Scope of Work

• In Scope

• Out of Scope

  • IT/cybersecurity (unless directly linked to physical access)

  • Field operations outside the office

  • Personnel vetting/HR background checks 

Risk Framework

• Risk Rating Scale

• Game Theory Application

• Actor mapping — who are the plausible adversarial actors (disgruntled clients, third-party coercers, criminal opportunists, state actors, insider threats)?

• Dominant strategies — what is the most rational course of action for each actor given the current security posture?

• Payoff asymmetry — where does current security create insufficient cost/friction to deter action?

• Counter-strategy — what organizational responses alter the adversary's rational calculus?

Key Deliverables

1. Executive Summary (3–5 pages)

   1. Overall risk rating for the facility

   2. Top 5 prioritized findings

      1. Immediate actions required before the next operational day (if any)

2. Full Security Assessment Report

   1. Current state description (observation-based)

   2. Gap identification

   3. Risk rating (probability + impact)

   4. The threat actor most likely to exploit the gap

   5. Recommended mitigation measure(s)

   6. Cost estimate category (low/medium/high)

      1. Responsible party for implementation

3. Interview Room Security Protocol (standalone document)

   1. Room configuration standards — furniture placement, door opening direction, staff positioning relative to exit

   2. Pre-interview checklist — room clearance, panic device test, colleague notification

   3. Duress signal system — verbal and non-verbal protocols, staff response procedure

   4. Escalation ladder — from client agitation through staff concern to active incident

   5. Intern-specific protocols — buddy system required

   6. Post-incident procedure — reporting, staff support, room lockdown sequence

   7. Client dignity safeguards — balancing security measures against client experience

4. Prioritized Risk Register

5. Security Management Plan (SMP) Draft

   1. Daily opening/closing procedures

   2. Visitor and client management flow

   3. Key holder policy

   4. After-hours incident contacts

   5. Emergency communication tree

      1. Quarterly review schedule

6. Training Needs Assessment

Methodology

Specific Focus Area — Interview Rooms

• Physical Layout

  • Can staff exit the room without passing the client if needed?

  • Is there a secondary communication point (phone/alarm) visible to staff but not obstructive to the client?

  • Are there objects in the room that could be used as weapons of opportunity?

  • Is acoustic privacy sufficient to prevent corridor eavesdropping (client confidentiality risk as well as security risk)?

• Staffing Configuration

  • Is there a clear policy prohibiting solo interviews by interns?

  • Is there a colleague designated as a monitor during all interview sessions?

  • What is the response time from alert to the physical presence of a second staff member?

• Duress Systems

  • Is there a functioning duress alarm or panic button? If yes — tested when? Linked to what response?

  • Is there an agreed verbal duress code known to all staff AND interns?

  • Is the code refreshed regularly enough to prevent client community familiarity?

• Client Risk Profiling

  • Is there a pre-interview risk-flagging system for clients with a history of incidents?

  • Who has access to flag data, and when in the client journey does it appear?

  • Does the intake process screen for indicators of third-party coercion or external surveillance of the client?

Timeline

Reporting Line & Authorization

• Minimum 7 years of security management experience, with at least 3 years in Southwest Asia (Middle East) contexts

• Direct experience assessing NGO or humanitarian operations in urban environments

• Familiarity with Jordan's legal and regulatory framework for civil society organizations, including current Ministry of Social Development registration and foreign funding approval requirements

• Working knowledge of UNHCR, ICRC, GISF, or equivalent facility security standards

• Demonstrated competency in threat and risk assessment methodology (HEAT-equivalent or higher)

• No conflict of interest with the organization or its donor base

• Clearance/reference check completed prior to engagement

Conduct & Confidentiality

• The assessor shall sign a confidentiality agreement before accessing any facility, staff, or documentary information.

• All findings are for internal use only unless explicitly authorized for external sharing.

• Staff interviews shall be conducted on a no-attribution basis.

• The final report shall be stored in accordance with the organization's data protection policy.

• The assessor shall disclose any findings of immediate danger to the Operations Manager within 24 hours of identification, regardless of the overall reporting timeline.