About:
Addressing the "dark side" of digitalisation for NGOs. The target audience handles highly sensitive data but lacks the infrastructure of corporate entities, facing unique vulnerabilities that standard IT solutions cannot solve.
Category:
Service design
Client:
Centre for Integration of Foreigners (CIC)
Year:
2025
Location:
Prague, Czech Republic
Design framework:
Design thinking, human-centred security
Tools:
Miro, Notion, Figma, Google Suite, Typeform
Research
Define
Ideate
Outcome
The problem:
Small NGO, limited resources, handling high value sensitive data (residency status, legal documents). Paradox: critical need for security vs. zero IT infrastructure.
Goal:
To design and implement a sustainable security framework. The primary goal is to audit vulnerabilities and introduce effective data protection protocols that foster institutional trust.
My role:
Cybersecurity consultant and project lead (audit, risk assessment, human-centred strategy)
Methods:
•
Security audit and gap analysis
•
Stakeholder interviews
•
Risk assessment matrix
•
Data flow mapping
•
Vulnerability scanning
•
Security policy design
•
Implementation roadmap
•
Staff training materials
•
Impact evaluation
•
Feedback loops
Discovery
I started in the field, not in slides. Before designing any security measure, I needed to understand who CIC actually is, what data they hold, and where the human factor is most exposed. The goal was to capture real moments where a small NGO is most vulnerable, not to apply corporate frameworks blindly.
/01
Context & project scope
CIC holds data that can decide whether a person stays in the country, and protects it with the resources of a small non-profit: no IT department, no security budget.
The Centre for Integration of Foreigners is a critical support hub for migrants in the Czech Republic, managing highly sensitive personal and legal data. Unlike large corporations, it runs lean, without dedicated security staff. That mismatch, high-value data on minimal protection, is the paradox this project set out to address.
/02
Discovery and mindset
My baseline approach combined Design Thinking with the principles of Human-Centred Security. Rather than starting from technology, I started from people: their needs, habits, and limitations.
The goal was never a purely technical fix. I was interested in the moments where a well-meaning person makes a natural mistake, and in designing measures that are understandable, realistic to follow, and that encourage secure behaviour instead of fighting it.
/03
Why CIC?
CIC was a deliberate choice, not a convenient one.
Vulnerable users. Stronger security protects the clients directly and reinforces the institutional trust they rely on.
Practical fit. As a smaller NGO without extensive IT, CIC is exactly the kind of organisation that needs accessible, low-overhead measures.
Real-world grounding. The collaboration was formalised, so the outputs had to be practically applicable, not theoretical.
/04
Hypotheses
Before interviewing anyone, I wrote down what I expected to be wrong. I formulated twelve hypotheses about typical NGO vulnerabilities, from password habits to a missing incident plan, so I had something concrete to test instead of vague assumptions.
/05
Survey distribution
To test those hypotheses against reality, I built an entry audit questionnaire and distributed it to senior management and across the organisation. The aim was to read CIC's actual security maturity: what was already in place, what worked, and where they themselves sensed the weaknesses.
Form detail
/06
Confirmed hypotheses
The survey data confirmed six of the twelve hypotheses. These six validated vulnerabilities, grounded in the organisation's own answers rather than in my assumptions, became the input for the define phase.
Define
After collecting evidence in the field, I distilled the work into a clear problem picture. This phase focused on naming what truly breaks cybersecurity for a small NGO, and translating scattered findings into a prioritised list and a single design challenge the team could act on.
/01
MoSCoW analysis
Based on the audit responses, I categorised the identified security gaps using the MoSCoW method. This clarified what the organisation must address immediately versus what can be planned for the future. The absolute "Must-Haves" were password management, staff training, and an incident response plan.
/02
Design challenge
Ideate
Research told us where the service was breaking. The next step was to turn those findings into ideas the organisation could actually run with. The constraint was clear: any solution had to be simple enough for a small NGO to adopt without dedicated IT support.
/01
Brainwriting and "How Might We"
I broke the single design challenge into three sharper How Might We questions, one for each priority area: passwords, training, and incident response. Narrowing it this way made the problem workable. Through brainwriting I then generated low-barrier ideas for each, from introducing a password manager with easy onboarding, to a one-page incident cheat sheet, to simulated phishing exercises.
/02
Lean Canvas
To pressure-test the handbook as a real intervention and not just a deliverable, I mapped it onto a Lean Canvas. It forced me to be explicit about who it serves, what makes it different, how it reaches people, and how success would be measured, even though this was never a commercial product. The value sits in resilience, not revenue: fewer incidents, lower long-term cost, and a team that knows what to do.
/03
Validation interview
Before finalising the proposal, I ran a validation interview with CIC management over a Teams call. I walked them through the problem and the possible solutions, and together we checked that the measures matched their real capacity. They decided to go ahead with the handbook, and we prioritised the top three problems to solve:
Passwords and their management.
A security recommendation brochure for onboarding and offboarding.
A step-by-step guide in case of a cyber attack.
Deliver
Instead of overwhelming the NGO with complex corporate software, the solution takes the form of a tailored Digital Security Guide, based on the Cyber Compass framework. The output is something CIC can actually use, update, and integrate into their daily routine.
/01
Solution architecture
The Digital Security Guide is delivered as open data, allowing the organisation to easily update the content in the future. It is highly practical and directly integrated into the employee onboarding process.
/02
Key metrics for success
Adoption. The number of staff and volunteers who receive the guide.
Integration. Whether the guide is integrated into standard onboarding.
Error reduction. A measurable reduction in critical errors such as weak passwords.
/03
The product
A simple, visually appealing, and easily understandable security brochure available in both digital (PDF) and printed formats. It works as a single, trusted source of truth for staff, removing confusion about correct practices.
Download
Outcome
/01
Impact
Introducing standardised password managers reduces the most critical vector for human error. Checklist protocols for onboarding and offboarding ensure a clean asset and access audit trail. Having a documented incident response plan reduces operational chaos and speeds up recovery from future breaches, ultimately protecting client trust.
/02
What I learned
The most crucial insight was prioritising human factor analysis over purely technical solutions. The project validated that corporate security frameworks can be adapted for resource-constrained NGOs by focusing on human-centreed design and iterative feedback, transforming abstract concepts into practical, adopted tools.
/03
Next steps
Adoption tracking. Introduce basic systems to track guide adoption. Monitor how many staff and volunteers have implemented the primary recommendations, such as setting up a password manager.
Regular awareness training. Implement simplified, recurring security awareness training, including basic simulated phishing campaigns to teach threat recognition through practical, non-punitive examples.
Secondary policy wave. Address identified gaps from the initial MoSCoW analysis (advanced cloud data management, penetration testing) once the foundational measures have stabilised.
Feedback loop. Establish a structured system to collect ongoing feedback from staff about the guide's usability. Use this data for periodic, small-scale iterations to improve content clarity and relevance.
© More works
(WDX®)
digital design
© help centre
(WDX)
clarification
Let’s talk