PM-12-727 Insider Threat Program

Insider Threat Program

Control ID

PM-12-727

Control Name

Insider Threat Program

Control Category

Program Management

Functional Areas

Identify

Sub-Areas

Information Security Risk Management

NIST Baseline Level(s)

NOT SELECTED

NIST Priority

State Implementation Required

Agency Last Implemented Date

Risk Statement

Lack of consistent process to manage insider threats may result in an inability to respond to (detect and prevent) malicious insider activity.

Control Description

The organization implements an insider threat program that includes a cross-discipline insider threat incident handling team.

Control Example

The organization has an active insider threat program.

State Implementation

State implementation of this standard is incorporated into TAC 202.

Testing Procedures

Obtain procedures addressing insider threat program and ascertain if: (i) insider threat programs are implemented to detect and prevent malicious insider activity (ii) a cross-discipline insider threat incident handling team is active (iii) insider threat policies and implementation plans are established