notepads to track concerns, reducing this risk but possibly being less impactful. Any physical notes taken on physical security should be destroyed. Digital notes should be kept in line with overall SAFETAG standards. The location of certain high-value assets is highly sensitive, and may be controlled/secret information. Handle with care when discussing with the organization, and if conducting this remotely/in advance, ensure the point of contact can handle and destroy the data responsibly. It should be noted that SAFETAG is focused only on the digital impacts of physical security. This guide does not provide a full physical security assessment. Walkthrough The auditor should first meet with the facilitator (possibly over secure videochat) to brief them on the activity and map out potential challenges (particularly around trust, organizational hierarchies, and any potential repercussions). The auditor then prepares a checklist of physical vulnerabilities with the facilitator, based on the current understanding of the organization's assets and the context they are operating within. The auditor, facilitator, and organization point of contact should decide if any areas are "off limits." Note that this is only a list of a suggestions. As with the "Risk Hunting" exercise in SaferJourno, and it should be modified to fit the requirements, assets, and threats the organization faces: Open windows. Door with key hanging from the lock and/or unlocked doors to secure areas Unlocked access to networking equipment - routers, wifi, modem / cablemodem / servers Unsecured Laptop(s) (e.g. no locked cabinet for overnight storage, no cable lock) Computer left unattended with active Outlook, Gmail, Skype or other communication application open and visible. Wires or cables for devices that have been strewn on the floor where someone would need to step over them. Portable backup drives, USBs, and/or other external hard drives on desktops or plugged in to computers Passwords written on a “sticky note” or other paper taped to a monitor or onto the surface of a desk. Smartphones, cameras or other valuable devices left unattended At the organization, the facilitator explains the activity to the organization members. To balance the need for consent with the benefits of identifying actual daily practices which may need improvement, the staff should already be aware that examining physical devices is part of the audit scope, but not the specific activity. Staff will be able to first identify and address their personal concerns before others. Page 126 of 240