Insider Risk Position

Control Statement

The organization shall define, and be able to execute, a rights-respecting process for resolving an indication of insider risk, with a stated disposition period.

Purpose. To be able to resolve an indication proportionately and lawfully, so that the organization is neither unable to act nor acting without safeguards.

Discussion

This control is written around resolving an *indication*, not around monitoring a population, and the distinction is the whole design. A process that begins with an indication and proceeds under defined safeguards is insider risk management; a capability that continuously scores individuals for propensity is workforce surveillance, and it corrodes exactly the cooperation that makes the rest of this family work. The rights safeguards are therefore assessed as part of the control rather than treated as an external constraint: legal and privacy review of the process, defined authority to initiate, minimum-necessary access to personal information, a disposition period that prevents indefinite open suspicion, and a route by which a closed indication leaves no residue against the person.

Goals and Metrics

A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.

Accountability

Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.

Inputs and Outputs

Activities

1. L2Define the process for resolving an indication of insider risk.
2. L2Name the process owner and the authority required to initiate.
3. L2State the disposition period within which an indication must be resolved.
4. L3Obtain legal and privacy review of the process before it is used, and record the review.
5. L3Define the minimum information the process may access at each stage, so escalation of access follows escalation of evidence rather than preceding it.
6. L3Define how a closed indication is recorded, including that an unsubstantiated indication leaves no adverse residue against the individual.
7. L3Define the route for referral to human resources, counsel or law enforcement, and the point at which the security function ceases to lead.
8. L3Flag open indications exceeding the disposition period.
9. L4Measure disposition times against the stated period, and the proportion of indications closed as unsubstantiated — a rate near zero suggests the threshold to initiate is set too high, and a rate near one that it is too low.
10. L4Test the process against a documented scenario rather than waiting for a real indication to discover it does not work.
11. L5Review closed indications for the conditions that produced them and address those conditions, since most substantiated insider events have precursors that were organizational rather than individual.

Measurement

Evidence and Assessment

Related Guidance

Position in the Chain

Derived from the other controls’ own declarations, so the two directions cannot disagree.

Where This Control Is Used

Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.