​

Pilot Pack & Data Readiness Guide

​

Table of Contents

1. Introduction
2. Minimum Viable Dataset (MVD)
3. Data Gathering Workflow
4. Taxonomy Crosswalk
5. Data Gathering Templates
6. Validation Checklist
7. Import/Export Guidance
8. Pilot Workshop Facilitation
9. Self-Service Instructions
10. Success Indicators
11. Feedback Collection
12. Troubleshooting Guide

​

1. Introduction

​

1.1 Purpose

• Primary: GISF pilot facilitators running NGO pilot workshops
• Secondary: NGO security managers, finance staff, and operations coordinators preparing data independently

​

1.2 What’s Included

​

1.3 Time Estimates

​

1.4 Key Success Factors

• Clear communication of MVD requirements before pilot session
• Structured agenda with defined milestones
• Anticipation of common questions and edge cases

• Access to historical incident and cost data (≥12 months)
• Multi-stakeholder team (security, finance, operations)
• Openness to discussing qualitative outcomes (access, continuity, acceptance, wellbeing)

​

2. Minimum Viable Dataset (MVD)

​

2.1 MVD Definition

​

2.2 MVD Validation Examples

​

3. Data Gathering Workflow

​

3.1 Overview

​

3.2 Step 1: Identify Data Sources

• Financial records (incident response costs, evacuation expenses, equipment replacement)
• Insurance claims (theft, damage, medical evacuation, ransom payments)
• HR records (staff injuries, evacuations, kidnappings, medical costs)
• IT security logs (cyberattacks, data breaches, recovery costs)
• Program disruption records (delays, cancellations, reputational response costs)
• Regional security databases (GISF, INSO, EISF) for scenario preset validation

• Annual budgets (security line items)
• Procurement records (equipment, training, assessments)
• HR payroll data (security personnel salaries)

​

3.3 Step 2: Gather Historical Costs OR Select Scenario Preset

• Direct Costs: Equipment replacement, medical expenses, ransom payments, evacuation costs
• Indirect Costs: Program delays, reputational response, legal fees, staff replacement
• Recovery Costs: IT system restoration, facility repairs, security assessments

• Routine security costs (guarding, training, equipment maintenance)
• Insurance premiums (unless specifically for incident response)
• General operational costs not directly related to incidents

Year 2024 Total Incident Costs: $________
- Direct costs: $________
- Indirect costs: $________
- Recovery costs: $________

Year 2023 Total Incident Costs: $________ (if available)
Year 2022 Total Incident Costs: $________ (if available)

• Stable governance, urban operations
• Less than 2 security incidents per year
• Strong state security presence

• Mixed stability, sporadic violence
• Remote programming, local partners
• Limited infrastructure, supply chain fragility

• Persistent insecurity, frequent incidents
• Armed actor presence in program areas
• Regular evacuations, high staff turnover risk

​

3.4 Step 3: Categorize Costs (budgets, invoices)

• Annual budgets (security line items)
• Procurement records (equipment, training, assessments)
• HR payroll data (security personnel salaries)
• Financial reports (CAPEX/OPEX categorization)
• Grant proposals (donor-funded security programs)

​

3.5 Step 4: Define Assumptions (time horizon)

• Strategic planning documents (multi-year program timelines)
• Previous cost-benefit analyses (social impact proxies, SROI precedents)

​

3.6 Step 5: Validate Completeness (MVD checklist)

​

3.7 Worked Example: Historical Cost Baseline

• Vehicle theft and equipment replacement: $25,000
• Staff evacuation due to security threat: $15,000
• Office break-in and equipment damage: $8,000
• Cyberattack recovery costs: $12,000
• Total 2024: $60,000

• Vehicle accident and medical costs: $18,000
• Office burglary and equipment theft: $6,000
• Staff kidnapping ransom and evacuation: $45,000
• Total 2023: $69,000

• Vehicle theft: $20,000
• Office break-in: $5,000
• Cyberattack: $8,000
• Total 2022: $33,000

Baseline EAL = (2024 + 2023 + 2022) / 3
Baseline EAL = ($60,000 + $69,000 + $33,000) / 3
Baseline EAL = $162,000 / 3 = $54,000

• Intervention Type: Comprehensive SRM Program
• Estimate Type: Moderate (50% reduction)
• Expected Annual Savings: $54,000 × 0.5 =$27,000

• Year 1: Physical security upgrades ($25,000), Training ($8,000), Personnel ($30,000) =$63,000
• Year 2: Ongoing training ($5,000), Personnel ($32,000) = $37,000
• Year 3: Ongoing training ($5,000), Personnel ($34,000) = $39,000
• Total Investment: $139,000

• Total Benefits (3 years): $27,000 × 3 =$81,000
• ROI: (($81,000 -$139,000) / $139,000) × 100 = -41.7%
• Payback Period: Not achieved within 3 years

​

4. Taxonomy Crosswalk

​

4.1 Historical Cost Categories

​

4.2 Cost Category Taxonomy

​

5. Data Gathering Templates

​

5.1 Historical Cost Data Worksheet

• Direct costs (equipment, medical, ransom): $________
• Indirect costs (delays, reputation, legal): $________
• Recovery costs (IT restoration, repairs): $________
• Total 2024: $________

• Direct costs: $________
• Indirect costs: $________
• Recovery costs: $________
• Total 2023: $________

• Direct costs: $________
• Indirect costs: $________
• Recovery costs: $________
• Total 2022: $________

​

5.2 Scenario Preset Selection Worksheet

• Stable governance, urban operations
• Less than 2 security incidents per year
• Strong state security presence

• Mixed stability, sporadic violence
• Remote programming, local partners
• Limited infrastructure, supply chain fragility

• Persistent insecurity, frequent incidents
• Armed actor presence in program areas
• Regular evacuations, high staff turnover risk

​

5.3 Investment Cost Worksheet

• Personnel: $________
• Training: $________
• Physical Security: $________
• Technology: $________
• Assessments: $________
• Other: $________
• Total Year 1: $________

• Personnel: $________
• Training: $________
• Maintenance: $________
• Other: $________
• Total Year 2: $________

• Personnel: $________
• Training: $________
• Maintenance: $________
• Other: $________
• Total Year 3: $________

​

6. Validation Checklist

​

6.1 Pre-Pilot Data Quality Check

• At least 1 year of incident cost data available OR scenario preset selected
• Direct costs included (equipment, medical, ransom, evacuation)
• Indirect costs included (delays, reputation, legal)
• Recovery costs included (IT restoration, repairs)
• Routine security costs excluded (guarding, training, maintenance)

• At least 3 cost line items identified
• Initial investment costs captured (Year 1)
• Ongoing operational costs captured (Years 2-3)
• CAPEX/OPEX categorization completed
• Cost categories match taxonomy (see Section 4.2)

• Time horizon defined (recommended: 3 years)
• Stakeholders identified (security, finance, operations)
• Data sources documented

​

6.2 MVD Compliance Check

• Historical costs ≥$5,000 OR scenario preset selected
• Investment costs ≥3 line items
• Time horizon ≥1 year
• Key stakeholders available for pilot

• 2-3 years of historical cost data
• 5+ investment cost line items
• Qualitative impact assessment included
• Multi-stakeholder team (security, finance, operations)

​

7. Pilot Workshop Facilitation

​

7.1 Workshop Agenda (2-3 hours)

• Welcome and introductions
• Review objectives and expected outcomes
• Confirm data availability and MVD compliance

• Step 1: Enter historical costs OR select scenario preset
• Step 2: Select intervention type and reduction rate
• Step 3: Enter investment costs
• Step 4: Define assumptions (time horizon)
• Step 5: Complete qualitative assessment (optional)

• Review ROI calculation and breakdown
• Discuss qualitative impact index
• Identify areas for refinement

• Export results (PDF/Excel)
• Schedule follow-up for questions
• Plan for implementation or refinement

​

7.2 Facilitation Tips

• Send data gathering templates 1 week in advance
• Confirm MVD compliance via pre-workshop call
• Prepare backup scenario presets for organizations without historical data

• Start with historical cost data (most reliable)
• Use scenario presets as fallback when needed
• Encourage discussion of qualitative impacts
• Document assumptions and rationale

• Send exported results within 24 hours
• Schedule follow-up call for questions
• Collect feedback on calculator usability

​

8. Self-Service Instructions

​

8.1 Quick Start Guide

1. Gather Historical Costs
   • Collect total incident costs for 1-3 recent years
   • Include direct, indirect, and recovery costs
   • Exclude routine security costs
2. Select Intervention Type
   • Choose: Physical Security, Training, Technology, or Comprehensive
   • Select confidence level: Conservative, Moderate, or Optimistic
3. Enter Investment Costs
   • List initial investment (Year 1)
   • Include ongoing costs (Years 2-3)
   • Categorize as CAPEX or OPEX
4. Review Results
   • Check ROI calculation and breakdown
   • Review qualitative impact index
   • Export results for stakeholders

1. Select Scenario Preset
   • Choose operational context that best matches your organization
   • Low-risk, Medium-risk, or High-risk environment
   • Override with custom baseline if needed
2. Follow Steps 2-4 above

​

8.2 Common Questions

​

9. Success Indicators

​

9.1 Pilot Success Criteria

• Historical cost data OR scenario preset selected
• Investment costs captured with appropriate detail
• Assumptions documented and justified

• Multi-stakeholder team engaged (security, finance, operations)
• Data sources identified and validated
• Assumptions discussed and agreed

• ROI calculation completed successfully
• Results exported and shared with stakeholders
• Qualitative impact assessment included

​

9.2 User Experience Indicators

• Calculator completed in less than 30 minutes
• Historical cost approach understood and accepted
• Scenario presets found useful when historical data unavailable

• ROI calculation considered credible
• Qualitative impact index valued
• Results suitable for decision-making

• Organization would use calculator independently
• Results would be shared with donors/leadership
• Calculator would be recommended to other NGOs

​

10. Feedback Collection

​

10.1 Post-Pilot Feedback Form

• How easy was it to gather historical cost data? (1-5 scale)
• Were the scenario presets helpful? (Yes/No)
• How long did data preparation take? (hours)

• How easy was the calculator to use? (1-5 scale)
• How long did the calculation take? (minutes)
• Were the results clear and understandable? (1-5 scale)

• How confident are you in the ROI calculation? (1-5 scale)
• Was the qualitative impact index valuable? (Yes/No)
• Would you use these results for decision-making? (Yes/No)

• What would improve the calculator?
• What additional features would be helpful?
• Would you recommend this tool to other NGOs? (Yes/No)

​

10.2 Feedback Analysis

• Average completion time
• User satisfaction scores
• Data quality issues
• Feature requests
• Adoption potential

• Completion time less than 30 minutes
• User satisfaction ≥4/5
• Confidence in results ≥4/5
• Recommendation rate ≥80%

​

11. Troubleshooting Guide

​

11.1 Common Issues and Solutions

• Solution: Use scenario presets based on operational context
• Alternative: Conduct cost estimation workshop using incident reports and insurance claims

• Solution: Verify data includes all incident types (direct, indirect, recovery costs)
• Alternative: Use scenario preset as validation check

• Solution: Use “Other” category with descriptive notes
• Guidance: Focus on capturing all costs rather than perfect categorization

• Solution: This is normal for many security investments
• Guidance: Emphasize qualitative benefits and long-term risk reduction

• Solution: Use conservative estimates and document rationale
• Alternative: Allow custom reduction rates with justification

​

11.2 Data Quality Issues

• Use scenario presets as fallback
• Document data limitations in assumptions
• Consider partial cost estimation

• Focus on major cost items first
• Add detail in follow-up sessions
• Use estimates for minor items

• Default to conservative estimates
• Document all assumptions
• Review with stakeholders

​

12. References

​

12.1 Methodology References

• Methods Note: NGO Security Risk Management ROI Calculator (Section 3: Historical Cost Baseline)
• Data Schema: Data Schema & Codebook (Sections 3.2-3.4: New Entity Schemas)
• Scenario Presets: Evidence-based baseline EAL estimates by operational context
• Reduction Rates: Evidence-based risk reduction ranges by intervention type

​

12.2 Supporting Documentation

• Pilot Pack: This document - Data readiness and facilitation guide
• Quick Start Guide: Step-by-step instructions for self-service use
• Validation Report: Formula validation and baseline testing results
• Focus Group Plan: User feedback collection methodology

​

12.3 External References

• ISO 31000:2018: Risk Management Guidelines
• GISF Research: Member survey results and incident data
• Humanitarian Outcomes: AWSD trend analysis and benchmarks
• FAIR Framework: Factor Analysis of Information Risk (adapted for NGO context)