Insider Threat and Risk Architecture (INTRA)
Definition
Insider Threat and Risk Architecture (INTRA) is a living three-level framework for building an insider risk management program in Europe.
- measures
- 110
- rows written
- 577
- binding
- 388
- jurisdictions
- 23 of 34
- sources
- 143
- Pillar. One of the nine parts a program is built out of. The nine do not change from one jurisdiction to another: what the law varies is what a program does inside a pillar, never which pillars the framework has.
- Measure. A single action or deliverable under a pillar, and the unit a practitioner plans, budgets, and hands over. Almost all of them are the same thing in one European country as in another. A few exist only because a law somewhere created the need for them, and those are the ones that travel least.
- Control. A measure as one European jurisdiction binds it. Where an instrument that binds there sets a condition on a measure, the measure so conditioned is a control, and it carries an identifier of its own. Where a standard or a study speaks to a measure instead, what stands against it is a row and not a control.
A control states the condition and names the source it comes from. It does not state what an organization should do, it does not compare one jurisdiction with another, and it is not advice on compliance.
Scope
Thirty-four jurisdictions in scope.
The European Union, the Council of Europe, every state in which Union or European Economic Area law applies, the United Kingdom, and Switzerland. A source qualifies if it is European in origin and if it sets out how a program is built, states a legal constraint on how one may operate, or reports research findings. American material is not listed: that part of the record is gathered already, and what is collected here can be used in a European organization without first subtracting the assumptions that do not hold there.
What a measure carries depends on what has been found for it.
- A source worked in. A control, or a row where the source does not bind, is written from it.
- A source not yet worked in. It is named on the measure, and nothing follows from it.
- No source at all. Nothing in the European record has been found to bear on the measure, which leaves it inside the framework and the question open.
Every row states its standing, and the standing is not a judgment about the row.
The standing is taken from the kind of the source, not decided row by row, and where a row rests on more than one the strongest governs, because the mark states binding force, and a statute is not made softer by the guidance cited beside it. ITER’s mark states evidential standing, and there the weakest governs. Nothing here weighs an obligation against a recommendation or records one as the other. A binding row is a mandatory one, and it is the only kind that carries a control identifier, since a standard and a study are cited by their own reference.
Sources
Everything here is written in two files, and both are public.
The framework and the library are kept as Markdown in a repository, under a license that lets anyone use them, change them, and build on them as long as they credit them. The data the site reads is generated from those two files, so a correction goes to the Markdown and never to the JSON. The repository holds the source files this page is built from, and anyone who thinks a control is formulated wrongly, or knows a source that belongs here, can open the question there. The method both records are kept by is written once.
Absences
Part of what INTRA maps is still missing at European level. The discipline has national forums, such as the Security Institute’s Insider Risk Conference in the United Kingdom, and meetings organized from outside Europe, such as the Insider Risk Practitioner Alliance’s Nordic summit; none of them has become a Europe-wide reference, and the longest-running event in the field, the National Insider Risk Symposium, is American, in its eleventh edition. No professional body dedicated to the discipline at European level has been identified; where it is organized, it is as a group inside a broader security body. There is no program standard at Union level, the only thematic report from the Union agency dating from 2020 and the only program development manual from 2019. INTRA records those absences the way it records a jurisdiction that has said nothing.
Version
Last reviewed 5 October 2026. 110 measures, 577 rows written across 23 of 34 jurisdictions in scope, 388 of them binding. Each measure carries the date it was last changed. The data file is published with its checksum, so what you cite can be checked against what was published.
Contributing
INTRA grows by contribution and debate. If a control needs reformulating, if a jurisdiction has said something this does not record, or if a source belongs here and is missing, write to me on LinkedIn. Contributors are named with their agreement.
Insider Threat and Risk Architecture (INTRA), Insider Threat Event Requirements (ITER), and Insider Risk Atlas are the names of three works by Alessandro Aledda, published under CC BY 4.0.