Note: Risk modeling will require a mixed approach of exercises, and the order which you identify each component will vary depending upon the organization. If it was not possible to conduct these activities in person, you can conduct them remotely through applying one of the remote facilitation approaches described in the Remote Facilitation appendix. OUTPUTS Maps of critical processes. A list of organizational assets. OPERATIONAL SECURITY Ensure that any physical notes/drawings are erased and destroyed once digitally recorded. Ensure that any digital recordings of this process are kept secure and encrypted. Consider who has physical and visual access to the room where this process takes place, and if the room can be secured if this activity may span long/overnight breaks. PREPARATION Risk Modeling and Proccess Mapping exercises can be intense and challenging to facilitate. Prepare and review your exercises, and plan for how they will flow together. Note your specific desired outcomes to easily recover or re-direct the activity based on emergent needs. RESOURCES Overview: "An Introduction to Threat Modeling" (Surveillance Self-Defense) Guide: "Risk Assessment" (Workbook on Security: Practical Steps for Human Rights Defenders at Risk - Chapter 2) Guide: "Threat Assessment: Chapter 2.5 p. 38"(Operational Security Management in Violent Environments (Revised Edition)) Guide: "Defining The Threshold Of Acceptable Risk" (Integrated Security) Guide: "Guide for Conducting Risk Assessments" (NIST 800-30) Report: "Risk Thresholds in Humanitarian Assistance" (European Interagency Security Forum) Threat Modeling Resources (General) Book: "Threat Modeling: Designing for Security" (Adam Shostack) Website: "An Introduction to Threat Modeling" (Surveillance Self-Defense) Page 136 of 240