(optional) Survey system with appropriate security precautions and access controls Note-taking device that can be secured. For remote support, a secure videochat system (such as Signal) which works with the available bandwidth. Considerations Any physical notes taken on physical security should be destroyed. Digital notes should be kept in line with overall SAFETAG standards. Consider the threat context if an online survey tool is used to collect information and manage data access and storage responsibly. Any remote communication on physical security should be done over secured channels from a private space It should be noted that SAFETAG is focused only on the digital impacts of physical security. This guide does not provide a full physical security assessment. Walkthrough This activity should build on the preparation work of the auditor, as well as the capacity assessment and context research work: Capacity Assessment: If the auditor has already completed the Capacity Assessment interview, many of the answers from its introductory "Open Up" questions (5-22) provide threat history, likelihood, and some basic policy information, and the questions grouped as "Threat Information," (58-68) go deeper into previous problems and responses. If those were not asked, they can be included here as a follow-up interview/survey. Context Research: Ensure context research has revealed whether the organization would be targeted by adversaries due to their work (e.g. advocacy, engagement in or media coverage of socially sensitive topics, etc.). Threat identification and technical context research should provide insight into likely technical capabilities of adversaries (are malware or other surillance tools used (https://sii.transparencytoolkit.org/) ? Physical surveillance/monitoring? Keyloggers?) Once an initial interview or survey has taken place (as part of capacity assessment or dedicated to the above-mentioned questions), Send a follow-up request for any policies mentioned or referred to (travel policies, onboarding/offboarding policies for staff changes, personal device usage ("BYOD") policies, etc.). After reviewing those documents, request any additional policies those may refer to (general IT or security policies), and/or schedule a follow up interview or informal survey to dig deeper into remaining unanswered questions on the operatioal security situation of the organization as well as Page 118 of 240