Skip to content

6 min read

Protection Planning

Summary

Protection planning is the organisational discipline of mapping threats, vulnerabilities, and capacities for a social organisation or a defender at risk, then translating that map into a written protection plan that integrates digital, physical, psychosocial, and legal dimensions and is built into the group’s structures rather than improvised under crisis.

Body

Protection planning names the analytical and operational discipline that human-rights organisations, defender networks, and high-risk collectives use to keep their members and their work safe in environments where state, paramilitary, corporate, or criminal actors are hostile. The classical frame, codified by Front Line Defenders and Tactical Tech’s Holistic Security Manual, is the threats × vulnerabilities ÷ capacities matrix: identify what could harm the organisation or the defender (threats), identify what makes the organisation or defender susceptible to that harm (vulnerabilities), and identify what resources the organisation has to prevent or absorb the harm (capacities) [source: front-line-protection-template] [source: holistic-security-tactical-tech]. The Comité Cerezo’s Spanish-language Manual de seguridad para organizaciones sociales operationalises that frame for the Mexican and Central American context and walks a facilitator through the workshop arc: a diagnóstico colectivo (collective diagnosis of the group’s situation and the threats it faces), the structured risk analysis, the mapping of amenazas against vulnerabilidades and capacidades, and the construction of a written security plan that integrates digital, physical, psychosocial, and legal dimensions [source: comite-cerezo-seguridad-organizaciones]. What the Comité Cerezo’s manual adds to the holistic-security corpus is the framing of seguridad integral — security that is colectiva (not the responsibility of one individual but of the whole group) and organizativa (built into the group’s structures, communication trees, decision protocols, and care practices, not improvised under crisis) — and the specific attention to the political context of Mexican social movements (state surveillance, paramilitary groups, criminal organisations, gender-based violence against women defenders). Protection planning is therefore inseparable from collective-care and from the psychosocial-wellbeing work that the IM-Defensoras Autocuidado / Travesías resource operationalises for women defenders in Mesoamerica: a security plan that does not include the care infrastructure for the defenders who carry the plan will not survive the first crisis [source: im-defensoras-autocuidado]. A common failure mode is to treat protection planning as a one-off document produced after an incident rather than as a living organisational discipline — the plan sits in a folder until the next threat materialises, by which point the named owners have changed and the documented procedures are stale. The discipline the Comité Cerezo manual imposes is that the plan is reviewed every cycle, the named owners are real and current, and the procedures are rehearsed rather than merely documented.

Use it for

Designing a security workshop for a Mexican or Central American social organisation; running a diagnóstico colectivo of threats, vulnerabilities, and capacities; constructing an organisational security plan that integrates digital, physical, psychosocial, and legal dimensions; integrating protection planning with collective-care practices inside a high-risk defender network.

Worked examples

  • nigeria-endsars-2020 — the post-EndSARS protection-planning retrospective; the campaign’s protection planning was implicit (peer-led encrypted channels) rather than explicit, and the post-incident review produced the protection-planning discipline now standard in Nigerian youth movements.
  • mothers-of-the-plaza-de-mayo-campaign-for-democracy-and-the — the Mothers’ protection planning under Argentine military dictatorship: rotating marchers, named responsible persons, encrypted communication, and the formal collective-care discipline that kept the campaign alive across years.
  • collective-care — the care infrastructure that a protection plan must integrate to survive its first crisis.
  • digital-security — the digital dimension of a holistic protection plan.
  • holistic-security-tactical-tech — the broader corpus that protection planning sits inside.

FAQ

What is protection planning?

Protection planning is the organisational discipline of mapping threats, vulnerabilities, and capacities for a social organisation or a defender at risk, then translating that map into a written protection plan that integrates digital, physical, psychosocial, and legal dimensions and is built into the group’s structures rather than improvised under crisis [source: front-line-protection-template]. It is the analytical and operational discipline that human-rights organisations, defender networks, and high-risk collectives use to keep their members and their work safe in environments where state, paramilitary, corporate, or criminal actors are hostile.

What is the threats-vulnerabilities-capacities matrix?

The classical frame, codified by Front Line Defenders and Tactical Tech’s Holistic Security Manual, is the threats × vulnerabilities ÷ capacities matrix: identify what could harm the organisation or the defender (threats), identify what makes the organisation or defender susceptible to that harm (vulnerabilities), and identify what resources the organisation has to prevent or absorb the harm (capacities) [source: front-line-protection-template], [source: holistic-security-tactical-tech]. The matrix is the diagnostic that the protection plan is built from.

How does the Comité Cerezo’s Spanish-language manual extend the frame?

The Comité Cerezo’s Spanish-language Manual de seguridad para organizaciones sociales operationalises the frame for the Mexican and Central American context and walks a facilitator through the workshop arc: a diagnóstico colectivo (collective diagnosis of the group’s situation and the threats it faces), the structured risk analysis, the mapping of amenazas against vulnerabilidades and capacidades, and the construction of a written security plan [source: comite-cerezo-seguridad-organizaciones]. What the manual adds is the framing of seguridad integral — security that is colectiva (not the responsibility of one individual but of the whole group) and organizativa (built into the group’s structures, communication trees, decision protocols, and care practices, not improvised under crisis).

What worked examples illustrate the discipline?

The Mothers’ protection planning under Argentine military dictatorship is a worked example: rotating marchers, named responsible persons, encrypted communication, and the formal collective-care discipline that kept the campaign alive across years [source: front-line-protection-template]. The post-EndSARS Nigerian protection-planning retrospective is a worked example of an implicit discipline (peer-led encrypted channels) made explicit after an incident.

Open Questions

How to keep the protection-planning discipline alive in organisations that have not yet experienced a major incident — the documentation tends to be most thorough precisely when it is too late to be useful.

Sources & verification

Last verified: 2026-07-09