Conducting a risk assessment

Think of Samuel, who directs a legal aid organisation in Addis Ababa. After a partner group nearby has its laptops taken in a raid, his team spends a staff meeting listing everything that could go wrong. By the end there are 30 worries on the whiteboard and everyone feels worse. Nobody knows which one to start with.

That’s a common place to get stuck: a long list of threats can feel overwhelming, as if nothing you do would help (NDI). This guide is about the next step, which is choosing.

What a risk assessment is

A risk assessment is a structured conversation about what you need to protect, who might want to harm it, how likely that is and how bad it would be (EFF; NDI). Its job is to help you decide what to do first. Nobody can defend against everything all the time, and trying to is exhausting (EFF).

You’ll meet a few words in it, and across this handbook:

• Assets: what’s worth protecting, such as information, devices, accounts, people and relationships (NDI).
• Threats: things that could happen and cause harm, from a stolen phone to a smear campaign.
• Adversaries: people or groups who might want to harm you or your work. They can be people you know, like a former colleague (NDI).
• Vulnerabilities: weak spots that make harm more likely.
• Capacities: what you have that makes harm less likely, such as skills, allies, tools, money and time.
• Risk: how likely a threat is (its likelihood) and how bad it would be (its impact).

Front Line Defenders puts the idea as a formula: risk grows with threats and vulnerabilities, and shrinks with capacities. The two often sit side by side. A charged phone with an emergency number saved is a capacity; a phone left at home is a vulnerability.

It’s worth doing even if you think you already know your biggest risk. Access Now’s helpline notes that organisations don’t always know what their main risks are, and that what they see as the biggest one sometimes isn’t (Access Now).

Start with a quick checklist

Many civil society organisations still struggle with risk assessment (Protect.ngo), so don’t worry if you don’t know where to start. A checklist gives you a first picture. SIIRF’s Readiness Assessment asks 32 questions across eight areas, each answered yes, partly, no or don’t know, and gives you a report of what to fix first.

Two other free starting points:

• Protect.ngo’s General Cybersecurity Assessment, which needs no technical background (Protect.ngo). It’s free for non-profits that join The Builders.
• NDI’s Security Plan Starter Kit, with questions to discuss for each part of a security plan.

A checklist shows the gaps every organisation should close. A conversation with your team finds the risks particular to your work.

Talk it through with your team

Set aside a meeting and work through these steps together. They follow SAFETAG, the audit framework Internews built for small civil society groups.

1. List what you do. Name the few activities the organisation couldn’t function without, such as paying staff, managing grants, talking to sources or publishing (SAFETAG).
2. List who’s involved. Staff and volunteers, anyone with keys to the office, partners, the people you serve, donors and the people who oppose your work.
3. List what you hold. Information and where it’s kept, accounts, devices and the website. The stocktake in Why digital security matters is a good start.
4. Name the threats. For each one, ask whether it has happened before, to you or to groups like yours, and whether the people behind it could do it and would want to (SAFETAG). Count theft, fire, floods, gender-based violence and laws that could be used against you, as well as attacks on your accounts and devices (Holistic Security; SAFETAG).
5. Rank them. Mark each threat low, medium or high for how likely it is and how bad it would be (NDI).
6. Decide, and write it down. Note which threats you’ll take seriously and which are too rare or too minor to worry about for now, who leads each step and when you’ll look again (EFF).

If the room gets stuck, try a pre-mortem. Ask everyone to imagine it’s a few months from now and the organisation can barely work. What happened (SAFETAG)?

Choosing what to tackle first

Start with the threats that are both likely and harmful. Ranking keeps the results from feeling overwhelming, because you only need to act on the top of the list first (SAFETAG). For the harmful ones that are unlikely, plan what you’d do if they happened: that’s what your incident response plan is for. Write down the ones you decide to accept for now too, with the reason.

Bring in allies. Other groups facing the same risks, a helpline or a partner with skills you lack can share the work (EFF).

Then look again regularly and whenever something big changes, such as new work, new staff, a new tool or a change in the political climate (EFF; NDI). Checklists and audits suggests a rhythm.

Look after people while you do it

Naming threats can stir up fear and leave people feeling hopeless. Leave breathing room, and remind everyone that any risk can be reduced (SAFETAG). Stress and exhaustion also bend what people see: some will imagine danger that isn’t there and others will miss what is (Holistic Security), so check your picture with people you trust (Holistic Security).

In a sense, threats are a sign that your work is effective and that your opponents fear your work. While it may be a moment which inspires fear, clearly recognising the threats you face should also be a moment of empowerment.

Holistic Security, Tactical Tech

Afterwards, keep a simple record of worrying signs (when, where, who, what happened) so you can spot patterns and share them (Holistic Security). Thank whoever reports one. Well-being and care has more on keeping that kind of trust.

Keep it safe

What you write down is a map of what matters most and who threatens it, so treat it as sensitive. Store it somewhere secure, wipe the whiteboard and destroy paper notes once they’re typed up, and think about who can see into the room (SAFETAG). That includes Samuel’s whiteboard. In high-risk settings, switch phones and laptops off while you talk, because a device with spyware on it can record the room (SAFETAG).

Where to go next

• Security policies: turn your decisions into rules people follow.
• Your incident response plan: plan for the threats you can’t prevent.
• Who has access: sort what you hold by how sensitive it is.
• Common Risks: the threats groups like yours face most, one at a time.
• For a deeper look, a trained auditor can run a full SAFETAG assessment with you.