This document describes the “information management challenge” – that of ensuring the security of sensitive information in the difficult conditions that may exist in many field offices, and where the risk of surveillance is present – and posits potential solutions through strengthening a process that will ensure the consistent observance of fundamental information security procedures, and regular audits guaranteeing that security procedures are commensurate to the risk context.  It also outlines the dimensions of an information management policy, and highlights the potential risks – and means of mitigating those – that it should address.  Fundamentally, it contends that good information security requires more than simply a “technical policy” or input from IT departments; rather, it argues that an “information management culture”, matching such technical solutions to consistent observance and awareness amongst all staff and managers, is necessary.