37 CARDS
FC 00 · METHOD · v1.0 — FC FAMILY
SENTIRASFC 00 · METHOD · v1.0
THE SENTIRAS SWEEP CYCLE
Core eight-step method for every inspection.

ALL PROCEDURESMETHODVERIFY FIRSTAUTHORIZED USE
8-STEP PROCEDURE
01PREPARE — scope, authority, tools
02BASELINE — normal devices, layout
03INSPECT — slow visual pass
04DETECT — tools support observations
05DOCUMENT — photograph and log
06VERIFY — repeat and confirm
07RESPOND — act by risk level
08REVIEW — findings, owners, next steps
SIGNAL NOTES
FALSE POSITIVES

Normal electronics, known infrastructure, building systems, environmental noise.

ESCALATE IF

Safety unclear, finding unverified, red risk level, professional review needed.

VERIFY BEFORE CONCLUDING
STOP IF SAFETY OR AUTHORITY IS UNCLEAR
DATE
LOCATION
OPERATOR
RISK
FINDINGS
FOLLOW UP
FC 01 · FIELD USE · v1.0 — FC FAMILY
SENTIRASFC 01 · FIELD USE · v1.0
HOTEL ROOM SWEEP
Privacy inspection protocol for authorized hotel rooms.

TRAVEL · PRIVACY10–15 MINMEDIUM RISKROOM ONLY
10-STEP PROCEDURE
01PAUSE AT ENTRY — photo first
02BASELINE ELECTRONICS — TV, router, alarm
03SECURE PRIVACY — curtains, locks, devices
04CHECK ENTRY POINTS — door, peephole, window
05CHECK BED AREA — lamps, chargers, outlets
06CHECK WORK AREA — desk, power, objects
07CHECK BATHROOM — mirror, vents, fixtures
08RUN DETECTOR PASS — RF + lens after baseline
09DOCUMENT ANOMALIES — location, time, photo
10DECIDE RESPONSE — green, amber or red
SIGNAL NOTES
FALSE POSITIVES

Smoke detector, smart TV, router, thermostat, alarm clock, USB charger, hotel phone.

ESCALATE IF

Camera in bathroom, concealed object, safety concern, repeated readings, unidentified object.

DOCUMENT BEFORE TOUCHING SUSPICIOUS ITEMS
STOP & ESCALATE IF PERSONAL SAFETY OR CRIMINAL CONCERN EXISTS
DATE
HOTEL
ROOM
OPERATOR
FINDINGS
FOLLOW UP
FC 02 · FIELD USE · v1.0 — FC FAMILY
SENTIRASFC 02 · FIELD USE · v1.0
OFFICE & MEETING ROOM SWEEP
Controlled room protocol for confidential meetings.

CONFIDENTIAL10–20 MINMEDIUM RISKAUTHORIZED ROOM
10-STEP PROCEDURE
01ENTER EARLY — before participants arrive
02PHOTOGRAPH ROOM — capture state first
03BASELINE EQUIPMENT — display, phone, sensors
04CLEAR LOOSE ITEMS — unknown electronics
05CHECK LINE OF SIGHT — objects facing seats
06CHECK TABLE AREA — surface, underside, cables
07CHECK WALL & CEILING — vents, sensors, lights
08CHECK POWER LOGIC — owners for all cables
09RUN DETECTION PASS — optical + RF after baseline
10DOCUMENT AND DECIDE — log, verify, rate level
SIGNAL NOTES
FALSE POSITIVES

Video bar, conference phone, WiFi AP, booking tablet, motion sensor, smart display.

ESCALATE IF

Unlabeled object faces area, concealed device, repeated readings, facilities cannot ID.

CLEAR THE ROOM BEFORE CONFIDENTIAL DISCUSSION
STOP IF PERSONAL SAFETY, LEGAL OR CRIMINAL CONCERN EXISTS
DATE
ROOM
MEETING
OPERATOR
FINDINGS
FOLLOW UP
FC 03 · FIELD USE · v1.0 — FC FAMILY
SENTIRASFC 03 · FIELD USE · v1.0
VEHICLE SWEEP
Authorized vehicle inspection for tracking risk.

VEHICLE · PRIVACY15–30 MINMED–HIGH RISKAUTH VEHICLE
10-STEP PROCEDURE
01CONFIRM AUTHORITY — own, control or authorized
02PARK SAFELY — stable, well lit, no traffic
03PHOTOGRAPH VEHICLE — all four sides first
04READ EXTERIOR — marks, trim, adhesive, objects
05CHECK WHEEL WELLS — curves, edges, inner surfaces
06CHECK BUMPER LINES — front and rear edges
07CHECK UNDERBODY EDGES — light + mirror only
08CHECK INTERIOR POWER — OBD, console, trunk
09RUN DETECTION PASS — RF/BT after baseline
10DOCUMENT & ESCALATE — preserve, contact support
SIGNAL NOTES
FALSE POSITIVES

Factory sensors, parking sensors, fleet device, insurance dongle, toll tag, dashcam.

ESCALATE IF

Personal safety, stalking involved, concealed object, magnetic attachment, authority unclear.

PHOTOGRAPH BEFORE TOUCHING SUSPECTED OBJECTS
STOP ROUTINE USE IF PERSONAL SAFETY RISK EXISTS
DATE
VEHICLE
LOCATION
OPERATOR
FINDINGS
FOLLOW UP
FC 04 · FIELD USE · v1.0 — FC FAMILY
SENTIRASFC 04 · FIELD USE · v1.0
HOME ENTRY SWEEP
Entry inspection for household security concerns.

HOME ENTRY10–20 MINVARIABLE RISKAUTH SPACE
10-STEP PROCEDURE
01PAUSE FIRST — do not move objects yet
02CHECK SAFETY — leave if someone inside
03PHOTOGRAPH ENTRY — door, frame, mailbox, packages
04CHECK DOOR SYSTEM — lock, handle, latch, hinges
05CHECK PACKAGES — addressee, condition, placement
06CHECK MAILBOX — authorized access only
07CHECK DEVICES — smart lock, camera, alarm, WiFi
08CHECK SIGHTLINES — what's visible from outside
09REVIEW ACCESS HISTORY — who had keys or codes
10DOCUMENT & ESCALATE — assign level, contact support
SIGNAL NOTES
FALSE POSITIVES

Delivery movement, building cleaning, wind, smart lock battery, WiFi outage, pet motion.

ESCALATE IF

Safety concern, unauthorized entry, lock damage, intentional placement, stalking, missing items.

DOCUMENT BEFORE MOVING ENTRY OBJECTS
LEAVE AREA IF SOMEONE MAY STILL BE INSIDE
DATE
LOCATION
OPERATOR
CONCERN
FINDINGS
FOLLOW UP
FC 05 · METHOD · v1.0 — FC FAMILY
SENTIRASFC 05 · METHOD · v1.0
RISK LEVEL & ESCALATION
Green, amber and red response framework.

ALL PROCEDURESGREEN AMBER REDVERIFY FIRSTSAFETY FIRST
8-STEP PROCEDURE
01ASSESS EVIDENCE — observed, detected, reported
02ASSIGN GREEN — explainable, normal readings
03ASSIGN AMBER — unresolved, document and verify
04ASSIGN RED — safety, privacy, criminal, confirmed
05MATCH RESPONSE — record, verify or escalate
06AVOID CONFRONTATION — no unverified accusations
07DOCUMENT DECISION — evidence supports the level
08ESCALATE RED — appropriate support immediately
SIGNAL NOTES
FALSE POSITIVES

Normal electronics, infrastructure, environmental signals, routine maintenance.

ESCALATE IF

Personal safety, stalking, private area camera, tracking device, unauthorized entry.

DO NOT CONFRONT BASED ON UNVERIFIED ANOMALY
LEAVE AREA IF PERSONAL SAFETY RISK EXISTS
DATE
LOCATION
OPERATOR
RISK LEVEL
EVIDENCE
FOLLOW UP
FC 06 · METHOD · v1.0 — FC FAMILY
SENTIRASFC 06 · METHOD · v1.0
FIELD DOCUMENTATION SYSTEM
Record observations, preserve context, verify before concluding.

ALL SWEEPSALL RISK LEVELSDOCUMENT FIRSTVERIFY FIRST
8-STEP PROCEDURE
01CREATE CASE REF — date, location, reference
02PHOTOGRAPH FIRST — wide, medium, close views
03WRITE FIELD LOG — time, operator, observations
04SEPARATE FACTS — label observations vs assessments
05ASSIGN EVIDENCE LEVEL — observation to confirmation
06ASSIGN RISK LEVEL — green, amber or red
07RECORD ACTION — who contacted, what remains
08SECURE RECORD — safe storage, limit sharing
SIGNAL NOTES
FALSE POSITIVES

Over-documentation of low risk, dramatic language, treating readings as proof.

ESCALATE IF

Safety or criminal concern, formal record needed, chain of handling required.

DOCUMENT BEFORE TOUCHING
ESCALATE IF SAFETY OR CRIMINAL CONCERN EXISTS
CASE REF
DATE
LOCATION
OPERATOR
RISK LEVEL
FOLLOW UP
FC 11 · FIELD USE · v1.0 — FC FAMILY
SENTIRASFC 11 · FIELD USE · v1.0
TRAVEL SECURITY PROTOCOL
Document, device and routine control for lawful travel.

TRAVEL5 STAGESVARIABLE RISKAUTH USE ONLY
10-STEP PROCEDURE
01REDUCE THE KIT — carry only required items
02CONTROL DOCUMENTS — one predictable pouch
03LOCK DEVICES — before trays, counters, taxis
04USE OWN POWER — charger, cable, power bank
05LIMIT CONNECTIVITY — approved WiFi, VPN, BT
06PROTECT CONVERSATIONS — no sensitive public calls
07RUN HOTEL ARRIVAL — door, latch, Ch 7 sweep
08CONTROL MEETING MATERIAL — carry + recover only
09RESET ON RETURN — confirm everything returned
10DOCUMENT ANOMALIES — time, place, action, level
SIGNAL NOTES
FALSE POSITIVES

Travel login alert, battery drain, roaming prompt, app update, captive portal.

ESCALATE IF

Device lost, passport missing, safety concern, unauthorized access, data exposed.

REBUILD THE KIT AFTER EVERY HANDOFF
MOVE TO SAFETY IF PERSONAL RISK EXISTS
DATE
TRIP
OPERATOR
STAGE
CONCERN
FOLLOW UP
FC 12 · FIELD USE · v1.0 — FC FAMILY
SENTIRASFC 12 · FIELD USE · v1.0
SENSITIVE MEETING PROTOCOL
Room, participant, device and document control.

MEETING5 STAGESVARIABLE RISKAUTH USE ONLY
10-STEP PROCEDURE
01CLASSIFY MEETING — sensitivity, owner, participants
02BASELINE ROOM — door, window, display, whiteboard
03CONFIRM PARTICIPANTS — in-room + remote verified
04SET DEVICE RULE — phones, laptops, watches, earbuds
05CONFIRM RECORDING — audio, video, transcript, AI
06CONTROL DOCUMENTS — minimum copies, recover drafts
07CONTROL SCREEN — only required files, hide notifs
08PAUSE FOR CHANGES — visitors, unknown participants
09CLOSE THE ROOM — recover all materials and devices
10LOG EXCEPTIONS — time, issue, action, level
SIGNAL NOTES
FALSE POSITIVES

Normal room mic, video bar, smart speaker, meeting icon, emergency phone.

ESCALATE IF

Unauthorized recording, unexpected transcript, unknown participant, privilege exposed.

CONFIRM RECORDING STATUS BEFORE CONTENT
STOP IF THE MEETING BOUNDARY IS LOST
DATE
LOCATION
MEETING OWNER
SENSITIVITY
CONCERN
FOLLOW UP
FC 13 · FIELD USE · v1.0 — FC FAMILY
SENTIRASFC 13 · FIELD USE · v1.0
POST INCIDENT RESPONSE
Safety, evidence preservation and escalation after incident.

RESPONSEFIRST HOURVARIABLE RISKAUTH USE ONLY
10-STEP PROCEDURE
01CHECK SAFETY — leave if risk may be active
02PRESERVE STATE — don't move, reset or clean
03LIMIT ACCESS — keep people away from area
04CAPTURE CONTEXT — wide, medium, close photos
05RECORD FACTS — time, place, discoverer, last normal
06AVOID CONFRONTATION — no accusations or following
07IDENTIFY OWNER — emergency, hotel, IT, security, legal
08SEND FIRST REPORT — factual, state support needed
09TRACK HANDOFFS — who handled evidence, when, where
10CLOSE THE LOOP — assign owners, store records
SIGNAL NOTES
FALSE POSITIVES

Housekeeping entry, key card error, platform setting, nearby Bluetooth, luggage shift.

ESCALATE IF

Active safety, criminal activity, sensitive items missing, unauthorized recording, device compromise.

DOCUMENT BEFORE MOVING OR RESETTING
SAFETY FIRST · EVIDENCE SECOND
DATE
TIME
LOCATION
INCIDENT
DISCOVERED BY
FOLLOW UP
DC 01 · FIELD USE · v1.0 — DC FAMILY
SENTIRASDC 01 · FIELD USE · v1.0
RF DETECTION BASICS
Baseline, control, scan, repeat and verify.

DETECTIONRF SIGNALVARIABLEAUTH USE ONLY
9-STEP PROCEDURE
01BASELINE VISUALLY — know what's present first
02CONTROL OWN DEVICES — phones, BT, laptops, watches
03LIST KNOWN SOURCES — routers, TVs, alarms, APs
04SET DETECTOR — record model, setting, sensitivity
05SCAN SLOWLY — consistent path and distance
06REPEAT ALERTS — rescan from another angle
07VERIFY CONTEXT — sightline, placement, owner, infra
08DOCUMENT — location, setting, sources, result
09ESCALATE CAREFULLY — Ch 13 if anomaly confirmed
SIGNAL NOTES
FALSE POSITIVES

Phones, routers, Bluetooth, access points, smart TVs, vehicles, nearby rooms.

ESCALATE IF

Repeated unexplained reading, aligns with object, sensitive zone, sources controlled.

BASELINE BEFORE SCANNING
DO NOT DISMANTLE OBJECTS BASED ON A READING ALONE
DATE
LOCATION
DETECTOR
SETTING
SOURCES
FOLLOW UP
DC 02 · FIELD USE · v1.0 — DC FAMILY
SENTIRASDC 02 · FIELD USE · v1.0
HIDDEN CAMERA DETECTION
Sightline, reflection, verification and lawful escalation.

DETECTIONVISUAL PRIVACYNON DESTRUCTIVEAUTH USE ONLY
10-STEP PROCEDURE
01CONFIRM AUTHORIZATION — permitted spaces only
02IDENTIFY SENSITIVE ZONES — bed, desk, bathroom
03MAP SIGHTLINES — stand in zone, look outward
04CHECK OBJECTS FACING ZONES — openings, reflections
05USE LIGHT AND ANGLE — slow, multiple positions
06REPEAT REFLECTIONS — clue not proof
07DOCUMENT WIDE MEDIUM CLOSE — context before detail
08VERIFY OWNER — hotel, facilities, vehicle, host
09DO NOT DISMANTLE — no unscrewing or prying
10ESCALATE IF PRIVATE ZONE — Ch 13 for red/amber
SIGNAL NOTES
FALSE POSITIVES

Screws, sensors, LEDs, vents, AV hardware, glossy plastic, thermostat.

ESCALATE IF

Unexplained object faces bathroom/bedroom, exposure may have occurred, safety concern.

VERIFY SIGHTLINE AND OWNER BEFORE CONCLUDING
STOP USE OF PRIVATE ZONE IF UNEXPLAINED OBJECT FOUND
DATE
LOCATION
ZONE
OBJECT
SIGHTLINE
FOLLOW UP
DC 03 · FIELD USE · v1.0 — DC FAMILY
SENTIRASDC 03 · FIELD USE · v1.0
GPS TRACKER DETECTION
Authorized vehicle and personal item tracking risk check.

TRACKING RISKVEHICLE/ITEMNON DESTRUCTIVEAUTH USE ONLY
10-STEP PROCEDURE
01CONFIRM AUTHORIZATION — own or authorized only
02MOVE TO SAFE LOCATION — no traffic, no confrontation
03REVIEW ACCESS HISTORY — keys, service, valet, fleet
04CHECK LEGITIMATE SYSTEMS — telematics, insurance, toll
05INSPECT VISIBLE EXTERIOR — wheels, bumpers, plate
06INSPECT ACCESSIBLE INTERIOR — seats, console, trunk
07CHECK PERSONAL ITEMS — bags, sleeves, luggage, jackets
08CAPTURE SMART TAG ALERTS — screenshot time + route
09DOCUMENT BEFORE MOVING — photograph in place
10ESCALATE SAFETY CONCERNS — Ch 13 for stalking/threats
SIGNAL NOTES
FALSE POSITIVES

Fleet tracker, telematics, toll device, insurance dongle, dashcam, smart tag, alarm.

ESCALATE IF

Stalking concern, unauthorized object, device in belongings, threats, repeated alerts.

PHOTOGRAPH BEFORE TOUCHING SUSPECTED OBJECTS
STOP ROUTINE USE IF PERSONAL SAFETY RISK EXISTS
DATE
VEHICLE/ITEM
LOCATION
OPERATOR
ALERT
FOLLOW UP
DC 04 · FIELD USE · v1.0 — DC FAMILY
SENTIRASDC 04 · FIELD USE · v1.0
AUDIO RISK & LAWFUL DOCUMENTATION
Consent, boundary, device status and factual records.

AUDIOCONSENTRECORD STATUSAUTH USE ONLY
10-STEP PROCEDURE
01CONFIRM SENSITIVITY — does topic need audio control
02CONFIRM CONSENT — recording/transcription authorized
03IDENTIFY ROOM SYSTEMS — conf phone, video bar, mics
04SET DEVICE RULE — phones, laptops, watches, earbuds
05VERIFY REMOTE ATTENDEES — names, dial-ins confirmed
06CHECK RECORDING STATUS — platform indicators, AI notes
07PAUSE IF UNCLEAR — stop content until resolved
08DOCUMENT FACTS — what appeared, when, who acted
09STORE RECORDS SECURELY — control minutes + transcripts
10ESCALATE UNAUTHORIZED — Ch 13 when exposure occurred
SIGNAL NOTES
FALSE POSITIVES

Normal room mic, video bar, muted speaker, meeting icon, emergency phone.

ESCALATE IF

Unauthorized recording, unexpected transcript, unknown participant, private zone risk.

CONFIRM RECORDING STATUS BEFORE CONTENT
STOP IF UNAUTHORIZED AUDIO CAPTURE SUSPECTED
DATE
LOCATION
MEETING
PLATFORM
RECORDING
FOLLOW UP
KC 01 · FIELD USE · v1.0 — KC FAMILY
SENTIRASKC 01 · FIELD USE · v1.0
VISUAL INSPECTION TOOLS
Light, angle, reflection and documentation before detection.

EQUIPMENTVISUALNON DESTRUCTIVEAUTH USE ONLY
9-STEP PROCEDURE
01CONFIRM AUTHORIZATION — permitted spaces only
02START WIDE — room layout and sensitive zones
03USE LIGHT — direct + side lighting for edges
04CHANGE ANGLE — reflections from multiple positions
05USE MIRROR — behind and under without moving
06DOCUMENT FIRST — wide, medium, close before handling
07VERIFY OWNER — ask facilities, hotel or household
08DO NO DAMAGE — no dismantling or interfering
09ASSIGN LEVEL — green, amber or red by evidence
SIGNAL NOTES
FALSE POSITIVES

Screws, vents, sensors, LEDs, AV hardware, cable ports, decorative holes.

ESCALATE IF

Object unexplained, faces sensitive zone, tied to unauthorized access.

LOOK FIRST · TOUCH LAST
ESCALATE IF OBJECT IS OUTSIDE YOUR AUTHORITY
DATE
LOCATION
OPERATOR
OBJECT
SIGHTLINE
FOLLOW UP
KC 02 · FIELD USE · v1.0 — KC FAMILY
SENTIRASKC 02 · FIELD USE · v1.0
CLEAN DEVICE PROTOCOL
Minimal data, controlled accounts and trusted connections.

DEVICEMINIMAL DATATRUSTED POWERRESET REQUIRED
10-STEP PROCEDURE
01DEFINE PURPOSE — calls, maps, docs, photos, emergency
02SELECT PROFILE — travel, meeting, field, loaner, laptop
03REMOVE EXTRA DATA — unnecessary files, apps, cached
04LIMIT ACCOUNTS — only required for the task
05UPDATE BEFORE USE — system + apps before travel
06LOCK AND ENCRYPT — passcode, encryption, remote lock
07CONTROL CONNECTIVITY — WiFi, BT, sharing, hotspot
08USE TRUSTED POWER — own charger, cable, power bank
09STORE RECORDS — field photos to approved storage
10RESET AFTER USE — remove temp files, networks, pairings
SIGNAL NOTES
FALSE POSITIVES

Travel login alert, battery drain, roaming prompt, app update, captive portal.

ESCALATE IF

Lost device, unauthorized access, account alert, sensitive data, unauthorized software.

PREPARE BEFORE STRESS · NOT DURING
STOP SENSITIVE USE IF COMPROMISE SUSPECTED
DATE
DEVICE
PROFILE
PURPOSE
ACCOUNTS
RESET
KC 03 · FIELD USE · v1.0 — KC FAMILY
SENTIRASKC 03 · FIELD USE · v1.0
FARADAY STORAGE & SIGNAL CONTROL
Authorized signal isolation with custody and retrieval records.

SIGNAL CONTROLTEMPORARYLOGGEDAUTH USE ONLY
10-STEP PROCEDURE
01DEFINE PURPOSE — meeting, travel, key fob, evidence
02CONFIRM AUTHORIZATION — only devices you may handle
03PROTECT SAFETY ACCESS — don't block emergency comms
04RECORD DEVICE STATE — power, lock, alerts, battery
05PLACE FULLY INSIDE — completely inside pouch
06SEAL CORRECTLY — per pouch design, don't overfill
07TEST IF APPROPRIATE — own devices only, not evidence
08LABEL POUCH — ID, device type, owner or participant
09RECORD RETRIEVAL — time, handler, condition, release
10ESCALATE EVIDENCE — Ch 13 for tracker or legal concern
SIGNAL NOTES
FALSE POSITIVES

Damaged pouch, poor seal, wrong size, missing log, data risk not signal risk.

ESCALATE IF

Missing device, suspected tracker, legal evidence, personal safety, custody dispute.

SIGNAL ISOLATION IS NOT DATA PROTECTION
PRESERVE EVIDENCE BEFORE SEALING
DATE
DEVICE
OWNER
POUCH ID
SEALED BY
RELEASED TO
KC 04 · FIELD USE · v1.0 — KC FAMILY
SENTIRASKC 04 · FIELD USE · v1.0
FIELD KIT MAINTENANCE
Check, clean, charge, test, log and pack.

KITREADINESSMAINTENANCEAUTH USE ONLY
10-STEP PROCEDURE
01CONFIRM PURPOSE — match kit level to task
02CHECK VENUE RULES — remove restricted tools
03VERIFY TOOLS PRESENT — flashlight, mirror, detector
04CHECK BATTERIES — recharge and replace as needed
05TEST DETECTORS — RF, lens and other active tools
06CHECK FARADAY POUCH — seal, fabric, function
07CHECK DOCUMENTATION — cards, log sheets, notebook
08CLEAN TOOLS — lens, mirror, pouch, case, surfaces
09REPLACE CONSUMABLES — labels, envelopes, pens, batteries
10UPDATE LOG — readiness, faults, retirement, next review
SIGNAL NOTES
FALSE POSITIVES

Minor wear, cosmetic damage, old firmware, expired label stock.

ESCALATE IF

Critical tool unreliable, detector test failed, pouch broken, incident contaminated.

MAINTAIN BEFORE YOU NEED IT
DO NOT USE UNRELIABLE EQUIPMENT IN THE FIELD
DATE
KIT ID
OPERATOR
LEVEL
FAULTS
NEXT REVIEW
SC 01 · FIELD USE · v1.0 — SC FAMILY
SENTIRASSC 01 · FIELD USE · v1.0
SECURE COMMUNICATION PRINCIPLES
Recipient, channel, content and record control.

COMMUNICATIONNEED TO KNOWCHANNEL CONTROLAUTH USE ONLY
10-STEP PROCEDURE
01CLASSIFY SENSITIVITY — routine to urgent safety
02VERIFY RECIPIENT — name, address, domain, group
03SELECT CHANNEL — match sensitivity and record need
04MINIMIZE MESSAGE — only what recipient needs
05USE NEUTRAL TITLES — no sensitive topics in subjects
06CONTROL ATTACHMENTS — file, version, metadata, notes
07CHECK LINKS — destination, permissions, sensitive names
08VERIFY URGENT REQUESTS — second channel confirmation
09PROTECT PUBLIC CALLS — no sensitive calls in public
10PRESERVE RECORDS — incident records in approved location
SIGNAL NOTES
FALSE POSITIVES

Autocomplete error, old thread, wrong version, broad distribution list.

ESCALATE IF

Credentials exposed, identity docs shared, customer data sent wrong, regulated material.

PAUSE BEFORE SENDING SENSITIVE INFORMATION
STOP SHARING IF WRONG RECIPIENT CONFIRMED
DATE
TYPE
RECIPIENTS
CHANNEL
VERIFICATION
FOLLOW UP
SC 02 · FIELD USE · v1.0 — SC FAMILY
SENTIRASSC 02 · FIELD USE · v1.0
TRAVEL PHONE PROTOCOL
Prepare, connect, protect and reset phones during travel.

TRAVELPHONECONNECTIVITYRESET REQUIRED
10-STEP PROCEDURE
01SELECT PHONE PROFILE — daily, work, travel, loaner
02REDUCE DATA — remove unnecessary apps + files
03CONFIRM ACCOUNTS — required accounts + MFA access
04CONTROL LOCK SCREEN — hide previews + auth codes
05PLAN CONNECTIVITY — roaming, eSIM, hotspot, VPN
06USE TRUSTED POWER — own charger, cable, power bank
07LIMIT LOCATION SHARING — review all sharing settings
08PROTECT IN PUBLIC — no sensitive calls, control screen
09RESPOND TO LOSS — remote lock, notify, protect accounts
10RESET AFTER RETURN — remove temp networks + pairings
SIGNAL NOTES
FALSE POSITIVES

Roaming alert, captive portal, battery drain, unknown Bluetooth, public charging.

ESCALATE IF

Phone lost, work device missing, account access, sensitive data exposed, safety concern.

REBUILD THE KIT AFTER EVERY HANDOFF
MOVE TO SAFETY IF PERSONAL RISK EXISTS
DATE
TRIP
PROFILE
CONNECTIVITY
ALERTS
RESET
SC 03 · FIELD USE · v1.0 — SC FAMILY
SENTIRASSC 03 · FIELD USE · v1.0
ACCOUNT & DEVICE HYGIENE
Passwords, MFA, recovery, devices, sessions and connected apps.

ACCOUNTSDEVICESSESSIONSREVIEW REQUIRED
10-STEP PROCEDURE
01INVENTORY PRIORITY ACCOUNTS — email, vault, cloud, bank
02USE UNIQUE PASSWORDS — no reuse across important accounts
03PROTECT PASSWORD MANAGER — strong master + MFA
04ENABLE MFA — appropriate methods, current backups
05REVIEW RECOVERY — email, phone, codes, contacts
06REVIEW DEVICE LIST — remove old or unknown devices
07CLEAN SESSIONS — sign out unused browsers + apps
08REVIEW CONNECTED APPS — remove unused, broad permissions
09CHECK CLOUD SHARING — public links, broad folders, former collab
10PRESERVE INCIDENT EVIDENCE — save records before cleanup
SIGNAL NOTES
FALSE POSITIVES

Travel login, VPN location, browser update, app reauth, duplicate device name.

ESCALATE IF

Confirmed unauthorized access, unknown MFA, forwarding rules, lost device, exposed recovery.

REVIEW ACCESS LAYERS AFTER EVERY TRIP OR INCIDENT
PRESERVE EVIDENCE BEFORE CLEANUP
DATE
ACCOUNT
MFA STATUS
DEVICES
SESSIONS
FOLLOW UP
SC 04 · FIELD USE · v1.0 — SC FAMILY
SENTIRASSC 04 · FIELD USE · v1.0
MEETING COMMUNICATION PROTOCOL
Invite, pre-read, live record and post-meeting distribution.

MEETINGCOMMUNICATIONRECORD CONTROLAUTH USE ONLY
10-STEP PROCEDURE
01CLASSIFY SENSITIVITY — routine to regulated
02CONTROL INVITE TITLE — neutral when topic sensitive
03VERIFY PARTICIPANTS — invitees, domains, roles, external
04CONTROL PRE-READS — needed files to right group only
05CHECK ATTACHMENTS — version, comments, notes, metadata
06SECURE MEETING LINK — waiting room, passcode, host ctrl
07CONFIRM RECORD STATUS — recording, transcript, AI notes
08CONTROL LIVE CHAT — factual, capture in approved record
09FILTER DISTRIBUTION — minutes + files to those who need
10STORE FINAL RECORD — approved location, document exceptions
SIGNAL NOTES
FALSE POSITIVES

Broad invite, old attachment, hidden notes, open link, AI note taker.

ESCALATE IF

Unauthorized participant, unauthorized recording, wrong recipient, privilege exposed.

CONFIRM RECORDING STATUS BEFORE CONTENT
STOP IF MEETING BOUNDARY IS LOST
DATE
MEETING
PLATFORM
PARTICIPANTS
RECORDING
FOLLOW UP
SC 05 · FIELD USE · v1.0 — SC FAMILY
SENTIRASSC 05 · FIELD USE · v1.0
EMERGENCY CONTACT PROTOCOL
First message, contact tree, check-in and closeout.

EMERGENCYCONTACT TREECHECK INCLOSEOUT
10-STEP PROCEDURE
01KNOW CONTACT TREE — trusted, local, work, travel, authority
02STATE LOCATION — current position before background
03STATE SAFETY STATUS — safe, unsafe, unsure, moving
04STATE FACTUAL EVENT — one clear sentence
05STATE HELP NEEDED — call, send support, contact hotel
06ASK CONFIRMATION — request receipt of message
07SHARE LOCATION CAREFULLY — trusted contact only
08ESCALATE ON DEADLINE — missed check-in triggers action
09LOG ACTIONS — times, contacts, messages, escalation
10CLOSE THE LOOP — confirm safe, update everyone activated
SIGNAL NOTES
FALSE POSITIVES

Dead battery, train delay, forgotten check-in, message delivery failure.

ESCALATE IF

Immediate danger, threat, medical issue, intrusion, missing person, stalking.

LOCATION AND SAFETY STATUS COME FIRST
ESCALATE IF NO RESPONSE AFTER AGREED DEADLINE
DATE
LOCATION
PERSON
SAFETY
CONTACT
FOLLOW UP
RP 01 · RESPONSE · v1.0 — RP FAMILY
SENTIRASRP 01 · RESPONSE · v1.0
SUSPECTED GPS TRACKER FOUND
Safety, preservation and escalation after tracker discovery.

RESPONSETRACKING RISKNO CONFRONTATIONPRESERVE
10-STEP PROCEDURE
01CHECK SAFETY — move away if threat is active
02DO NOT CONFRONT — no contact with suspected person
03DO NOT DISMANTLE — no open, charge, pair or test
04PHOTOGRAPH IN PLACE — wide, medium, close first
05PRESERVE ALERTS — screenshot smart tag + route + time
06RECORD CONTEXT — location, time, vehicle, access history
07VERIFY OWNER — fleet, rental, family, workplace, luggage
08DECIDE STORAGE — in place or Faraday if authorized
09ESCALATE CORRECTLY — safety, workplace, legal, authority
10CLOSE THE LOOP — explanation, status, level, owner
SIGNAL NOTES
FALSE POSITIVES

Telematics, fleet device, rental tracker, toll tag, dashcam, insurance dongle, smart tag.

ESCALATE IF

Stalking or threats, unexplained object, device in belongings, repeated alerts, hazardous.

PHOTOGRAPH BEFORE TOUCHING SUSPECTED OBJECTS
STOP ROUTINE USE IF PERSONAL SAFETY RISK EXISTS
DATE
TIME
LOCATION
VEHICLE
OBJECT
OWNER
PHOTOS
FOLLOW UP
RP 02 · RESPONSE · v1.0 — RP FAMILY
SENTIRASRP 02 · RESPONSE · v1.0
SUSPECTED HIDDEN CAMERA FOUND
Privacy stop, preservation and escalation after visual recording concern.

RESPONSEPRIVACY RISKNO DISMANTLINGPRESERVE
10-STEP PROCEDURE
01STOP USE — pause bedroom, bathroom, changing area
02MOVE TO CONTROLLED AREA — protect affected person
03DO NOT CONFRONT — no accusing staff or guests
04DO NOT DISMANTLE — no unplug, pry or remove
05PHOTOGRAPH IN PLACE — wide, medium, close views
06RECORD SIGHTLINE — which private zone it faces
07VERIFY OWNER — hotel, rental, workplace, facilities
08ESCALATE PRIVATE ZONES — bathroom/bedroom = fast
09PROTECT RECORDS — store securely and narrowly
10SUPPORT AFFECTED PERSON — limit questions, protect dignity
SIGNAL NOTES
FALSE POSITIVES

Smoke detector, motion sensor, video bar, thermostat, AV device, dashcam.

ESCALATE IF

Unexplained object faces private zone, exposure may have occurred, safety concern.

STOP SENSITIVE USE OF AFFECTED AREA
ESCALATE IMMEDIATELY IF PRIVATE ZONE COMPROMISED
DATE
TIME
LOCATION
ZONE
OBJECT
SIGHTLINE
OWNER
FOLLOW UP
RP 03 · RESPONSE · v1.0 — RP FAMILY
SENTIRASRP 03 · RESPONSE · v1.0
UNKNOWN RF ACTIVITY DETECTED
Source control, repeat scan and verification after RF reading.

RESPONSERF SIGNALREPEAT FIRSTAUTH USE ONLY
10-STEP PROCEDURE
01PAUSE IF SENSITIVE — stop private activity if aligned
02RECORD SETTINGS — detector, sensitivity, time, location
03CONTROL OWN DEVICES — phone, watch, earbuds, laptop
04LIST KNOWN SOURCES — router, TV, AP, conference, vehicle
05REPEAT SAME POSITION — stable or momentary?
06REPEAT NEW ANGLE — direction, distance, object relation
07COMPARE KNOWN SOURCE — understand detector behavior
08PHOTO CONTEXT — location + nearby objects, not just screen
09VERIFY OWNER — hotel, facilities, IT, vehicle, property
10CLOSE OR ESCALATE — explain, unresolved, or red level
SIGNAL NOTES
FALSE POSITIVES

Phone, router, Bluetooth, smart TV, access point, vehicle key, conference system.

ESCALATE IF

Repeated unexplained in private zone, aligns with object, incident context.

BASELINE BEFORE CONCLUDING
STOP SENSITIVE ACTIVITY IF READING ALIGNS WITH PRIVATE ZONE
DATE
TIME
LOCATION
DETECTOR
SETTING
SOURCES
READING
FOLLOW UP
RP 04 · RESPONSE · v1.0 — RP FAMILY
SENTIRASRP 04 · RESPONSE · v1.0
SUSPICIOUS OBJECT DISCOVERED
Safety, context preservation and owner verification.

RESPONSEUNKNOWN OBJECTDO NOT TOUCHVERIFY OWNER
10-STEP PROCEDURE
01ASSESS SAFETY — move away if hazard possible
02DO NOT TOUCH — no open, shake, move, dismantle
03KEEP DISTANCE — keep others away if safe to do so
04PHOTO IF SAFE — wide, medium, close when safe
05RECORD CONTEXT — time, location, discoverer, zone
06CLASSIFY CONCERN — safety, privacy, tracking, lost, infra
07VERIFY OWNER — hotel, facilities, IT, vehicle, rental
08USE SPECIFIC PLAYBOOK — tracker, camera, RF, incident
09ESCALATE IF UNSAFE — emergency, security, authority
10CLOSE WITH RECORD — explanation, status, handoff, owner
SIGNAL NOTES
FALSE POSITIVES

Sensor, AV adapter, charger, cleaning tag, maintenance tool, router, lost item.

ESCALATE IF

Hazard possible, threat context, private zone, personal item, unauthorized access.

DO NOT HANDLE UNKNOWN OBJECTS
MOVE AWAY IF HAZARD IS POSSIBLE
DATE
TIME
LOCATION
OBJECT
DISCOVERED BY
OWNER
PHOTOS
FOLLOW UP
RP 05 · RESPONSE · v1.0 — RP FAMILY
SENTIRASRP 05 · RESPONSE · v1.0
POSSIBLE UNAUTHORIZED ENTRY
Safety, threshold preservation and access verification.

RESPONSEENTRY CONCERNDO NOT ENTERPRESERVE STATE
10-STEP PROCEDURE
01STOP AT THRESHOLD — do not enter until assessed
02ASK IF SOMEONE PRESENT — sounds, door, lock, lights
03MOVE AWAY IF UNSAFE — emergency, hotel, workplace, trusted
04DO NOT SEARCH ALONE — no clearing rooms or closets
05PHOTO CURRENT STATE — threshold, lock, door, window, items
06RECORD LAST NORMAL — when last controlled, who had access
07PRESERVE ALERTS — smart lock, alarm, device, account msgs
08VERIFY ACCESS HISTORY — keys, cards, codes, logs, visitors
09ESCALATE AFFECTED ITEMS — passport, device, docs, keys, safety
10CLOSE WITH RECORD — explanation, status, access changes, owner
SIGNAL NOTES
FALSE POSITIVES

Housekeeping, maintenance, weak latch, family, coworker, valet, user error.

ESCALATE IF

Someone present, forced entry, missing sensitive item, safety, tampering, repeated.

DO NOT ENTER IF SOMEONE MAY BE INSIDE
MOVE TO SAFETY BEFORE INVESTIGATING
DATE
TIME
LOCATION
ENTRY
CHANGES
ITEMS
OWNER
FOLLOW UP
RP 06 · RESPONSE · v1.0 — RP FAMILY
SENTIRASRP 06 · RESPONSE · v1.0
SENSITIVE INFORMATION LEAK
Containment, preservation and owner escalation after exposure.

RESPONSEINFO EXPOSURESTOP SHARINGPRESERVE
10-STEP PROCEDURE
01STOP SHARING — no forward, repost, reply broadly
02PRESERVE ORIGINAL — message, file, link, platform record
03IDENTIFY INFORMATION — personal, customer, legal, HR, cred
04IDENTIFY ACCESS — recipients, groups, public link, folder
05RESTRICT OR REVOKE — change permissions if authorized
06NOTIFY OWNER — IT, legal, privacy, HR, customer, manager
07REQUEST HOLD — ask recipients not to forward or use
08RECORD TIMESTAMPS — sent, access, revoked, notification
09ESCALATE HIGH RISK — credentials, identity, regulated, safety
10CLOSE WITH PREVENTION — final access state + prevention step
SIGNAL NOTES
FALSE POSITIVES

Authorized distribution, known recipient, inherited permissions, no sensitive content.

ESCALATE IF

Public access, wrong external recipient, customer data, credentials, identity, legal.

CONTAIN WITHOUT DESTROYING THE RECORD
ESCALATE IMMEDIATELY IF REGULATED OR PERSONAL DATA EXPOSED
DATE
TIME
CHANNEL
INFO TYPE
RECIPIENTS
CONTAINMENT
OWNER
FOLLOW UP
RP 07 · RESPONSE · v1.0 — RP FAMILY
SENTIRASRP 07 · RESPONSE · v1.0
LOST PHONE OR DEVICE
Safety, remote lock, account protection and closeout.

RESPONSEDEVICE LOSSACCOUNT EXPOSUREOWNER NOTIFY
10-STEP PROCEDURE
01MOVE TO SAFETY — don't chase or confront
02RECORD LAST SEEN — time, location, context, lock state
03REMOTE LOCK — lost mode if authorized + available
04NOTIFY OWNER — IT, carrier, hotel, venue, manager
05CHECK DATA EXPOSURE — files, photos, email, chat, travel
06PROTECT ACCOUNTS — email, device, vault, work, cloud
07HANDLE SIM & PAYMENTS — carrier, eSIM, wallet, banking
08DECIDE WIPE OR REVIEW — follow owner/IT/legal guidance
09PRESERVE TIMELINE — screenshots, tickets, alerts, actions
10CLOSE WITH PREVENTION — recovered, replaced, wiped, monitored
SIGNAL NOTES
FALSE POSITIVES

Phone in bag, device in safe, laptop in meeting room, battery dead, misplaced bag.

ESCALATE IF

Stolen, unlocked, work device, customer data, credentials, MFA device, safety location.

THE DEVICE IS A DOORWAY · NOT JUST A GADGET
STOP SENSITIVE USE AND PROTECT ACCOUNTS IMMEDIATELY
DATE
TIME LOST
DEVICE
OWNER
LAST SEEN
LOCK
REMOTE
FOLLOW UP
RP 08 · RESPONSE · v1.0 — RP FAMILY
SENTIRASRP 08 · RESPONSE · v1.0
DIGITAL ACCOUNT ALERT
Trusted route verification, account review and escalation.

RESPONSEACCOUNT ALERTTRUSTED ROUTEDO NOT CLICK
10-STEP PROCEDURE
01DO NOT CLICK — avoid links in unexpected alerts
02DO NOT APPROVE UNKNOWN MFA — deny uninitiated prompts
03PRESERVE ALERT — sender, time, account, device, details
04ASK IF INITIATED — travel, VPN, update may explain it
05USE TRUSTED ROUTE — official app, typed URL, IT support
06REVIEW ACTIVITY — recent logins, devices, sessions
07REVIEW MFA & RECOVERY — methods, devices, backup codes
08CHECK CONNECTED APPS — email, cloud, calendar, social
09ESCALATE HIGH RISK — financial, work, credentials, customer
10CLOSE WITH RECORD — explanation, actions, monitoring, prevention
SIGNAL NOTES
FALSE POSITIVES

Travel login, VPN location, browser update, app reauth, password manager sync.

ESCALATE IF

Unknown MFA approved, recovery changed, financial fraud, unauthorized login, regulated data.

VERIFY THROUGH TRUSTED ROUTE · NOT THE ALERT
DENY UNKNOWN MFA PROMPTS IMMEDIATELY
DATE
TIME
ACCOUNT
ALERT TYPE
INITIATED
TRUSTED ROUTE
ACTIONS
FOLLOW UP
RP 09 · RESPONSE · v1.0 — RP FAMILY
SENTIRASRP 09 · RESPONSE · v1.0
IMMEDIATE PERSONAL SAFETY CONCERN
Move to safety, contact support, preserve when safe.

RESPONSEPERSONAL SAFETYNO CONFRONTATIONSUPPORT FIRST
10-STEP PROCEDURE
01ASK IF SAFE — pause all investigation if unsure
02MOVE TO SAFER PLACE — staffed, public, controlled
03DO NOT CONFRONT — no accusing, following, arguing
04CONTACT SUPPORT — emergency, security, hotel, trusted
05SEND FIRST MESSAGE — location, status, event, help, confirm
06SHARE LOCATION CAREFULLY — trusted contact only
07SET CHECK-IN — next update time + missed action
08PRESERVE WHEN SAFE — messages, timeline, photos, witnesses
09ESCALATE SPECIFIC — tracker, device, entry, account, leak
10CLOSE THE LOOP — confirm safe, update support, document
SIGNAL NOTES
FALSE POSITIVES

Same-route pedestrian, hotel key issue, valet movement, meeting misunderstanding.

ESCALATE IF

Immediate danger, threat, intruder, forced entry, unable to leave, missing person, stalking.

SAFETY OVERRIDES INVESTIGATION
GET TO SAFETY FIRST · DOCUMENT LATER
DATE
TIME
LOCATION
PERSON
SAFETY
SUPPORT
MESSAGE
FOLLOW UP
ES 01 · ESCALATION · v1.0 — ES FAMILY
SENTIRASES 01 · ESCALATION · v1.0
WORKING WITH POLICE, SECURITY & LEGAL
Factual handoff, evidence package and follow-up record.

ESCALATIONPROFESSIONALEVIDENCE HANDOFFNEED TO KNOW
10-STEP PROCEDURE
01CONFIRM SAFETY — emergency/security support first
02CHOOSE CHANNEL — police, hotel, workplace, legal, IT, HR
03PREPARE SUMMARY — location, time, observation, need
04USE NEUTRAL LANGUAGE — observed, not assumed
05PRESERVE EVIDENCE — photos, screenshots, messages, timeline
06SHARE NEED TO KNOW — limit private, legal, child details
07ASK FOR INSTRUCTIONS — stop investigating after handoff
08RECORD HANDOFF — who, what, when, why, reference
09COLLECT CASE NUMBER — report, ticket, incident reference
10CLOSE WITH OWNER — next owner, follow-up, record storage
SIGNAL NOTES
FALSE POSITIVES

Routine inquiry, standard report, admin action, false alarm confirmed.

ESCALATE IF

Unsafe person, threat, hazardous object, forced entry, stalking, regulated data.

FACTUAL LANGUAGE MAKES THE HANDOFF STRONGER
DO NOT DELAY EMERGENCY SUPPORT FOR A PERFECT PACKAGE
DATE
TIME
INCIDENT
CHANNEL
CONTACT
REFERENCE
EVIDENCE
FOLLOW UP
ES 02 · ESCALATION · v1.0 — ES FAMILY
SENTIRASES 02 · ESCALATION · v1.0
EVIDENCE PACKAGE PREPARATION
Originals, timeline, privacy review and professional handoff.

ESCALATIONEVIDENCEORIGINALS UNCHANGEDNEED TO KNOW
10-STEP PROCEDURE
01CONFIRM AUTHORIZATION — package authorized records only
02PRESERVE ORIGINALS — no editing photos, messages, logs
03CREATE WORKING COPIES — annotated/redacted for review
04BUILD TIMELINE — time, location, observation, action
05INDEX RECORDS — photos, screenshots, messages, logs
06MINIMIZE PRIVACY — redact copies where unnecessary
07USE CLEAR FILE NAMES — date, location, type, sequence
08PREPARE SUMMARY — status, facts, actions, next step
09SHARE THROUGH RIGHT CHANNEL — police, security, legal, IT
10RECORD HANDOFF — recipient, channel, time, reference
SIGNAL NOTES
FALSE POSITIVES

Over-documentation, dramatic names, mixed copies, broad forwarding.

ESCALATE IF

Evidence altered, wrong recipient, regulated data, legal matter, safety records exposed.

ORIGINALS STAY UNCHANGED
DO NOT DISTRIBUTE SENSITIVE RECORDS BROADLY
DATE
INCIDENT
PACKAGE
ORIGINALS
SUMMARY
RECIPIENT
REFERENCE
FOLLOW UP
ES 03 · ESCALATION · v1.0 — ES FAMILY
SENTIRASES 03 · ESCALATION · v1.0
INSURANCE, EMPLOYER & TRAVEL REPORTING
Targeted reporting, reference numbers and follow-up ownership.

ESCALATIONNON-EMERGENCYTARGETEDFOLLOW UP
10-STEP PROCEDURE
01CONFIRM CHANNEL — insurance, employer, travel, hotel, carrier
02PREPARE SUMMARY — date, time, location, issue, status
03MATCH CHANNEL NEEDS — only what they need to act
04MINIMIZE PRIVACY — no unnecessary identity or customer data
05USE OFFICIAL ROUTE — portal, support line, incident system
06ATTACH TARGETED EVIDENCE — proof, photos, report extract
07ASK FOR REFERENCE — claim, case, ticket, incident number
08RECORD INSTRUCTIONS — requested, promised, assigned
09ASSIGN FOLLOW-UP OWNER — traveler, manager, IT, insurer
10UPDATE MASTER RECORD — claim, reporting, prevention together
SIGNAL NOTES
FALSE POSITIVES

Wrong channel, broad package, no reference, speculative claims.

ESCALATE IF

Active safety, work device data, passport, regulated data, customer data, fraud.

EACH CHANNEL GETS A TARGETED REPORT · NOT THE FULL FILE
DO NOT CREATE A SECOND EXPOSURE THROUGH OVER-SHARING
DATE
INCIDENT
CHANNEL
CONTACT
REFERENCE
SUMMARY
EVIDENCE
FOLLOW UP
ES 04 · ESCALATION · v1.0 — ES FAMILY
SENTIRASES 04 · ESCALATION · v1.0
DIGITAL FORENSICS & DEVICE REVIEW
Preserve device state, stop self-inspection, hand off to professional.

ESCALATIONDEVICE REVIEWPRESERVE STATEPROFESSIONAL
10-STEP PROCEDURE
01STOP SELF-INSPECTION — stop when evidence matters
02RECORD CURRENT STATE — device, owner, time, power, alerts
03DO NOT ALTER — no wipe, update, reset, install, clear
04DO NOT CONNECT UNKNOWN MEDIA — no unknown USB/cards
05ISOLATE CAREFULLY — owner/IT instructions for network
06PRESERVE RELATED RECORDS — alerts, screenshots, timeline
07RECORD CUSTODY — who handled, when, why, where
08IDENTIFY PROFESSIONAL OWNER — IT, legal, forensics, vendor
09PREPARE REVIEW PACKAGE — summary, timeline, sensitivity
10CLOSE WITH DISPOSITION — cleared, wiped, rebuilt, escalated
SIGNAL NOTES
FALSE POSITIVES

Travel login, app update, battery drain, normal reauth, duplicate device.

ESCALATE IF

Confirmed compromise, regulated data, unknown device, recovered stolen, safety risk.

STOP MAKING CHANGES WHEN EVIDENCE MAY MATTER
DO NOT DIY FORENSICS ON SENSITIVE SYSTEMS
DATE
TIME
DEVICE
OWNER
STATE
CUSTODY
PROFESSIONAL
DISPOSITION
ES 05 · ESCALATION · v1.0 — ES FAMILY
SENTIRASES 05 · ESCALATION · v1.0
INCIDENT CLOSEOUT & LESSONS LEARNED
Safety, containment, evidence, lessons and ready state.

ESCALATIONCLOSEOUTLESSONSREADY STATE
10-STEP PROCEDURE
01CONFIRM SAFETY — person safe, locations avoided
02CONFIRM CONTAINMENT — exposure + access controlled
03CONFIRM OWNER — every item has owner + reference + due
04STORE EVIDENCE — originals preserved, copies labeled
05UPDATE CONTACTS — trusted contacts + support closed out
06REVIEW RETENTION — keep required, remove uncontrolled
07CAPTURE LESSONS — helped, slowed, missing, must change
08UPDATE SYSTEM — cards, checklists, contacts, kit, accounts
09RESET KIT — recharge, replace, repack, update log
10FINAL CLOSEOUT — status, level, owners, references, prevention
SIGNAL NOTES
FALSE POSITIVES

False alarm resolved, normal access, user error, equipment malfunction.

ESCALATE IF

Safety unresolved, evidence at risk, no owner, legal issue open, regulated data.

CLOSEOUT NOT COMPLETE WHILE SAFETY OR EVIDENCE UNRESOLVED
KEEP INCIDENT ACTIVE IF RED CONDITION PERSISTS
DATE
INCIDENT
FINAL LEVEL
OWNER
REFERENCES
EVIDENCE
LESSON
UPDATE