Objectives of the organization
This activity seeks to put the whole group on the same page regarding the reasons for being of the organization and the goals that it pursues. In the case of activist organizations, this can be a propitious moment to reinforce the concepts and values of social justice that motivate the group to do the work they do. In the case of media workers, the values of access to accurate information and freedom of expression which motivate journalists can be strengthened.
Stakeholder mapping and classification
In this activity, the main idea is to continue exploring the organization, gathering information directly related to its security, also necessary to raise an optimal threat model in the future. In addition, it is a valuable input to study the evolution of the organization, its environment, and changes in the corresponding threat model.
Data mapping and classification
The main idea of this activity is to achieve the information about the organization, and thus redirect it towards its sensitivity. In the process, the bases that will easily allow the construction of the first security policies for the organization will be established.
Information flow Mapping
The main idea of this activity is to understand where the information rests, through which channels the information is transmitted, also to discuss the levels of security provided by these channels, and to associate data objects mapped in the previous activity in order to define key factors towards the construction of a data retention policy.