Insider Threat Program Strategy

To implement a complete insider threat program, agencies should adopt a data collection and monitoring framework that includes the following:

Organizational Processes
Helps detect suspect attitudes and behaviors

• Culture
• Performance reviews
• Analytics
• Workflows

Internal information
Helps identity suspect use of internal data and resources

• Cybersecurity controls
• Activity monitoring
• Internet traffic
• Data loss

External information
Helps uncover at-risk individuals and suspect associations

• Traditional credit
• Alternative financial
• Public records
• PAEI
• Device intelligence

Using this framework enables agencies and contractors to better identify insiders who should be considered for threat evaluation and investigation.