BA001Risk indicator catalogue

The defined set of observable circumstances the program treats as bearing on the likelihood of harm.

Pillar: BA | Behavioral assessment
Sources cited: 6
Added: 30 AUGUST 2026
Updated: 24 SEPTEMBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
BA001/DEMandatory	Germany	Betriebsverfassungsgesetz, section 94Bundestag · read 24 Sep 2026	That a personnel questionnaire needs the works council’s consent, and that the same applies to the drawing up of general principles of assessment.	The drawing up of general principles of assessment needs the works council’s consent, as a personnel questionnaire does, so the set of circumstances a program treats as bearing on concern is settled with the workforce before it is applied. Where no agreement is reached on the content, the conciliation board decides.
BA001/ITMandatory	Italy	Statuto dei lavoratori, article 8Parlamento della Repubblica · read 24 Sep 2026	That an employer may not enquire, including through third parties, into a worker’s political, religious or union opinions, nor into facts that do not bear on the assessment of their professional aptitude, either at hiring or during the relationship.	The employer may not enquire, including through third parties, into a worker’s political, religious or union opinions, nor into facts that do not bear on the assessment of professional aptitude, either at hiring or during the relationship. An indicator that would be established by such an enquiry cannot be gathered, whatever it is called.
Recommended	Belgiumwhere written	CyberFundamentals 2025, EssentialCentre for Cybersecurity Belgium · read 29 Aug 2026	What the Belgian centre sets out for the heaviest of its assurance levels, and the only place in this record where a national authority names the insider as something the detection tools are there to catch.	Behavioral signs are named as things training should teach people to recognize, and three are given: unusual access patterns, the hoarding of data, and sudden changes in behavior.
Recommended	United Kingdomwhere written	Insider Data Collection Study: Report of Main FindingsNPSA, published as CPNI · read 11 Aug 2026	How real insider acts occurred and what preceded them, from a review of United Kingdom cases.	Real cases have been reviewed and what preceded the acts described, which is where an indicator can be taken from rather than supposed.
Reported	Denmarkwhere written	SoK: The Psychology of Insider ThreatsSaddiqa and Ruohonen · read 11 Aug 2026	What has been published on traits, states, and situational factors, and that the foundations are thin and hard to compare across studies.	An indicator taken from this literature carries thin foundations with it, and findings that cannot readily be compared between studies.
Reported	United Kingdomwhere written	Understanding Insider Threat: A Framework for Characterising AttacksNurse, Buckley, Legg, Goldsmith, Creese, Wright, and Whitty · read 11 Aug 2026	A vocabulary for describing an insider attack in four parts: catalyst, actor, attack, and organization.	A published vocabulary is available to build the catalogue on: catalyst, actor, attack, and organization, grounded in case studies rather than telemetry.