Workforce Terrain
The people who operate the estate, held as ground
The organization shall identify on the terrain overlay the roles whose compromise would materially advance an adversary, and record the population holding each.
PurposeTo make the workforce positional, so that defensive effort concentrates on the roles an adversary would actually target.Activities10 · Metrics2Every privileged account shall resolve to a named, currently employed, appropriately vetted individual, and the register shall be reconciled on a defined cadence.
PurposeTo ensure privilege is held by accountable people, so that every privileged action has a person behind it.Activities10 · Metrics3Personnel in identified workforce terrain shall receive preparation specific to how their role is actually attacked, and their readiness shall be measured rather than attested.
PurposeTo prepare people for the attacks their role attracts, and to know whether the preparation worked.Activities10 · Metrics2The organization shall define, and be able to execute, a rights-respecting process for resolving an indication of insider risk, with a stated disposition period.
PurposeTo be able to resolve an indication proportionately and lawfully, so that the organization is neither unable to act nor acting without safeguards.Activities11 · Metrics4All access held by a departing or suspended individual shall be removable in a single action, within a period measured against the tempo at which that access could be misused.
PurposeTo close the window between a person ceasing to be trusted and their access ceasing to work.Activities10 · Metrics3