Answer plain-language prompts about source contact, accounts, devices, pre-publication files, and escalation paths, then download a filled PDF for newsroom discussion.
Use this guided checklist before a sensitive investigation, after a staffing change, or when deciding whether you need a tip line, private workspace, or deeper security review.
Start by deciding how sources should contact reporters at different risk levels.
List the channels your newsroom expects reporters to use: email, phone, Signal, in-person, legal channel, anonymous tip line, or something else.
Example: Routine tips use email; sensitive sources use Signal or in-person; anonymous document submissions are not yet supported.
Every channel has limits. Email has metadata. Phone numbers can identify people. Personal devices may not be controlled by the newsroom.
Example: Reporters know Signal is better for sensitive conversations, but we have not documented when email is acceptable.
Shared inboxes should have MFA, named owners, limited access, and recent review.
Example: Needs work: the tips inbox has MFA, but access has not been reviewed since last year.
Before asking a high-risk source to send material, decide who handles intake, what channel is used, and where files go.
Example: Editor approves the intake plan first; source contact starts on Signal; files go into a restricted workspace.
Source protection breaks down if newsroom accounts and devices are easy to compromise.
Include email, file storage, publishing, password manager, social accounts, and admin accounts.
Example: Done for email and files; Needs work for social accounts.
Unique passwords matter most for source-facing and publishing systems.
Example: Not sure: some staff use a password manager, but freelancers are not covered.
Look for OS updates, disk encryption, screen lock, basic malware protection, and a plan for lost or suspicious devices.
Example: Needs work: staff laptops are updated, but freelancer devices are unmanaged.
Review files, accounts, workspaces, shared devices, publishing systems, and source-facing inboxes.
Example: Not sure: full-time staff offboarding is tracked, but contractors are inconsistent.
Drafts, source notes, FOIAs, claims, timelines, and web captures need a clear home.
Name the approved place for drafts, FOIAs, notes, claims, timelines, web captures, and sensitive files.
Example: Sensitive investigations use a private project workspace with limited access, not personal drives or ad hoc links.
Personal storage makes access, retention, and source protection harder to explain.
Example: Needs work: some reporters still keep interview files in personal cloud folders.
Sensitive files should not be open to the whole newsroom by default.
Example: Done: each investigation has a restricted folder approved by the editor.
Decide whether materials are archived, exported, restricted, or deleted, and who approves it.
Example: Editor and legal review the project folder; final evidence is archived; temporary exports are deleted.
These answers help the newsroom avoid improvising during a source, device, leak, or legal concern.
Name the first person or role, the first action, and what should not happen.
Example: Editor-in-chief is called first; pause outreach; do not discuss source identity in broad channels.
Avoid wiping evidence too soon. Decide who helps contain, preserve evidence, and protect accounts.
Example: Reporter stops using the device, calls the security contact, preserves screenshots, and resets key account sessions from another device.
Name who coordinates the response and what information should be gathered before public speculation.
Example: Managing editor coordinates; collect file names, access list, timestamps, and last known changes before notifying the wider team.
Define responders, first-hour steps, and playbooks for account, device, and leak scenarios.
Choose the right validation work when a newsroom needs proof its controls hold up.
Worksheets, checklists, templates, and buyer guides for small teams improving security.
Secure Origin helps newsrooms and press freedom teams choose the right next step: Protect Devices for staff endpoints, Protect People for account risk, Protect The Organization for reporting workflows, Security Testing & Validation for proof, or a managed workspace for sensitive collaboration.