For many smaller organisations, security risk management sits quietly in the corner of someone’s job description. It can feel overwhelming to balance SRM with a full workload, especially when the sector is full of guidance, online tools and examples from larger NGOs with dedicated teams. This workshop is designed to help organisations cut through the noise and work out where to start, what to prioritise and how to build something that is realistic and sustainable. Drawing on the GISF Security Risk Management: A Basic Guide for Smaller NGOs, we will explore what effective SRM looks like when you have limited capacity, whether you already have a basic system with visible gaps or you are beginning from almost nothing. Key questions include how to choose the first tools to put in place, how to decide what can wait, and how to introduce SRM processes into an organisation that has managed with very little up to now. Participants will leave with a clear, practical set of first steps, a simple prioritisation method and tools they can introduce without overwhelming colleagues or themselves. The workshop is open to beginners and to those who want to strengthen what they already have.