SAFEGUARDING AND
SECURITY PROTOCOLAFRICAN TECHNOLOGY POLICY STUDIES NETWORK (ATPS)DATE :

23 February 2024
PRESENTED BY :Daniel Gallego+254 020 2714092
info@atpsnet.org

AFRICAN TECHNOLOGY POLICY STUDIES NETWORK (ATPS)
8th Floor, Chancery Building, Valley Road
P. O. Box 10081-00100, Nairobi, Kenya
Email: execu�vedirector@atpsnet.org
Phone No: +254-202714092

SAFEGUARDING AND SECURITY PROTOCOLThe objec�ve of this security protocol is to establish a robust framework that ensures the protec�on,conﬁden�ality, integrity, and availability of sensi�ve informa�on, physical assets, and personnel andbeneﬁciaries of the African Technology Policy Studies Network (ATPS). By implemen�ng this protocol, ATPS
aims to mi�gate risks, prevent unauthorized access, safeguard data, and respond eﬀec�vely to security
incidents aﬀec�ng the ins�tu�on, its staﬀ, associates, network members, and project beneﬁciaries.
1. Governance and Risk Management:a) Establish a security governance structure with clearly deﬁned roles, responsibili�es, andaccountability for security-related maters.
b) Conduct regular risk assessments to iden�fy vulnerabili�es, threats, and risks to ATPS's informa�onsystems, physical facili�es, and personnel.
c) Develop and maintain a risk management plan that outlines risk mi�ga�on strategies, controls, andrisk treatment processes.
d) Con�nuously monitor and evaluate the eﬀec�veness of risk management ac�vi�es.
2. Physical Security:a) Implement physical security measures, including access control systems, surveillance cameras, andsecurity personnel, to protect ATPS's premises and assets.
b) Establish visitor management protocols to ensure authorized access and monitor visitor ac�vi�es.
c) Implement procedures for handling physical security incidents, including the�, unauthorized entry,
or emergencies, and conduct regular drills and training exercises.
d) Maintain an inventory of physical assets and conduct periodic audits to ensure their security.
1|ATPS Safeguarding and Security Protocol 2023

3. Informa�on Security:a) Develop and enforce an informa�on security policy that covers the protec�on, handling, storage,transmission, and disposal of sensi�ve informa�on.
b) Implement access controls, such as user authen�ca�on, authoriza�on mechanisms, and role-based
access controls, to ensure authorized access to systems and data.
c) Regularly update and patch so�ware systems, employ ﬁrewalls, intrusion detec�on systems, andencryp�on technologies to protect against cyber threats.
d) Conduct periodic security awareness training for employees and stakeholders to promote a securityconscious culture and educate them about common security risks and best prac�ces.
e) Establish incident response procedures to handle and report security incidents promptly, including
data breaches, malware infec�ons, or unauthorized access atempts.
f)Regularly back up cri�cal data and establish robust disaster recovery and business con�nuity plans.

4. Network Security:a) Implement secure network architecture, including segmented networks, network monitoring, andintrusion preven�on systems.
b) Employ strong network access controls, such as virtual private networks (VPNs), to protect datatransmited over public networks.
c) Regularly assess and update network security conﬁgura�ons, including routers, switches, andﬁrewalls.
d) Conduct periodic vulnerability assessments and penetra�on tes�ng to iden�fy and address network
vulnerabili�es.
5. Personnel Security:a) Implement a comprehensive personnel security program, including background checks,
conﬁden�ality agreements, and security awareness training.
b) Deﬁne clear security roles and responsibili�es for employees and ensure appropriate access controls
based on job roles and responsibili�es.
c) Establish processes for managing employee onboarding, o�oarding, and role changes to ensurethat access privileges are granted or revoked promptly.
d) Foster a culture of security awareness and accountability among employees through ongoingtraining and communica�on.
e) In case of insecurity incidences in the country of project implementa�on, the following needs to beconsidered and acted upon:•Use local security experts: Local security experts will be familiar with the speciﬁc security threatsin the country and will be able to provide guidance to the ATPS team through the Na�onal
Chapter Coordinators on how to mi�gate them.

2|ATPS Safeguarding and Security Protocol 2023

•Use secure communica�on channels: All communica�on related to the project should be
conducted using secure channels, such as encrypted email and chat applica�ons wherenecessary.

•Be aware of the poli�cal climate: The poli�cal climate in the country can change rapidly, so it isimportant to be aware of the latest developments and to adjust the security protocolaccordingly. ATPS Na�onal Chapter Coordinators will support in this.

•Have a con�ngency plan: In the event of a security incident, it is important to have a con�ngency
plan in place. This plan will outline the steps that will be taken to respond to the incident and tominimize the damage. ATPS will commit all resources available to implement this.

6. Third-Party Security:a) Perform due diligence on third-party vendors and partners to assess their security prac�ces before
engaging in any business rela�onship.
b) Establish and enforce contractual agreements that deﬁne security expecta�ons and requirements
for third par�es handling ATPS's data or systems.
c) Regularly review and monitor the security prac�ces of third-party vendors and conduct audits orassessments as needed.
7. Compliance and Legal Considera�ons:a) Ensure compliance with relevant laws, regula�ons, and standards pertaining to data protec�on,privacy, and security in the jurisdic�ons ATPS operates in.
b) Establish mechanisms to monitor and adapt to changes in applicable laws and regula�ons.
c) Maintain appropriate documenta�on, consent forms, and privacy policies to demonstratecompliance with data protec�on regula�ons.
8. Incident Management and Response:a) Develop an incident management plan that outlines procedures for detec�ng, repor�ng, andresponding to security incidents promptly.
b) Establish an incident response team responsible for coordina�ng and execu�ng incident responseac�vi�es.
c) Regularly conduct security incident drills and tabletop exercises to test the eﬀec�veness of incident
response plans and iden�fy areas for improvement.
d) Maintain incident logs, conduct post-incident reviews, and implement lessons learned to enhance
future incident response eﬀorts.
9. Con�nuous Improvement:a) Establish a process for ongoing monitoring, assessment, and improvement of ATPS's securityposture.
3|ATPS Safeguarding and Security Protocol 2023

b) Regularly review and update security policies, procedures, and controls to align with emerging
threats, technological advancements, and regulatory requirements.
c) Encourage feedback from employees, stakeholders, and security professionals to iden�fy areas forenhancement and address evolving security challenges.
10. Insurance Coverage:a) Assess the insurance needs of ATPS and obtain appropriate insurance coverage to mi�gate risks on
ATPS personnel, its associates’ ﬁnances associated with security incidents, including property
damage, data breaches, liability claims, and business interrup�on.
b) Consult with insurance professionals to iden�fy the speciﬁc types of insurance policies required, suchas property insurance, cyber liability insurance, professional liability insurance, and businessinterrup�on insurance.
c) Review and update insurance policies periodically to ensure they align with ATPS's evolving security
risks and opera�onal changes.
d) Maintain proper documenta�on of insurance policies, coverage limits, deduc�bles, and contact
informa�on for insurers.
e) Develop procedures for promptly repor�ng security incidents to insurers and ﬁling insurance claims
when necessary.
f)Conduct periodic reviews and assessments of insurance coverage to ensure it adequately addresses
ATPS's security risks and poten�al liabili�es.

11. Risk Transfer and Indemniﬁca�on:a) Establish contractual agreements with third-party vendors, partners, and service providers that
include provisions for risk transfer and indemniﬁca�on.
b) Include clauses that require third par�es to maintain adequate insurance coverage and provide proofof coverage.
c) Review and nego�ate indemniﬁca�on clauses to allocate risks appropriately and protect ATPS frompoten�al ﬁnancial losses resul�ng from third-party ac�ons or failures.
d) Consult with legal advisors to ensure the language in contracts eﬀec�vely transfers risk and provides
necessary protec�ons for ATPS.
12. Claims Handling and Recovery:a) Develop a claims handling process to streamline the repor�ng and resolu�on of insurance claims.
b) Designate a responsible individual or team within ATPS to oversee the claims handling process andliaise with insurers.
c) Maintain detailed records of security incidents and related damages or losses to support insurance
claims.
d) Collaborate with insurers during the claims process, providing all necessary documenta�on,evidence, and informa�on requested.

4|ATPS Safeguarding and Security Protocol 2023

e) Monitor the progress of insurance claims and follow up as needed to ensure �mely and fairresolu�on.
f)Develop a con�ngency plan to address poten�al gaps in insurance coverage, such as self-insurance
or alterna�ve risk management strategies, to mi�gate risks that cannot be fully transferred throughinsurance.

Note: This Security Protocol provides a founda�on for ATPS to develop detailed security policies, guidelines,
and prac�ces tailored to its speciﬁc needs and opera�ng environment. Regular assessments, employee
training, and con�nuous improvement eﬀorts are essen�al to ensure the eﬀec�veness of security measuresand adapt to evolving security risks.

5|ATPS Safeguarding and Security Protocol 2023

Contact Us+254 020 2714092
info@atpsnet.org
https://atpsnet.org/

8th Floor, The
Chancery, Valley
Rd, Nairobi,
Kenya