Send us the client who can't pass the questionnaire.
Every renewal season, someone on your book gets a cyber-insurance application with questions their small staff can't answer — MFA, backups, incident response, access reviews. We do the work: read-only monitoring of their Google Workspace or Microsoft 365, a scorecard against the 12 controls carriers actually probe, an evidence packet with dates, and a prioritized fix list — at a price a church or small nonprofit can pay. What we don't do: we are not an insurer, we don't write policies or quote premiums, and we never speak to a carrier without your client copied on the conversation.
Read-only, enforced by Google & Microsoft — we never hold a password. Call or text (940) 281-6672
From "we don't know where we stand" to a broker-ready packet.
One flat-fee engagement, then an optional subscription if they want the gaps closed and kept closed before every renewal.
The $750 Cyber-Insurance Readiness Checkup (up to 15 users; $1,250 for 16–50)
A scorecard against the 12-control Church & Small-Organization Insurance-Readiness Standard, each line pass / gap / evidence quoted. Includes a one-page, broker-ready summary you can attach to the submission, a prioritized fix list walked through on a call, and re-verification with dates once gaps are closed. See the printable 12-control checklist.
Optional: Guardian Plus "Insurance Ready" — $549/mo
For clients who want the gaps closed and kept closed. Concierge support at every renewal: the questionnaire itself, gap-closing, and a fresh evidence packet before the policy comes up again. See plans & pricing.
Or the Essentials starter — $99/mo
Inbox scam monitoring plus the outside-in layer — DMARC/spoofing, lookalike domains, breach catalog, exploited-vulnerability watch, website — for clients who aren't ready for the full concierge yet. Full scope at what's included, and what isn't.
The questions on the application, and where each one is answered.
We lined up the control questions from several carriers’ public small-business cyber applications against our 12-control standard. When your client's packet comes back, every question below already has an answer, with the evidence behind it.
| What the application asks | Where the packet answers it |
|---|---|
| MFA on email | Control 1, checked for enforcement, not just availability |
| MFA on remote access (VPN, remote desktop) and cloud admin consoles | Control 2 |
| Privileged accounts protected and limited | Controls 2 and 3 |
| Backups: how often, kept offline or separate, actually tested | Control 6 |
| Antivirus, endpoint protection and patching | Control 7 (endpoint protection); control 12 watches for actively exploited public software |
| A written incident-response plan and a named person responsible | Control 8 |
| Security-awareness training, including for staff who move money | Control 9 |
| Call-back verification or dual approval before funds or bank details change | Control 11 |
| Encryption and third-party vendor practices | Covered in the Checkup interview and noted in the packet (not one of the 12 controls) |
Three of our controls go further than most forms ask today: domain spoofing protection (control 4), human-verified email monitoring (control 5) and quarterly access reviews (control 10). They are there because email fraud is where small-organization claims start. The applications we reviewed are public editions from 2019 to 2023; your carrier's current form may differ, and we work from that one.
A sample of the one-page summary
This example is for a fictitious organization. Real summaries carry the client's own evidence and dates, and the client is copied on everything we send you.
| Example Community Church (sample) · 14 staff & volunteers with accounts · reviewed 2026-09-30 | ||
|---|---|---|
| 1. MFA on every email account | Pass | Enforced for all 14 accounts; admin console report dated 2026-09-30 |
| 2. MFA on admin & remote access | Pass | Both admin accounts use security keys; no remote desktop exposed |
| 3. Privileged accounts separated | Gap, closing | Pastor's daily account holds admin rights; separate admin account scheduled 2026-10-07 |
| 4. Email authentication at reject | Pass | DMARC p=reject published; SPF and DKIM aligned |
| 6. Tested, offline-capable backups | Gap | Backups run nightly; no restore test on record yet |
| 11. Call-back before payment changes | Pass | Written procedure adopted by the finance committee, 2026-09-14 |
| Remaining six controls follow the same format: status, then the evidence and its date. | ||
Simple on purpose — you stay in the loop, not in the middle.
You introduce
An email, a warm intro, or the form below — whatever's easiest. Tell us who the client is and what prompted the referral (a failed questionnaire, a renewal coming up, a general concern).
A 15-minute snapshot call
We talk with the client directly — what platform they run, roughly where they stand, and whether the checkup makes sense for them.
Checkup and report within the week
The 12-control scorecard, the broker-ready summary, and the fix list — delivered to the client, on a normal week's turnaround.
The client hands you the packet
We copy you on the report only with the client's written consent — it's their record to share. No referral fees are paid or accepted at this time; if that changes, it will be published here.
What we will and will not say.
- We will never tell a client their premium will go down. Industry guides report proactive controls can be associated with premium reductions of up to about 20% — that is an attributed industry figure, never a promise we make.
- We will never contact the carrier without the client on the line or copied in writing.
- We don't complete the application for the client — we prepare the evidence and help them answer it themselves.
- We don't guarantee approval, coverage terms, or pricing. Insurer decisions remain independent of anything we find or fix.
Three kinds of partners send us clients.
Insurance brokers & agents
A church or small nonprofit fails the cyber supplemental, and the renewal is at risk. Hand them the printable 12-control standard and let them book the checkup — you get a broker-ready summary back to attach to the submission.
Elder-law & estate attorneys
Families you already serve on estate and elder-care matters are frequently the ones being targeted by email fraud directly. For the family itself — not the organization — point them to our home page; Org Guard is for the churches and nonprofits they may also serve on a board.
Denominational offices, associations & dioceses
One review can serve many congregations. Hand your affiliated churches the same printable checklist so every one of them arrives at renewal with the same standard already in hand, instead of each figuring it out alone.
Or reach us directly — security@familysentinel.org · (940) 281-6672
Fair questions, straight answers.
Do you pay referral fees?
No referral fees are paid or accepted at this time. If that ever changes, it will be published here — nothing arranged privately.
Are you an insurer?
No. We are not an insurer, an agent, or a broker, and we don't write policies or quote premiums. We prepare the controls and evidence a carrier asks for; the coverage decision stays entirely between your client and their carrier.
Which carriers do you work with?
Any. We're carrier-agnostic — our job is the client's controls and evidence, not a relationship with a particular insurer. We prepare the record; the carrier decides.
Can you speak to our underwriter?
Only with the client on the line or copied in writing. We never contact a carrier independently of the client — every conversation about their posture includes them.
What if the client is a family, not an organization?
Org Guard is for churches, nonprofits, and small businesses. If the referral is a family or an individual, point them to our home page — family-focused elder-fraud protection is a separate service.
Know a client who won't pass the questionnaire?
Introduce them, or ask us how we work with partners like you.
Introduce a clientSee the insurance-readiness checkup →
Supports eligibility, underwriting readiness and risk reduction; does not guarantee premiums, coverage, claim payment or insurer approval.