurement, before any assessments, you need to know what you have. We start every diocesan engagement with a portfolio inventory: every parish and school, current security systems, documented incidents in the last 24 months, last assessment date, current insurance posture.

• Pull a list of all owned and leased properties.
• For each: when was the last security assessment, who did it, what category of system is in place.
• Pull insurance loss runs from the carrier - any incident over $500 in the last 36 months.
• Identify any sites currently under heightened watch from local PD.

Diocesan portfolios in New England typically range from a handful of sites in smaller dioceses to well over a hundred in larger ones. The Diocese of Providence, for example, has more than 130 parishes, plus diocesan schools, administrative offices, and supporting properties. The triage step matters more the larger the portfolio.

Weeks 2-3: Triage

From the baseline, sort sites into three buckets:

1. 1Tier 1 (urgent): sites with documented incidents, sites with no current assessment, or sites with known major gaps.
2. 2Tier 2 (priority): largest enrollment / congregation, highest insured value, or most external visibility.
3. 3Tier 3 (maintain): smaller sites with current assessments and no recent incidents.

Tier 1 gets walkthroughs in weeks 4-6. Tier 2 gets walkthroughs in weeks 7-12. Tier 3 gets a remote review and a 90-day check-in.

Weeks 4-6: Walk Tier 1 sites

Two officers, on-site, 60-90 minutes per location. The deliverable: a one-page risk summary plus a 5-15 page detailed assessment per site. The risk summary goes to the executive sponsor and the parish or school leadership. The detailed assessment goes to operations and the insurance broker.

Look for:

• The propped side door (it is almost always there).
• Camera coverage gaps on the approach paths.
• Lockdown procedures that omit non-academic staff and outdoor activities.
• Lighting gaps in evening Mass dispersal corridors.
• Vehicle approach exposure at sanctuary main entrances.

Weeks 4-12: Quick wins in parallel

While Tier 1 walkthroughs run, ship the universally-applicable improvements:

1. 1Standardize a one-page lockdown procedure template across all sites.
2. 2Brief every parish and school principal in a 60-minute virtual session on what they need to know.
3. 3Post-Mass usher protocol: two ushers per evening Mass remain in high-vis vests for 20 minutes after dispersal.
4. 4Install electromagnetic hold-opens on the most-propped doors at each Tier 1 site.
5. 5Set up a single emergency contact tree across the diocese.

Weeks 7-10: NSGP applications

Many schools and parishes are eligible for FEMA NSGP funding. Many never apply. If you are running a coordinated diocesan effort, you can submit applications for multiple sites in the same cycle, sharing common threat narrative and infrastructure language across applications.

Plan the application portfolio in week 7. Build threat narratives in weeks 8-9. Submit through your state administering agency in week 10. Our companion article on NSGP applications walks through the specifics.

Weeks 11-12: Establish the steady-state

By week 12 you should have:

• A current risk assessment on file for every Tier 1 and Tier 2 site.
• Standardized lockdown procedure across all sites.
• NSGP applications submitted where eligible.
• An ongoing-advisory cadence (we recommend monthly check-ins, quarterly site visits).
• An incident-reporting standard that flows to a single diocesan repository.
• A line item in the diocesan budget for security that survives the next budgeting cycle.

Year Two: what comes after the 90 days

The first 90 days build the baseline. Year Two is where the operating model matures. The work shifts from triage to maintenance and to reaching the long tail of Tier 3 sites that were not in the initial sweep.

• Quarterly walkthroughs of Tier 1 and Tier 2 sites to verify implementation and re-evaluate.
• Annual full reassessment for the highest-priority sites.
• Active threat training rolled out across the portfolio - typically 2-4 sessions per year covering different staff cohorts.
• Drill design and observation, with after-action notes feeding the next round of procedure updates.
• Insurance renewal participation - we sit in on broker meetings if useful.
• An annual diocesan security report to the bishop summarizing posture, incidents, expenditures, and recommendations.

What this costs

For a diocese in the range of dozens of sites, a coordinated 90-day effort typically requires advisory fees in the low-to-mid five figures, plus capital improvements that are often partially or fully reimbursable through NSGP for eligible sites. Larger portfolios scale up from there. The largest single risk reducer in the budget is usually the standardized lockdown procedure - which has near-zero capital cost and produces dramatic outcome improvements.

What kills the timeline

1. 1No executive sponsor. If the bishop or chancellor does not visibly back the effort, parish-level resistance kills it.
2. 2Trying to do everything at once. The roadmap works because Tier 1 buys focus. Skip the triage and the effort collapses.
3. 3Picking a vendor that has not done a multi-site engagement before. The operating rhythm is different from a single client.
4. 4Underestimating the time required to standardize procedure across many semi-autonomous sites.

If you are on month 6 with no progress

We get this call regularly. The fix is usually not a new vendor - it is restarting the sequence. Re-establish the baseline, re-triage, walk the top sites in 90 days, and stop trying to perfect everything before starting anything.

If a diocese-wide effort is on your roadmap and you would like to talk through the sequence, we offer a complimentary 90-minute initial planning conversation. No commitment.