- Draw up a security plan and security levels.
- Manage a critical incident, from alert to lessons learned.
- Fulfil the duty of care towards all staff.
1The security plan
The security plan turns the risk analysis into concrete rules: description of the context, main threats, standard operating procedures (movements, communications, base, cash), security levels (for example from 1 to 5, with the measures for each level), hibernation, relocation and evacuation plans, emergency contacts.
Everyone knows it, it is tested (drills) and revised at least every six months or after any major change. National staff, often more exposed and harder to evacuate, must be explicitly taken into account.
2Managing a critical incident
A critical incident (kidnapping, attack, death, serious assault) is managed by two teams: an incident management team on site and a crisis management team at headquarters. The steps: alert, fact-finding, securing other staff, informing families through a single point of contact, controlled external communication, decisions recorded in a crisis log.
Kidnappings follow a written policy: who negotiates, with what specialist support, and within what limits. Nobody negotiates alone in the field.
3Duty of care and post-incident support
The duty of care requires the organisation to take reasonable steps to protect its staff from foreseeable risks: information and training, equipment, insurance, procedures, psychosocial support. It applies to national and international staff alike, and to partners in a shared-risk approach.
After an incident, provide psychosocial support (psychological first aid, referral), a blame-free lessons-learned review, and update the security plan.
Exercise: security levels
For a fictitious area, define four security levels (normal, vigilance, restriction, hibernation/relocation): for each, the indicators that trigger the change, movement rules, hours and communications.
Key points
- Security plan: procedures, security levels, hibernation, relocation and evacuation plans.
- Critical incident: team on site + crisis team at headquarters, single point of contact for families.
- Kidnapping: written policy, nobody negotiates alone.
- Duty of care for all staff; psychosocial support and lessons learned.
Further reading: course references
- Humanitarian Practice Network (ODI) (2010). Good Practice Review 8: Operational security management in violent environments. odihpn.org/publication/operational-security-management-in-violent-environments-revised-edition
- GISF (2024). Global Interagency Security Forum (GISF) resources and training. gisf.ngo
- International NGO Safety Organisation (INSO) (2024). Security analyses for NGOs. ngosafety.org
- IASC / United Nations Security Management System (2019). Security Risk Management framework. interagencystandingcommittee.org
Daily quiz
3 questions to check what you have learned. Answer them all to complete the day.