INTRA/FrameworkFramework for a comprehensive insider risk management program
Nine pillars, and under each of them the measures it holds. A pillar is a structural component of an insider risk management program, and a measure is a single action or deliverable a program can implement: the unit a practitioner plans, budgets, and hands over. A program may hold all nine or some, and the order in which they are built belongs to the organization.
GVGovernance and mandate
14 measures | 40 rows | 24 binding
The authority under which an insider risk management program operates, its ownership, and the record of both.
PSPersonnel security
13 measures | 54 rows | 26 binding
The measures directed at the person: what is verified before and during employment, what is asked of the people who manage them, what the program may hold about them, and what happens when they leave.
DPData and asset protection
16 measures | 52 rows | 37 binding
The protection of the information and assets the organization holds, and of the records the program itself generates.
MDMonitoring and detection
21 measures | 136 rows | 108 binding
The technical means by which work is observed, and the conditions attaching to their deployment.
BABehavioral assessment
10 measures | 19 rows | 10 binding
The derivation of concern from the person rather than from an act.
IVInvestigation and digital forensics
13 measures | 25 rows | 8 binding
The examination of an identified person, and the handling of the material on which it rests.
IRIncident response
10 measures | 20 rows | 13 binding
The measures taken while an incident is open: containment, preservation, and notification.
CPConsequence for the person
7 measures | 8 rows | 7 binding
The action taken against a person following a finding, and the basis on which it may be taken.
AWAwareness and training
6 measures | 27 rows | 13 binding
The instruction of the workforce concerning the program, and the record of it.