There are many ways of responding promptly to a security incident. The following steps have been formulated in terms of when and how to react from the moment a security incident is reported, while it is happening, and after it is over.

Step 1: Reporting the incident.

• What is happening/has happened (try to focus on the actual facts)?
• Where and when did it take place?
• Who was involved (if it can be established)?
• Was there any injury or damage to individuals or property?

Step 2. Decide when to react.

There are three possibilities:

• An immediate reaction is required to attend to people with injuries or stop an attack.
• A rapid reaction (in the next few hours or even days) is necessary to prevent possible new security incidents from arising.
• A follow up action (in several days or weeks or even months): If the situation has stabilised, an immediate or rapid reaction may not be necessary. However, any security incident that requires an immediate or rapid reaction must be followed by a follow up action in order to restore or review your working environment.

Step 3. Decide how to react and what your objectives are.

• If the reaction has to be immediate, the objectives are clear: Attend to injuries and/or prevent another attack.
• If the reaction has to be quick, the objectives will be established by the person in charge or a crisis team (or similar) and focus on restoring the necessary security for those affected by the incident.

Subsequent actions/reactions will take place through the organisation’s normal decision-making channels, with the objective of restoring a safe working environment externally, as well as re-establishing internal organisational procedures and improving subsequent reactions to security incidents.

Any reaction also has to take into account the security and protection of other people or organisations or institutions with which you have a working relationship.

Establish your objectives before taking action.
Prompt action is important, but knowing why are
you taking action is more important. By first establishing
what you want to achieve (objectives), you can decide how to achieve it (course of action).

For instance:

If a defenders´ group has news that one of their colleagues has not duly arrived to her destination in a town, they may start a reaction by calling a hospital and calling their contacts in other NGOs and a nearby UN Office and police. But before starting those calls, it is very important to establish what you want to achieve and what you are going to say. Otherwise you may generate an unnecessary alarm (imagine that the defender was just delayed because they missed a bus and forgot to call the office) or a reaction opposite to the one intended.