Family and Household Protection Program: Operational Service Playbook
Deliverable EP-032. Structure per cc02-standards/SERVICE-STANDARD.md. Every watch item binds a tripwire, a cadence, and an escalation route, or it is removed.
Document Control
| Field | Value |
|---|---|
| Service Reference | [REF-YYYY-###] |
| Classification | internal |
| Version | 0.1.0 |
| Prepared By | [Operations Manager] |
| Effective Date | [YYYY-MM-DD] |
| Term | [12 Months] |
| Principal / Household | [PRINCIPAL / FAMILY OFFICE NAME] |
| Site Posture Baseline | [EP-005-residential-security-survey] (Report Reference [REF-YYYY-###]) |
Scope, Authorities & Limitations
This is a monitoring/operational service, not an investigation, a guarantee of detection, or legal advice. Collection is limited to lawful, authorized sources within the agreed scope; no unlawful access, intrusion, pretexting, or surveillance of non-consenting third parties is performed. Alerting is best-effort within the stated SLA and does not warrant prevention of any event.
Service Definition and Scope Boundaries
This service is the standing program for the people of the household - family members and household staff - as distinct from the physical site, which the residential security survey covers.
- Inclusions: Standing protection tiering for family members and household staff, family-movement coverage decisions, household staff continuous-monitoring intake, visitor and vendor access management at the residence, a family and staff security awareness program, and children-specific protective measures.
- Exclusions: Physical and structural survey of the residence itself (see [EP-005-residential-security-survey], the site-posture foundation this program consumes and does not repeat); the one-time pre-placement background investigation of a household staff candidate (see [OSINT-009-domestic-and-household-staff-vetting], the vetting gate this program cites and does not re-perform); digital-footprint collection or remediation work on family members (see [OSINT-044-family-and-household-digital-exposure-assessment], cited for awareness content only); and stand-up of a dedicated protective detail or covert detail (see [EP-013-protective-detail-retainer] / [EP-014-covert-protection-detail], which this program requests as a rider when tiering escalates to Principal-tier coverage rather than reproducing detail staffing here).
Protected Population Census
Census is a roster, not a narrative. Family members are recorded by role placeholder, never by name in this cell; household staff by position. Update on every hire, departure, or family-composition change (see Review & Renewal).
| Category | Population Entry | Protection Tier (see below) | Census Status |
|---|---|---|---|
| Family - Principal’s spouse/partner | [SPOUSE / PARTNER - ROLE PLACEHOLDER] | [Principal-level / Family-tier] | [Current / Pending Review] |
| Family - child | [CHILD 1 - AGE BAND PLACEHOLDER] | [Principal-level / Family-tier] | [Current / Pending Review] |
| Family - child | [CHILD 2 - AGE BAND PLACEHOLDER] | [Principal-level / Family-tier] | [Current / Pending Review] |
| Family - other resident relative | [RELATIVE - ROLE PLACEHOLDER] | [Family-tier] | [Current / Pending Review] |
| Household staff | [ESTATE MANAGER - POSITION] | [Staff-awareness-tier] | [Current / Pending Review] |
| Household staff | [NANNY / CHILDCARE - POSITION] | [Staff-awareness-tier] | [Current / Pending Review] |
| Household staff | [HOUSEKEEPER - POSITION] | [Staff-awareness-tier] | [Current / Pending Review] |
| Household staff | [PRIVATE CHEF - POSITION] | [Staff-awareness-tier] | [Current / Pending Review] |
| Household staff | [DRIVER - POSITION] | [Staff-awareness-tier] | [Current / Pending Review] |
| Household staff | [GROUNDSKEEPER / MAINTENANCE - POSITION] | [Staff-awareness-tier] | [Current / Pending Review] |
Protection Tiering
Tiering sets what coverage a census entry draws by default; it does not override an ad-hoc escalation raised through §4.
| Tier | Population | Criteria (exposure and threat) | Default Coverage Model |
|---|---|---|---|
| Principal-level | [PRINCIPAL, and family members co-located with or substituting for the principal at an event] | [Direct exposure to the principal’s own threat profile; public co-appearance; named threat referencing this individual] | Detail coverage per [EP-013-protective-detail-retainer] / [EP-014-covert-protection-detail] rider |
| Family-tier | [SPOUSE/PARTNER, CHILDREN, OTHER RESIDENT RELATIVES on independent movements] | [Independent public exposure; school/activity routine; no named threat but shares the principal’s surname or public identification] | Hardened-routine-only per §Family Movement Patterns, escalable to detail coverage on trigger |
| Staff-awareness-tier | [HOUSEHOLD STAFF in all positions] | [Proximity/access trust, not independent public exposure] | Awareness program (below) plus continuous monitoring intake; no dedicated coverage |
Family Movement Patterns and Coverage Rule
States when a family movement draws detail coverage and when a hardened routine (fixed route, fixed timing discipline, no dedicated operator) is sufficient. Coordinates with [EP-003-route-analysis] and [EP-004-motorcade-movement-plan] in lightweight form: this program does not re-run route analysis, it invokes the existing route product when a movement crosses the coverage threshold.
- Recurring movement categories in scope: school runs, extracurricular/activity transport, medical and personal appointments, and domestic-staff-driven errands (grocery, dry cleaning, deliveries pickup).
- Hardened-routine-only baseline: applies to Family-tier and Staff-awareness-tier movements below the coverage threshold. Consists of: fixed primary/alternate route pair drawn from the residence’s existing [EP-003-route-analysis] where one exists, fixed timing windows, driver briefed on choke points and safe havens, and a check-in call at departure and arrival.
- Coverage threshold (rule): a family movement escalates from hardened-routine-only to detail coverage when any of the following holds: (a) the movement is Principal-level per the tiering table; (b) an active watch-item tripwire is firing per §1 at Elevated or above; (c) the movement is to a venue with public advance notice (recital, tournament, media event) that increases predictability; or (d) the household requests coverage for a specific movement as a rider.
- Route discipline (lightweight form): where a family movement escalates to detail coverage, the assigned operator draws the route from the existing [EP-003-route-analysis] and, for a multi-vehicle movement, the existing [EP-004-motorcade-movement-plan]; this program does not generate a new route or motorcade plan, it invokes the current one and flags a gap to the Detail Intelligence Officer (DIO) if no current route product exists for the movement in question.
Household Staff Protocols
Two distinct controls apply to household staff: a one-time pre-placement gate and a continuous in-service watch. Neither substitutes for the other.
- Initial vetting gate (one-time): every household staff position is vetted before placement or access-card issuance via [OSINT-009-domestic-and-household-staff-vetting]. This program does not re-perform that screening; it cites the completed report reference and suitability recommendation as the entry condition for census inclusion.
- Continuous monitoring (in-service): incumbent household staff are carried on the
ART-insider-threat-monitoringpopulation fed by [OSINT-012-continuous-re-vetting-and-insider-threat-monitoring]. This program is the consumer of that artifact for the household staff cohort; it does not stand up its own re-vetting collection. - Intake path for a flag:
- An
ART-insider-threat-monitoringalert on a household staff member reaches the Detail Intelligence Officer (DIO) as first reviewer. - The DIO makes a protective-significance determination: does the flag bear on family or principal safety (access, proximity, movement knowledge, coercion/leverage exposure), or is it an employment-only matter with no protective nexus.
- Protective significance found: the DIO drafts an [EP-027-field-contact-and-suspicious-activity-report] and routes it into the household’s Threat Case Assessment and Management (TAM) case file (OSINT-052) for case-level tracking and management action.
- No protective nexus: the DIO routes the flag to the household’s Estate Manager (EM) point of contact as an employment-relevant record only; no EP-027 is generated.
- An
- Lawful employment-action boundary: the firm’s role is limited to reporting the graded observation through the path above. The firm does not hire, discipline, or terminate household staff. Any employment action following a flag is a decision of the client as employer, taken on the client’s own authority and counsel. This boundary is stated to every recipient of a flag report and is not to be represented otherwise.
Visitor and Vendor Access Management
Access control at the residence is a people-and-process layer on top of the physical access-control measures already surveyed in [EP-005-residential-security-survey] §5.6 and §5.7; this program does not re-inspect the hardware, it operates the roster and escort rules against it.
| Control | Rule |
|---|---|
| Authorized visitor list | [MAINTAINED BY - e.g. Estate Manager]; updated [CADENCE, e.g. weekly]; cross-checked at the gate against photo ID |
| Unlisted visitor | Denied entry pending verbal confirmation from a household member or the Estate Manager; logged regardless of disposition |
| Escort rule | [VISITOR CATEGORY, e.g. contractors, one-time service calls] require escort by household staff or security post for the duration of access; [VISITOR CATEGORY, e.g. recurring vetted vendors] may hold standing unescorted access to [DEFINED ZONES ONLY] |
| Delivery protocol | Deliveries received at [DESIGNATED DELIVERY POINT, not primary entrance]; package/parcel accepted only after [SCREENING STEP]; no delivery personnel admitted beyond the designated point without an escort |
| Recurring vendor vetting | Recurring vendors (landscaping, maintenance, catering) are held to the same access-card and vetting-status discipline as the [EP-005] §5.7 household staff access register; vendor entries are added to that register, not tracked separately |
| Access log retention | [RETENTION PERIOD] in line with [EP-005] systems-security audit retention |
Family and Staff Security Awareness Program
Awareness content is delivered, not investigated, by this program; where a finding requires collection it is routed to the named upstream product rather than performed here.
- Social media discipline: family members and household staff are briefed on the exposure classes identified in [OSINT-044-family-and-household-digital-exposure-assessment] (per-member digital exposure, cross-contamination and leverage pathways) as a standing awareness topic; this program does not conduct or update that assessment, it cites its remediation guidance and schedules the family’s periodic re-briefing.
- Elicitation recognition: household staff and family members are briefed on recognizing elicitation attempts (unsolicited probing of schedules, routines, access details, or family composition by strangers, delivery personnel, or online contacts) and the immediate reporting step (below).
- Duress procedures (household form): a simplified duress signal set, scaled down from the operator-grade PACE plan at [EP-011-communications-plan-pace] §5, is briefed to family members and household staff: a verbal duress phrase for use in a phone call or in front of a visitor, and a single designated emergency contact number to reach the Detail Leader (DL) or, absent detail coverage, the Estate Manager (EM).
- Reporting path: family members and household staff report a suspicious contact, elicitation attempt, unlisted visitor, or duress event to [DESIGNATED INTAKE - e.g. Estate Manager or on-duty operator], who forwards it to the DIO; where the report meets protective-significance criteria (see Household Staff Protocols intake path) it is written up as an [EP-027-field-contact-and-suspicious-activity-report].
Children-Specific Measures
Stated soberly: these are administrative and liaison controls, not tactical ones. No child-specific finding, name, or school identity is recorded in this cell.
- School liaison: [ESTATE MANAGER / DESIGNATED LIAISON] maintains a point of contact with each child’s school administration for security-relevant coordination (authorized-pickup changes, schedule changes, and notification in the event of a security incident).
- Custody-document staging: where custody or guardianship documentation bears on who may collect a child, current copies are staged with the school and with [DESIGNATED HOUSEHOLD REPOSITORY]; any change to custody status is routed to the school liaison and to the DIO for the authorized-pickup list update below.
- Authorized-pickup list: each school-age child has a current authorized-pickup list held by the school and by the household; the list is reconciled at each program review (§6) and immediately on any custody-document change; an attempted pickup by a person not on the list is a §1 watch item.
1. Scope & Watch Criteria / Tripwires
| Watch Item | Indicator | Tripwire Threshold | Severity (L×I) | Escalation Route |
|---|---|---|---|---|
| Household staff insider-threat flag | ART-insider-threat-monitoring alert on a census-listed staff member | Any alert graded Elevated or above per OSINT-012 severity bands | Elevated (11-15) to High (16-20) per source grade | DIO review; EP-027 to TAM (OSINT-052) if protective significance found |
| Family movement pattern break | Deviation from the briefed hardened route or timing window on a recurring movement | Deviation exceeds [N] minutes or departs the briefed route | Elevated (11-15) | Alert to DL (if covered) or EM; verify with driver/staff member directly |
| Unauthorized pickup attempt | Person not on the authorized-pickup list presents at school or activity site | Any such attempt, regardless of outcome | High (16-20) | Immediate notification to school liaison, EM, and DL; EP-027 filed |
| Visitor/vendor access anomaly | Unlisted visitor at gate, or listed vendor outside escort/access rule | Any denied-entry event or escort-rule breach | Moderate (6-10) | Logged; notify EM; DIO review if recurring |
| Family digital exposure critical finding | OSINT-044 reassessment surfaces a Critical or High-severity household exposure item | Grading at Critical or High per OSINT-044 severity register | High (16-20) to Critical (21-25) | DIO briefs household; remediation routed to OSINT-044 owner, not performed here |
| Duress signal | Verbal duress phrase or emergency contact used by family member or staff | Any use, regardless of later confirmation | Critical (21-25) | Immediate notification to DL/EM and, where covered, activation of detail response |
| Household staff turnover | Departure, termination, or new hire in a census position | Any change in household staff census | Moderate (6-10) | Trigger-based program review per §6; new hire gated by OSINT-009 before census entry |
2. Collection Cadence & Sources
| Source/Lane | Collection Method | Cadence | Source Grade | Owner |
|---|---|---|---|---|
ART-insider-threat-monitoring feed | Continuous re-vetting signals per OSINT-012 | Continuous, reviewed on receipt | B2 | Detail Intelligence Officer (DIO) |
| Household staff pre-placement vetting | OSINT-009 completed report, cited at hire | One-time, at onboarding | A2 | DIO / Estate Manager |
| Family digital exposure posture | OSINT-044 assessment, cited for awareness content | [Annual / on request re-assessment cadence set by OSINT-044 owner] | B2 | DIO |
| Visitor/vendor access log | Gate log and escort record review | [Weekly] | A1 | Estate Manager |
| School liaison contact | Direct liaison check-in | [Per school term / on change] | B2 | School Liaison |
| Family movement schedule review | Review of upcoming recurring movements against tiering | [Weekly] | A1 | Detail Leader (DL) / Estate Manager |
3. Reporting Cadence & Product Format
| Product | Trigger/Cadence | Format | Recipient | Channel |
|---|---|---|---|---|
| Staff flag intake log | On each ART-insider-threat-monitoring alert | Log entry with DIO disposition | Operations Manager | Secure Portal |
| EP-027 field contact / suspicious activity report | On protective-significance determination | Structured report per EP-027 | TAM (OSINT-052) case owner, Operations Manager | Secure Email |
| Family movement schedule brief | [Weekly] | Table of upcoming movements and coverage tier | DL / Estate Manager | Secure Chat |
| Household program digest | [Monthly] | Markdown summary of census, flags, access log exceptions | Client | Secure Portal |
| Quarterly program review report | Quarterly per §6 | PDF executive summary | Client | Secure Email |
4. Escalation & Notification Triggers
Risk scoring key (reproduce verbatim): Likelihood (1-5) x Impact (1-5) = 1-25; 1-5 Low - 6-10 Moderate - 11-15 Elevated - 16-20 High - 21-25 Critical.
| Severity Tier | Trigger Condition | Notify | Method | Acknowledgement Target |
|---|---|---|---|---|
| Low (1-5) | Routine log entry, no action required | Operations Manager | Log update | 24 Hours |
| Moderate (6-10) | Access anomaly, routine staff turnover | Estate Manager, DIO | Secure Chat | 24 Hours |
| Elevated (11-15) | Staff insider-threat flag, movement pattern break | DIO, DL, Operations Manager | Secure Chat and Call | 4 Hours |
| High (16-20) | Unauthorized pickup attempt, high-severity digital exposure finding | DL, Estate Manager, TAM case owner | Secure Call | 1 Hour |
| Critical (21-25) | Duress signal | DL, Operations Manager, Client point of contact | Secure Call, immediate | 15 Minutes |
5. Service Levels (SLA)
| Metric | Target | Measurement | Reporting | Remedy/Credit |
|---|---|---|---|---|
| Staff flag review turnaround | DIO disposition within [4] business hours of alert receipt | Alert timestamp vs. disposition timestamp | Monthly | Process review with DIO |
| EP-027/TAM escalation turnaround | Filed within [24] hours of protective-significance determination | Determination timestamp vs. filing timestamp | Monthly | Escalation SOP retraining |
| Access-list update turnaround | Visitor/vendor list updated within [1] business day of a change request | Request timestamp vs. update timestamp | Monthly | Service credit |
| Duress response acknowledgement | 100% within Critical-tier target (§4) | Duress log vs. acknowledgement timestamp | Continuous | Full incident review |
| Quarterly review punctuality | 100% delivered on schedule | Delivery log vs. contract schedule | Quarterly | Extended term / credit |
6. Review and Renewal
Two review triggers apply: the standing calendar cadence and any trigger event that invalidates the current census or tiering.
| Review Type | Cadence / Trigger | Scope |
|---|---|---|
| Standing program review | Quarterly | Census accuracy, tiering assignment, access-list reconciliation, awareness-program currency |
| Trigger-based review | Household staff turnover (hire, departure, termination) | Re-run census update; new hire gated by OSINT-009 before census entry; departing staff offboarded per Annex B |
| Trigger-based review | Material threat-level change (principal threat profile escalation, named threat referencing family) | Re-run tiering assignment; consider Family-tier to Principal-level escalation |
| Trigger-based review | Family composition change (birth, custody change, new resident relative) | Update census, authorized-pickup list, and school liaison contact |
| Change-control | Any scope, tier, or coverage-model modification | Written addendum to ART-engagement-order-equivalent household service agreement |
| Renewal | [Annual] | Full census, tiering, and vetting-currency re-authorization |
| Termination | [N] days written notice | Offboarding per Annex B; stand-down fees at [N]% of standard rate |
7. Engagement Model and Pricing
Placeholder commercial structure; final terms are set in the client service agreement, not in this cell.
| Tier | Scope Included | Pricing Model | Placeholder Rate |
|---|---|---|---|
| Full Program (Principal-level eligible) | Census, tiering, staff continuous monitoring, family movement coverage decisions, awareness program, children-specific measures, detail-rider eligibility | Monthly retainer | [$N / month] |
| Staff Monitoring and Awareness | Household staff continuous monitoring intake, visitor/vendor access management, family and staff awareness program | Monthly retainer | [$N / month] |
| Staff Monitoring Only | ART-insider-threat-monitoring intake and escalation path only | Monthly retainer | [$N / month] |
| Detail-coverage rider | Family-tier movement escalated to detail coverage per Coverage Rule | Billed per [EP-013] / [EP-014] rate schedule | [$N / hour or day] |
| Minimum term | [N months] | - | - |
| Setup / onboarding fee | One-time, covers census build and initial OSINT-009 gating coordination | One-time | [$N] |
8. Service Risk Register
- Risk 1: Household staff turnover outpaces vetting-gate turnaround, leaving a census position unvetted. Likelihood (2) x Impact (4) = 8 (Moderate). Mitigation: OSINT-009 gate is a hard entry condition for census inclusion; no interim access pending completion.
- Risk 2: Family-tier movement predictability increases through unbriefed schedule disclosure (e.g. school event listings). Likelihood (3) x Impact (3) = 9 (Moderate). Mitigation: awareness program covers schedule-disclosure discipline; reconcile against OSINT-044 findings at each quarterly review.
- Risk 3: Employment-action boundary is misread by the client as the firm having termination authority over flagged staff. Likelihood (2) x Impact (3) = 6 (Moderate). Mitigation: boundary statement reproduced in every flag report and restated at program review.
Annex A: Source and Watch-List Register (graded)
NATO Admiralty source reliability (A-F): A Completely reliable - B Usually reliable - C Fairly reliable - D Not usually reliable - E Unreliable - F Reliability cannot be judged.
NATO Admiralty information credibility (1-6): 1 Confirmed by other sources - 2 Probably true - 3 Possibly true - 4 Doubtful - 5 Improbable - 6 Truth cannot be judged.
| Source / Watch Item | Lane | Grade | Last Verified | Notes |
|---|---|---|---|---|
ART-insider-threat-monitoring feed | Household staff continuous monitoring | B2 | [YYYY-MM-DD] | Fed by OSINT-012 |
| OSINT-009 vetting record | Household staff onboarding gate | A2 | [YYYY-MM-DD] | One-time per hire |
| OSINT-044 exposure posture | Family and staff awareness content | B2 | [YYYY-MM-DD] | Reassessment cadence set by owner |
| Visitor/vendor access log | Residence access control | A1 | [YYYY-MM-DD] | Ties to EP-005 systems-security audit |
| School liaison contact | Children-specific measures | B2 | [YYYY-MM-DD] | Per-term or on-change |
Annex B: Onboarding / Offboarding and Data-Handling Checklist
- Onboarding Checklist:
- Confirm household service agreement and effective date.
- Build initial protected population census (family and staff) from principal/family office intake.
- Assign protection tier to each census entry.
- Confirm OSINT-009 completion status for each household staff position; gate census entry on completion.
- Register household staff cohort on the
ART-insider-threat-monitoringpopulation. - Pull [EP-005-residential-security-survey] for the current access-control and systems-security baseline.
- Establish visitor/vendor access list and escort rules.
- Brief family and staff on the awareness program, including household-form duress signals.
- Establish school liaison contact and authorized-pickup list for each school-age child.
- Offboarding Checklist:
- De-provision departing household staff access credentials.
- Remove departing staff from the
ART-insider-threat-monitoringpopulation. - Archive census, flag, and access-log records per retention schedule.
- Conduct client exit debrief and confirm handoff of any open TAM case items.
- Data-Handling: Store family census and vetting-status records on encrypted drives, access restricted to DIO and Operations Manager; store no child-identifying school or custody detail beyond the designated household repository; destroy superseded census and access-log records after [N] days.
END OF SERVICE PLAYBOOK
Model wiring
Generated from cell frontmatter at publish time.