Security champions

Take Grace, the finance and admin officer at a women’s rights organisation in Kampala. She never applied to be anyone’s security person. But colleagues forward strange messages to her, the director calls her when the email won’t open, and she’s the one who set up the shared drive. This week alone she has spotted a fake invoice, reset two passwords and checked in on a colleague who’s been getting abuse online.

Grace is a security champion. She just hasn’t been told.

Is this you?

Most small organisations have no IT department, so the role finds someone. Often it’s the colleague who’s good with phones and starts answering questions, with no title and no time set aside for it. Some directors name a person; some teams share the work; many have nobody until something goes wrong.

You might be the champion already if:

• people ask you whether a message or link is safe
• you set up, or quietly look after, the shared accounts and drives
• you’re the first call when someone is locked out or hacked
• you worry about the team’s safety more than anyone asked you to

If that’s you, the most useful step is to make the role visible: a name, some time each month and someone to share it with. Then it doesn’t depend on one tired person.

What a champion does

• You’re the first point of contact when something goes wrong. Practitioners describe in-house champions gathering what happened and making a first check of whether a message or file is harmful (SAFETAG). Do that without opening the link or file, and bring in outside help early. The playbooks in Incident Response walk you through the first hour.
• You keep the basics going. Regular check-ins, simple checklists and audits, and teaching colleagues in ways that fit their day (Training your team).
• You help write and practise the plan. In a small organisation one person may hold several roles in your incident response plan, so give every role a deputy (SIIRF).
• You look after people as well as devices. Someone who’s been hacked or harassed needs care first. Well-being and care covers what helps.

The aim is a team that can look after itself. Outside trainers and auditors say the same about their own work: its goal is to make itself unnecessary (SAFETAG).

What a champion isn’t

• The only person responsible: a role carried by one person breaks when they’re away, leave or burn out. Share it, and name a deputy (SAFETAG; SIIRF).
• An expert on everything: knowing when to ask for help is part of the job. Access Now’s Digital Security Helpline is free for civil society, day and night.
• The security police: people drop rules that stop them getting their work done, so listen first and fit the habits to how your colleagues actually work (SAFETAG).

Building a security culture in a small team

The tools are rarely the hard part.

I feel comfortable using the tools themselves, but the harder process is actually change management within the organization and getting it rolled out to my team. That’s often the biggest piece that isn’t being considered by vendors, trainers, or folks writing resources online.

A survey respondent, New America’s Defending the Defenders, 2025

What helps:

• A regular, safe time to talk about security: a standing item in a meeting you already have is enough. When it’s on the agenda, raising a worry doesn’t feel paranoid or like wasting people’s time (NDI; Holistic Security). Let different people lead it now and then, so it’s clear security belongs to everyone.
• Trust: people share concerns, and even mistakes, with colleagues they trust. Notice what gets in the way: a dismissive tone, the distance between junior and senior staff, a stressful week (Holistic Security).
• Ordinary moments: build security into a new colleague’s first week, and into the day someone leaves, when their access gets switched off (NDI).
• Thanks, not blame: thank everyone who reports a problem, and keep the facts calm. Fear makes people stop listening or give up (NDI).

Getting your director on side

Leaders need to back the work in public and follow the same rules, or nobody else will (NDI; SIIRF). What most often convinces them is a real incident nearby, at a partner or a group they know. Funding helps too: many funders now require the groups they support to keep their security strong (NDI).

When you ask, be specific. Ask for a standing item in meetings, a few hours a month written into your role and someone senior to own the incident response plan. SIIRF’s Readiness Assessment report gives you something concrete to show.

Look after yourself too

The role usually comes on top of a full job, with no time set aside for it. Practitioners at a 2021 meeting described digital security helpers in Eastern Europe and Eurasia as overstressed, overworked and underpaid (SAFETAG). Your rest needs planning like everything else. Share the load, say no to what isn’t yours and use the support in Well-being and care.

When something is beyond you, ask for help. Contact Access Now’s helpline, or find another in the Digital First Aid Kit’s support list.

Where to go next

• Training your team: sessions that fit busy colleagues.
• Your incident response plan: who does what when something goes wrong.
• Checklists and audits: simple checks you can repeat.
• Well-being and care: looking after the team, and yourself.