Salmini

About
Find your path
Essays

Find your path

Where should your team start?

Answer four quick questions and get a short path through the handbook, in the order to read it.

This plan link doesn't match the guides on the site. Ask for a new one, or answer the questions to make your own.

Your plan has been cleared.

Something wrong right now?

This needs JavaScript to work. Every guide is also listed by topic on the home page. Browse every guide

Something wrong right now? Go to the playbooks

What brings you here today?

Something has gone wrong An account, a device or a colleague needs help now.

I'm new to looking after security You want the foundations, in a sensible order.

I want to fix a weak spot You know roughly what worries you.

I'm bringing my team on board Rules, training and habits that stick.

What's happening?

Pick any that fit.

An account was taken over

A phone or laptop was lost or seized

Someone clicked a suspicious link

Personal details were posted online Something else

Which areas worry you most?

Pick up to three.

Accounts and passwords

Email, messages and calls

Phones, laptops and browsing

Files and sensitive information

Being targeted, watched or harassed

Team habits and well‑being

How comfortable is your team with digital security?

Just getting started Few habits or tools in place yet.

Some basics in place A few habits, but gaps you know about.

Fairly confident Ready for the harder questions.

Do any of these apply to your organisation?

Pick any that fit, or none.

We travel or cross borders for our work We hold sensitive information about the people we support Several of us share logins Our staff are visible or speak out in public We've had an incident before

Your answers never leave this device, and they're cleared when you finish or close the browser.

Your plan

This order builds step by step, and each guide also stands on its own.

You've read every guide in this plan. Share it with your team, or retake the questions for a new one.

Saving it replaces the plan on this device.

Based on your answers Something has gone wrong I'm new to looking after security I want to fix a weak spot I'm bringing my team on board An account was taken over A phone or laptop was lost or seized Someone clicked a suspicious link Personal details were posted online Something else Accounts and passwords Email, messages and calls Phones, laptops and browsing Files and sensitive information Being targeted, watched or harassed Team habits and well‑being Just getting started Some basics in place Fairly confident We travel or cross borders for our work We hold sensitive information about the people we support Several of us share logins Our staff are visible or speak out in public We've had an incident before

Right now

Security Culture Why digital security matters The threats civil society organisations face most often, the basic terms every other guide uses, and how to take stock of your organisation's digital footprint.
Security Culture Conducting a risk assessment Working out which threats apply to your organisation and which to tackle first, so limited time and money go where they matter most.
Security Culture Security champions What the role looks like in a small organisation: running regular check-ins and audits, and keeping an eye on colleagues' well-being, not just their devices.
Security Culture Well-being and care Spotting stress and burnout, supporting colleagues during and after an incident, and building security habits that don't wear people down.
Policies and Training Security policies Which security policies a small organisation needs, how to get them followed, and how to keep them documented and up to date.
Policies and Training Training your team How to train colleagues with mixed technical backgrounds, measure what's sinking in, and build habits that hold up under stress.
Policies and Training Your incident response plan Who does what, who to call and where your records live, written down before anything goes wrong.
Policies and Training Checklists and audits Simple checklists and regular audits that show whether your security practices are still working.
Account Security Password management Getting the whole team onto a password manager, checking whether your logins have leaked in a data breach, and handling account recovery safely.
Account Security Two-factor authentication Adding a second step to your logins, so a stolen password alone isn't enough to get in.
Account Security Social media accounts Keeping control of the accounts your organisation speaks through, including the ones several people log in to.
Account Security Shared accounts Logins several people use, like the organisation's social media or a fundraising platform, shared safely and taken back when someone leaves.
Communication Security Email security Running your organisation's email safely: choosing a provider, keeping work and personal email apart, and recognising common malicious emails.
Communication Security Phishing How to spot a phishing message before anyone clicks, and what to do if someone already has.
Communication Security Secure messaging Choosing messaging apps for sensitive conversations, and what your messages reveal even when their content is encrypted.
Communication Security Video calls Running sensitive meetings over video, from choosing a tool to keeping uninvited people out and deciding what gets recorded.
Devices and Browsing Phones and laptops Phones and laptops hold everything your team works on. Encryption, location settings, licensed software, and the rules for using personal devices for work.
Devices and Browsing Travel and border crossings Preparing phones and laptops before a trip, what to do at a border, and checking devices for tampering when you're back.
Devices and Browsing Browsing securely Every site you visit learns something about you. What VPNs, privacy extensions and privacy-protecting browsers do, and when each one helps.
Devices and Browsing Wi-Fi and networks Securing the office network, using public Wi-Fi safely, and the basics of firewalls and network monitoring.
Data Security Backups Keeping copies of your files so a stolen laptop, a broken drive or ransomware doesn't wipe out years of work.
Data Security Sharing files and cloud storage Choosing where files live, sharing documents safely, and what changes when your data sits on someone else's servers.
Data Security Who has access Sorting your information by how sensitive it is, and deciding who should see what, from someone's first day to their last.
Data Security Deleting data safely Getting rid of files, old devices and paper records so the information on them can't be recovered.
Common Risks Doxxing When someone publishes your staff's home addresses, phone numbers or family details to intimidate them, and how to shrink what can be found in the first place.
Common Risks Online harassment and abuse Harassment and intimidation campaigns aimed at your staff, including by extremist groups, and how to support the colleagues on the receiving end.
Common Risks Spyware and surveillance Recognising when your devices, communications or meetings may be monitored, from spyware to physical surveillance, and the basic counter-measures that help.
Common Risks Social engineering When someone lies their way in by phone, message or in person, pretending to be a colleague, a funder or tech support.
Incident Response Account taken over Getting back into a hijacked email, messaging or social media account, then closing the way in so it doesn't happen again.
Incident Response Device lost or seized The first hours after a phone or laptop goes missing or is taken: what to lock, what to change and what to write down.
Incident Response Clicked a bad link Someone clicked a suspicious link or opened an attachment. What to check, what to change and who to tell.
Incident Response Details posted online A colleague's personal details have been published. What to do first, how to get them taken down and how to support them.
Playbooks Incident Response The first steps when something else has gone wrong.

When things are calm

Browse all guides

Link to this plan

The link lists the guides in this plan, never your answers.

Your answers stay on this device

Nothing you pick is sent anywhere. While you answer, your picks are kept in this tab, so a refresh won't lose them. Closing the browser clears them.

When you finish, only your plan's list of guides is kept here, never your answers. You can clear it anytime.

Salmini

Plain-language digital security guides for security champions at small civil society organisations.

If something goes wrong

An account was taken over
A phone or laptop was lost or seized
Someone clicked a suspicious link
Personal details were posted online

Navigation

Home
About
Topics
Find your path
Essays