Begin asking what other threats identified could come as a result of this threat, supplanting the responses from the participants with additional threats. For example, a hacked website could lead to loss of trust by funders or partners. "Chain reactions" can be illustrated as lines of events (loss of trust by funders could lead to a loss of funding). Do the same for what threats could lead to the "central" threat - a confiscation of a device could lead to email hacking, for example. Some threats can be both potential causes and secondary effects. Close out this with a discussion of how every threat is potentially connected to both digital and physical impacts. Recommendation REGIONAL CONTEXT RESEARCH Covered in full in Capacity Assessment: Regional Context Research Identify additional adversaries not identified in interviews including: government authorities, non-state actors (organized crime. corporations, etc), and police or security forces. Identify capacity and willingness of potential adversaries to act against the organization. Identify any legal risks associated with conducting the audit (Secure communications and storage, network forensics, device exploitation, digital security training.) 78 Technical Context Research Identify access to communications infrastructure. Explore latest cyber security trends. Explore security landscape of hardware and software identified in interviews. 79 Page 160 of 240