PHYSICAL AND OPERATIONAL SECURITY SUMMARY The organizational security methodology is focused on how to mitigate against threats that occur because of the arrangement of digital assets in the physical world -- how secure are the devices at an organization's office, where and how staff travel with organizational devices, and whether staff work outside of the office (e.g. in remote offices, at their homes, while traveling, or at cafes). Further, is organizational information accessed from personal devices, and how are those devices secured? PURPOSE While the SAFETAG framework is focused on the security of data, the physicality of devices, backup drives, servers, and even hard-wired networks cannot be overlooked. For many organizations, digital threats that depend on physical access are considered the least probable. So much so, that many security specialists concede that there is no proper defense against an attacker with physical access to sensitive hardware. While there is some truth to this, it is not useful advice for small scale civil society organizations or independent media houses. The risks that advocacy and media organizations face are far more varied, and the cost of lost information can be crippling to their ability to operate. As such, these risks have high severity, despite their equally high probability for these organizations. Depending on the specific threats for each organization, the auditor should consider the challenges of not only one-time exfiltration of data as well as potential ways an adversary could use physical access or proximity to the organization or its devices to gain ongoing remote access, track, or cause harm to the organization through the outright destruction of data. THE FLOW OF INFORMATION Information Threats Results Threats Activity Actors Actors Capacity Capacity Activities Activities Vulnerabilities Vulnerabilities Barriers Barriers Assets Assets Data Assessment Information Flow GUIDING QUESTIONS Who has physical access to what? When are devices not monitored by trusted staff? Who has independent access to the office space? How could adversaries gain access? (forced entry, theft, social engineering, seizure) How are daily devices used and stored -- where are they when employees go home? Page 112 of 240