their adaptations to it. In the (likely) case where there are no policies governing these topics, the auditor can ask their points of contact for these discussions what the general practices are and expand and verify this through additional activities. In creating new questions, be careful to not "lead" on security in a way that would discourage honest and transparent responses. For example, ask "Do you host community events and trainings?" instead of "Do you allow outside people into your office"? Below are questions not already covered in the capacity assessment interview process, and after that selected questions from that process which are of particular use here. Office layout and access Describe your office - is it on a floor of a building? An entire floor? (What level of the building?) How close are other buildings? Is it a shared, open office space or coworking space? (shared network? open access?)? Has the organization dealt with robberies/theft, break-ins, or office raids? If so, what happened, when, and how did you respond (or do you have a policy or contingency plan? When was that last reviewed/updated?) Who has independent access to the office space, and routine after-hours access (i.e. who is able to unlock the space). This may include security, cleaning or other building service personnel. What other wifi networks can you see? (See https://wigle.net/ ) Programs and staff Do you host events or trainings at the office? Open "cybercafe" or community meeting space? Do you host 1:1 meetings with funders, partners, Do staff work from or meet at homes or cafes/restaurants? Selected questions from the Capacity Assessment Interview, "Open Up" section: What issues does the organization work on? Are these issues sensitive where you work? Where does your organization have activities? Does the organization have activities in more than one (city/provence/country/region)? What kind of funding does you organization receive? Does the organization have its own office space? Does the organization have a domain name or brand identity that is used for all Page 119 of 240