Security Introduction
Amazon Studios (“AS”) is committed to providing a secure working environment for the protection of all cast, crew, employees, guests, intellectual property, and the AS brand. Security relies on the collaborative efforts of all cast and crew members in helping to proactively mitigate security issues and incidents. This guide provides an overview of the AS Physical Security and Digital Security expectations and base-level measures to be considered by every production.
Anyone working on an Amazon Original is expected to notify Amazon Studios Production Security Team (“PST”) of any security incidents or lost or stolen devices belonging to, accessing, or storing AS content at the earliest possible opportunity. If anyone sees something they believe could compromise the confidentiality of an Amazon Original, immediately alert the local production security contact and production-security@amazon.com. Please include a telephone number, and a team member will call as soon as possible.
For help or questions related to the Security Section of the Global Production Manual, please do not hesitate to contact PST: production-security@amazon.com.
Security Emergency Inquiries / Reporting
For emergencies or immediate threats to the safety of the production staff or assets, please notify the local police authorities as appropriate.
As soon as the situation is safe and under control please immediately report the security incident using the Incident Notification Form. You will need the password below.
Incident Notification Form - Click Here
Password: ASIR2023
In addition, all non-emergency security issues must be reported using the same form. Non-emergency security incidents may include issues associated with the following:
- Physical Asset Protection and Set Security
- Theft
- Acts of violence
- Threats of violence
- Production Facility Access Control
- Visitor Management
- Talent Protection
- Secure Production Workflows
- Digital Asset Protection
- Cyber-attack / Compromise / Breach
- Leaked Content
- Security Related Vendor Management/Vetting
Refer to the Health & Safety Emergency Policy for any set/office-related accidents.
To report a content or digital asset leak, e-mail Production-Security@amazon.com and please provide the following information:
- The name of the person reporting the incident
- The code name of the production
- Location
- Contact information
- A description of what occurred
Please also include the local Amazon Studios executive in any reports.
Physical Security Management
When there is an elevated risk to a production’s Content, Shooting Location, and/or Talent, Amazon Studios may recommend that the Production Company (“Prod Co”) hire a Security Manager or HOD who will act as a direct point of contact for the PST and be responsible for security management. PST will coordinate with the Prod Co in identifying risks and will assist in selecting the Security Manager.
All security vendors engaged by the production should, at a minimum, be licensed to practice within the particular jurisdiction for the services provided and maintain a sufficient level of liability insurance to cover the needs of the production. All contracted security vendors must maintain strict security and confidentiality practices throughout all aspects of the production. Staff are prohibited from sharing any production-related information. No unauthorized persons, photography, filming, or autograph requests are permitted.
PST maintains a trusted network of preferred security providers around the globe and can provide the Prod Co with guidance and recommendations. For any information or support regarding physical security vendors, please contact Production-Security@amazon.com.
When hiring, productions are required to ensure crew, contractors, daily hires, and extras sign a Non-Disclosure Agreement (“NDA”). The production office is responsible for maintaining a clear and auditable record of all NDAs. During the hiring process, it is Prod Co’s responsibility to conduct appropriate background/reference checks. Crew should be made aware of security requirements such as photography policy, social media restrictions, safe storage, transfer, and destruction requirements within their contracts.
Upon wrap, copies of NDAs, incident reports, visitor logs, and any information required for investigative purposes must be captured and sent to or shared through an approved platform agreed upon ahead of wrap.
The Prod Co is expected to regularly communicate security best practices, awareness, and security procedures unique to the production environment and associated risks. Security awareness briefings and messaging should be provided to all crew throughout the production. Awareness posters covering production rules regarding photography, social media, and document/asset destruction should be placed around the production facilities for all productions. Contact production-security@amazon.com for training and awareness support.
Post security awareness reminders throughout the film locations as guidance on protecting Amazon Originals’ content. PST offers branded material to assist with messaging and consistency; please see Security / Posters & Signage examples below.
Protecting physical access to people and assets is a key component of overall security.
All productions are expected to establish a perimeter barrier to help prevent unauthorized access. Where possible, access should be restricted using gates and fences. However, while on location, even something as simple as stringing up caution tape can define a perimeter and help restrict unauthorized access. Additional access control measures will be required based on coordinated discussions with PST for productions operating with high-value content and assets or for those filming in high-risk locations.
The following areas should be considered within studios and on location:
- Shared areas - where members of the public have access, i.e., reception, carparks, cafeterias
- Perimeter – the first point of entry to a premises, building, car park location
- Controlled areas – where authorized staff have unrestricted access, e.g., production office
- Restricted areas – areas only authorized people are permitted, such as the art dept, props, post production staff
All productions are expected to issue some form of visual identification that establishes who is authorized to be on set. For most productions, all crew and visitors should wear production-issued identification credentials. However, colored wristbands or stickers may also suffice. Identifiable identification should always be created and worn while within a production facility or location. The issuance of credentials should be strictly controlled and regularly reviewed. Where possible, passes are to include a contact for reporting lost IDs and include a photograph of the bearer. Badges should not reveal the official name of the production. Codenames or a production alias should be established and included on all cast and crew badges.
All visitors to a production site should be pre-authorized through the production/producer’s office. Visitors should wear identification and be escorted and accompanied by their production point of contact at all times. The following information for all visitors should, at a minimum, be captured:
- Name
- Company
- Time in/time out
- Person/people visited
In accordance with the Asset Management policies established by Amazon Studios, Production Heads of Departments should identify high-value digital and physical assets and understand the requirements for safe storage, transfer, and destruction.
Examples of high-value assets include:
- Video and audio assets (including raw footage and film)
- Photographs of sets and cast (including behind the scenes)
- Concept artwork
- Costumes, weapons, and props
- Creatures and animatronics
- Set Plans/Designs
At a minimum, high-value assets should be tracked with an auditable log. High-value digital assets are never to be transferred via email and should be shared only via AS-approved file sharing and collaboration systems. When granting access to the assets, the principle of “least privilege” is to be observed.
Physical Protection of High-Value Content: Production should also consider the implementation of certain physical security barriers/procedures to ensure that valuable content is not exposed to the public or other unauthorized viewers. Consider the following:
- Restricted Views: Place privacy screens/barricades or drapes to minimize line of sight to sets, workshops, and show and tells on set.
- Cast Visibility: Limit cast visibility to the public by strategically positioning trucks and trailers at base camp and on set, covering the cast in costume with secrecy cloaks, and organizing cast transportation vehicles in close proximity to the set.
- Visual Content: All visual or pictorial documents (i.e., from locations, art dept., previs) are only to be viewed on access-restricted systems approved by Amazon (e.g., WorkDocs, Amazon Studios Box) or as a hard copy in secure environments (e.g., offices, trailers, etc.).
- Safe Handling: Visual or pictorial documents are not to be transferred via email. Any artwork (i.e., set plans or reference material) used in workshops, stages, or exterior sets must be watermarked and stored in a lockable storage unit.
Avoid keeping cash, bank checks, and high-value items on production sites as much as possible. Payments for daily minor transactions/production needs should be made by credit card or other electronic format.
Please notify Production-Security@amazon.com if a significant amount of cash or bank stock will be kept on any production site.
Scenechronize must be used for script distribution for high-security (Tier 1) projects. Only authorized users with a legitimate business need may possess a physical script. To receive a physical script, the recipient must:
- Confirm that they've attempted all alternative solutions (e.g., Amazon Studios iPad) and provide a reason for why the solutions will not work.
- Sign an NDA for the current project (e.g., related/current season or related Amazon Original Movie title).
- Receive written approval from the Production Executive responsible for the related project.
If approved, physical scripts will be issued to specific individuals rather than groups or departments.
The creation and distribution of physical scripts should be avoided whenever possible. However, if a physical script must be printed, be sure to follow the appropriate standards:
- Script Log: An auditable log of physical script pages must be kept at all times. Any unused or revised pages must be collected and disposed of correctly.
- Watermarking: All printed pages must be individually marked on each copy with a unique ID number and recipient's name. Print on red-colored paper or anti-copy paper, rendering photocopying ineffective.
- Accountability: Only print pages that are required to complete the work for the day (e.g., side scripts). All script pages must be returned and accounted for at the end of each day.
- Protection: Never leave scripts unattended for any amount of time. Scripts should be locked away when not in use or, if required, placed into a script folder with a GPS tracker.
- Exceptions: Any exceptions to the above requirements must be approved by the Executive responsible for the title in question and discussed with Amazon Studios Content Security to ensure a Risk Assessment has been carried out.
All crew must know the risks to themselves and their valuables while traveling. Security procedures must be followed when any Amazon or Amazon Studios intellectual property is brought on any trip outside the studio. Production Security can also assist by providing location risk assessments ahead of travel to better inform the production when choosing a location and to help prepare the production to mitigate the identified risks in advance of travel. Please contact production-security@amazon.com for more information.
Digital Security Management
The Amazon Studios Content Security Team manages Digital Security. For any questions related to digital security, please email content-security@amazon.com. or review the Digital Security section of the Manual.
Photography Approval: The requestor's department head or coordinator must send a request for photography approval to AS Production and AS Marketing. The sender must include the crew member's details and the reason for the request. AS will then approve or deny using a production iPod Touch or a specific device if a more proficient camera is required. The Executive Producer's office will maintain a list of all approved crew members, logging their device ID, expiration date, and cloud account details. This will be shared amongst Amazon Studio Security, IT, and Production.
For Tier 1 productions, auditable records are to be in place, and a strict approval process must be followed. iPod Touch devices are used to control who is authorized to capture images in a production environment. Auditable records will be maintained to assist with tracking devices and off-boarding. Utilizing these devices provides a safe and secure method to upload images to a secure cloud storage area. All iPod Touch devices should be color-coded and numbered to assist security in detecting non-authorized devices.
- Issuance of Device: Approved crew will then be instructed to do the following:
- Visit the IT department for the issuing of the device.
- Arrange a meeting with the production’s Digital Asset Manager to discuss their required workflow, device use, and image capture management.
- The crew member will then be issued a separate photography-approved badge with an agreed expiration date.
- The photography device should only be used by the individual it has been assigned to and is in possession of the correct ID credentials.
- Visit the IT department for the issuing of the device.
- Specific Device: The approved photography device only captures department-relevant images and must not be used to capture personal images or images irrelevant to the crew member's job description.
- Content Management: All images are required to be fully uploaded and wiped from the device within agreed and appropriate time frames.
- Appropriate Use: The crew member should not attempt to alter the settings on the device or attempt to remove or share the images inappropriately.
- Device Credentials: Login details for the cloud account or device should never be shared. If the security of the device or cloud credentials is ever compromised, the assigned crew member must immediately contact AS Security.
- Device Accountability: The photography device should be returned to Production once the assigned crew member's approval period ends or as part of their off-boarding procedure.
- Lost & Stolen Devices: If the photography device is ever lost or stolen, the assigned crew member must contact AS Content Security immediately for the device to be remotely wiped.
AS attempts to reduce the amount of printed material and manage its data life cycle, as with all devices and equipment that touches AS content; AS asks the production to notify the IT Department if a printer is required. Using personal printers is prohibited unless pre-approved by the Prod Co.
When printed, sensitive material should have a watermark of the requestor's name and department clearly displayed. If watermarks are requested to be removed, an auditable tracking sheet must be created to ensure the location of non-watermarked material at all times.
All documents with sensitive information or intellectual property, such as artwork and call sheets, are to be disposed of by being shredded or placed within the secure, confidential shred bins provided within the production offices, workshop stages, and location environments.
Prod Cos will ensure all physical pieces of production content are handled correctly. Shred bins should be available to all crew in studio and location environments. The shred bins should be located in all offices, workshops, or set areas where confidential material is being used. Documents should be shredded on-site by an authorized secure shredding company with relevant security industry accreditation. The company will attend to production sites on an agreed schedule and will be escorted into AS facilities or locations by security personnel at all times.
Offboarding - Regular
Always be proactive in communicating that a production offboarding will occur to all responsible parties (e.g., production security, production technology, production office, etc.). To avoid confusion, this must be a written communication to the responsible parties with the first and last name of the terminating production staff, their title, and the end date.
Once the offboarding date is identified, the reporting party must notify the appropriate PST members and Production IT at support@amazonstudios.com to initiate the termination, including access removal from all digital tooling and systems related to the production.
- Make sure that the production office sends the following information to the terminating production staff’s personal email address:
- A copy of the production nondisclosure agreement (NDA) and written reminder, “Thank you for working on this production. Please remember that you are under strict NDA and cannot discuss your participation in this project without prior approval.”
- Instructions on whom to contact and obtain written approval prior to sharing participation. “Do not share any production information, including your participation, without prior written approval from the studio.” Some examples include:
- Concept art (e.g., DeviantArt.com)
- Discussing participation on social media, in video or print media publications
- IMDb credits or other industry tools
- Interviews
- Participation at in-person or virtual fan conventions
- Virtual portfolios
- Sharing on social media
Offboarding - Immediate Termination
An immediate termination occurs when an individual has breached the terms of their contract, commonly due to the following incident types safety, misconduct, or security. Any breach of contract must be reported to Production leadership and production security. If an immediate termination is decided, notify production security to execute termination appropriately (i.e., discreetly).
- Inform security management of terminating individual’s name, dept., title, and termination time.
- Include relevant termination information if the individual who is being terminated possibly poses an immediate security risk, e.g., termination due to physical misconduct or safety.
- When the individual is informed that they are being terminated, they are to be escorted at all times until off-site.
- All access to digital systems is to be cut at a time agreed upon by Production leadership or individuals HoD.
- It is recommended that this coincides with the time individual is being informed of termination.
- Notify Production IT at support@amazonstudios.com and Content-Security@amazon.com, and obtain written confirmation that access to sensitive information was revoked.
- All production equipment and technology that contains content should be identified and collected.
- Any items not collected containing content are to be reported immediately to Content Security and Production leadership so appropriate mitigations can be implemented as required.
- Make sure that the production office sends the following information to the individual’s personal email address:
- A copy of the production nondisclosure agreement (NDA) and written reminder, “Thank you for working on this production. Please remember that you are under strict NDA and cannot discuss your participation in this project without prior approval.”
- Instructions on whom to contact and obtain written approval prior to sharing participation. “Do not share any production information, including your participation, without prior written approval from the studio.”
- Some examples include:
- Concept art (e.g., DeviantArt.com)
- Discussing participation on social media, in video or print media publications
- IMDb credits or other industry tools
- Interviews
- Participation at in-person or virtual fan conventions
- Virtual portfolios
- Sharing on social media
- Some examples include:
Security Templates & Exhibits
Posters & Signage
Productions are encouraged to download the following exhibits and post them on set and in production offices.
- Paper Shredding
- Photography
- Report Suspicious Activity
- Sending Content
- Social Media - Ver 1 and Ver 2
- Production Office Sign
- Top 10 Security Tips