Insider Threat and Risk Architecture (INTRA)
What INTRA is
Insider Threat and Risk Architecture (INTRA™) is a living three level framework for building an insider risk management program in Europe.
- measures
- 110
- rows written
- 381
- binding
- 246
- jurisdictions
- 15 of 34
- sources
- 71
- Pillar. One of the nine parts a program is built out of. The nine do not change from one jurisdiction to another: what the law varies is what a program does inside a pillar, never which pillars it has.
- Measure. A single action or deliverable under a pillar, and the unit a practitioner plans, budgets, and hands over. Almost all of them are the same thing in one European country as in another. A few exist only because a law somewhere created the need for them, and those are the ones that travel least.
- Control. A measure as one European jurisdiction binds it. Where an instrument that binds there sets a condition on a measure, the measure so conditioned is a control, and it carries an identifier of its own. Where a standard or a study speaks to a measure instead, what stands against it is a row and not a control.
A control states the condition and names the source it comes from. It does not state what an organization should do, it does not compare one jurisdiction with another, and it is not advice on compliance.
Where it applies
Thirty-four jurisdictions in scope.
The European Union, the Council of Europe, every state in which Union or European Economic Area law applies, the United Kingdom, and Switzerland. A source qualifies if it is European in origin and if it sets out how a program is built, states a legal constraint on how one may operate, or reports research findings. American material is not listed: that part of the record is gathered already, and what is collected here can be used in a European organization without first subtracting the assumptions that do not hold there.
What a measure carries depends on what has been found for it.
- A source worked in. A control is written from it.
- A source not yet worked in. It is named on the measure, and nothing follows from it.
- No source at all. Nothing in the European record has been found to bear on the measure, which leaves it inside the framework and the question open.
Every row states its standing, and the standing is not a judgment about the row.
The standing is taken from the kind of the source, not decided row by row, and where a row rests on more than one the strongest governs, because the mark says how hard a row binds, and a statute is not made softer by the guidance cited beside it. ITER’s mark says how far a row can be trusted, and there the weakest governs. Nothing here weighs an obligation against a recommendation or records one as the other. A binding row is a mandatory one, and it is the only kind that carries a control identifier, since a standard and a study are cited by their own reference.
Where to find the sources
Everything here is written in two files, and both are public.
The framework and the library are kept as markdown in a repository, under a license that lets anyone use them, change them, and build on them as long as they credit them. The data the site reads is generated from those two files, so a correction goes to the markdown and never to the JSON. What the repository holds is what this page is built from rather than a copy of it, and anyone who thinks a control is formulated wrongly, or knows a source that belongs here, can open the question there. The method both records are kept by is written once.
Absences
Part of what INTRA maps does not exist. There is no European insider symposium: the reference event in the field is American, in its eleventh edition. There is no European professional body for the discipline. There is no program standard at Union level, the only thematic report from the Union agency dating from 2020 and the only program development manual from 2019. INTRA records those absences the way it records a jurisdiction that has said nothing.
Version
20 SEPTEMBER 2026. 110 measures, 381 rows written across 15 of 34 jurisdictions in scope, 246 of them binding. Each measure carries the date it was last touched. The data file is published with its checksum, so what you cite can be checked against what was published.
Contributing
INTRA grows by contribution and debate. If a control needs reformulating, if a jurisdiction has said something this does not record, or if a source belongs here and is missing, send me a message on LinkedIn. Contributors are named unless they ask not to be.
INTRA™ and ITER™, Insider Threat and Risk Architecture and Insider Threat Event Requirements, are unregistered trade marks of Alessandro Aledda.