Insider Risk Mitigation Framework

This is CPNI's recommended framework for developing an Insider Threat programme which aims to reduce insider risk. The implementation of this will facilitate an objective review of security posture and allow measures to be updated or deployed in a risk based manner.

This will ensure proportionate spending on any measures posed and make the cost benefit argument to support recommendations for security. It will also support organisational security development through the best use of insider risk mitigation methods to further mature a protective security stance.

1. Foundation

1. Board Engagement & Governance

Positive and visible Board level support for, and engagement with, protective security is vital to demonstrate to staff the value placed on security and the insider threat strategy.

2. Insider Threat Practitioners & Stakeholders

Insider Threat Practitioners and Stakeholders will need to be engaged across business areas to provide specialist insight and ensure a successful implementation of a working Insider Threat Programme.

3. Role Based Security Risk Assessment

Understanding what security risks your organisation faces is essential for developing appropriate and proportionate security mitigation measures within the insider threat programme.

2. Implementing Mitigations

Policies, Standards, Guidelines & Procedures

Ensuring proportionate policies, standards, guidelines and procedures are in place that are understood and consistently enforced is critical in any insider threat programme.

Employment Screening & Vetting

Employment screening comprises the procedures involved in deciding an individual's suitability to hold employment in a given job role.

Physical & Technical Measures

Physical and technical measures should be defined by operational requirements and should be applied alongside personnel security measures to deliver security in an integrated manner.

Security Education & Training

Effective education and training is necessary to ensure individuals know what policies, standards, guidelines and procedures are in place to maintain security.

Monitoring & Review

A programme of monitoring and review should be in place to enable potential security issues, or personal issues that may impact on an employee's work, to be recognised and dealt with effectively.

Investigation & Disciplinary

Appropriate investigation and disciplinary practices are essential in ensuring that disproportionate actions are minimised and adherence to security policies and processes are reinforced.

3. Concurrent Actions

Communications

An insider threat programme should integrate effectively with the organisation’s overall communications’ strategy.

Read more
Security Culture

A good security culture in your organisation is an essential component of a robust protective security regime and helps to mitigate against insider threats and external people threats.

Read more
Continuous Improvement

The Insider Threat programme should be continuously reviewed to measure the effectiveness of any resources used and that it correctly reflects the current threats and vulnerabilities in your organisation.

Read more

Download Diagram