Scope of Work, Key Deliverables, and Methodology

Scope of Work




• In Scope




Domain	Specific Areas
Physical perimeter	Exterior doors, security door systems, gate/barrier assessment, CCTV coverage, lighting, blind spots
Access control	Entry protocols, visitor management, and tailgating vulnerabilities
Reception & waiting areas	Client flow, separation from staff-only zones, sight lines, furniture placement
Interview rooms	Door configurations, furniture layout, acoustic privacy, sight lines, and duress protocols
Staff-only zones	Staff offices, HR & Finance files, communications equipment
Emergency systems	Fire, evacuation routes, muster points, first aid, communication trees
Intern & staff protocols	Briefing adequacy, lone worker risk, incident reporting, and de-escalation training coverage
Information security (physical)	Document handling, clean desk, screen visibility from client areas
External threat environment	Neighborhood risk profile, historical incident mapping within a 500m radius
Game-theory threat mapping	Adversarial actor analysis — who benefits from compromising this office, and how

• Out of Scope

  • IT/cybersecurity (unless directly linked to physical access)

  • Field operations outside the office

  • Personnel vetting/HR background checks

  
  

  Risk Framework

  
  

  • Risk Rating Scale

  
  

  Rating	Probability	Impact	Required Response Timeline
  CRITICAL	Likely–Almost Certain	Severe	Immediate (within 72 hours)
  HIGH	Possible–Likely	Major	Within 2 weeks
  MEDIUM	Unlikely–Possible	Moderate	Within 60 days
  LOW	Rare–Unlikely	Minor	Next planning cycle

  
  
  

  • Game Theory Application

  
  

  • Actor mapping — who are the plausible adversarial actors (disgruntled clients, third-party coercers, criminal opportunists, state actors, insider threats)?

  • Dominant strategies — what is the most rational course of action for each actor given the current security posture?

  • Payoff asymmetry — where does current security create insufficient cost/friction to deter action?

  • Counter-strategy — what organizational responses alter the adversary's rational calculus?

  
  

  Key Deliverables

  
  

  1. Executive Summary (3–5 pages)

     1. Overall risk rating for the facility

     2. Top 5 prioritized findings

        1. Immediate actions required before the next operational day (if any)

  2. Full Security Assessment Report

     1. Current state description (observation-based)

     2. Gap identification

     3. Risk rating (probability + impact)

     4. The threat actor most likely to exploit the gap

     5. Recommended mitigation measure(s)

     6. Cost estimate category (low/medium/high)

        1. Responsible party for implementation

  3. Interview Room Security Protocol (standalone document)

     1. Room configuration standards — furniture placement, door opening direction, staff positioning relative to exit

     2. Pre-interview checklist — room clearance, panic device test, colleague notification

     3. Duress signal system — verbal and non-verbal protocols, staff response procedure

     4. Escalation ladder — from client agitation through staff concern to active incident

     5. Intern-specific protocols — buddy system required

     6. Post-incident procedure — reporting, staff support, room lockdown sequence

     7. Client dignity safeguards — balancing security measures against client experience

  4. Prioritized Risk Register

  5. Security Management Plan (SMP) Draft

     1. Daily opening/closing procedures

     2. Visitor and client management flow

     3. Key holder policy

     4. After-hours incident contacts

     5. Emergency communication tree

        1. Quarterly review schedule

  6. Training Needs Assessment

  
  
  

  Methodology

  
  

  Method	Purpose
  Physical walkthrough	Full facility inspection, minimum two passes (announced and unannounced)
  Structured staff interviews	Minimum 80% of staff, all interns, confidential format
  Document review	Existing SOPs, incident logs, etc
  Observation periods	Morning arrival, client-peak hours, end-of-day — minimum one session each
  Simulated access test	Attempt to access staff-only areas using client pathways (with management consent)
  Neighborhood assessment	500m perimeter walk, local incident history review via OSINT and community sources
  Red team scenario modeling	Three adversarial scenarios gamed against the current security posture

  
  

  Specific Focus Area — Interview Rooms

  
  

  • Physical Layout

    • Can staff exit the room without passing the client if needed?

    • Is there a secondary communication point (phone/alarm) visible to staff but not obstructive to the client?

    • Are there objects in the room that could be used as weapons of opportunity?

    • Is acoustic privacy sufficient to prevent corridor eavesdropping (client confidentiality risk as well as security risk)?

    • Staffing Configuration

      • Is there a clear policy prohibiting solo interviews by interns?

      • Is there a colleague designated as a monitor during all interview sessions?

      • What is the response time from alert to the physical presence of a second staff member?

      • Duress Systems

        • Is there a functioning duress alarm or panic button? If yes — tested when? Linked to what response?

        • Is there an agreed verbal duress code known to all staff AND interns?

        • Is the code refreshed regularly enough to prevent client community familiarity?

        • Client Risk Profiling

          • Is there a pre-interview risk-flagging system for clients with a history of incidents?

          • Who has access to flag data, and when in the client journey does it appear?

          • Does the intake process screen for indicators of third-party coercion or external surveillance of the client?

Timeline and Reporting

Timeline




Phase	Activity	Duration
Mobilization	Contracting, briefing, document provision	Days 1–2
Field Assessment	Physical inspection, interviews, observation	Days 3–7
Analysis	Risk scoring, source triangulation, scenario modeling	Days 8–9
Reporting	Draft report, protocols, risk register	Days 10–12
Review & Finalization	Management review, assessor response to queries	Days 13–15
Debrief	Presentation to Country Director	Day 16







Reporting Line & Authorization




Role	Responsibility
Operations Manager	Day-to-day liaison with assessor, provides access and documentation, receives final report
Senior Security Officer (Assessor)	Conducts assessment, produces all deliverables

Qualifications

• Minimum 7 years of security management experience, with at least 3 years in Southwest Asia (Middle East) contexts

• Direct experience assessing NGO or humanitarian operations in urban environments

• Familiarity with Jordan's legal and regulatory framework for civil society organizations, including current Ministry of Social Development registration and foreign funding approval requirements

• Working knowledge of UNHCR, ICRC, GISF, or equivalent facility security standards

• Demonstrated competency in threat and risk assessment methodology (HEAT-equivalent or higher)

• No conflict of interest with the organization or its donor base

• Clearance/reference check completed prior to engagement




Conduct & Confidentiality




• The assessor shall sign a confidentiality agreement before accessing any facility, staff, or documentary information.

• All findings are for internal use only unless explicitly authorized for external sharing.

• Staff interviews shall be conducted on a no-attribution basis.

• The final report shall be stored in accordance with the organization's data protection policy.

• The assessor shall disclose any findings of immediate danger to the Operations Manager within 24 hours of identification, regardless of the overall reporting timeline.

0 - 2500 USD