MethodThe Keeping of the Records

Insider Threat and Risk Architecture (INTRA) and Insider Threat Event Requirements (ITER) are two records kept by one method. INTRA holds what each European jurisdiction has established on the measures a program is built from. ITER holds what an insider event obliges, and from when. They differ in what they hold and in one rule, stated below. In everything else they are the same record twice, and this page is where the method is written once.

The row#

A row is one thing a source establishes, stated as a fact about the source. In INTRA it is a measure as one jurisdiction conditions it. In ITER it is one reporting act, or the body it is owed to, or the national act that moves its term. A row states what a source establishes; it does not state what an organization should do with its own processes to meet it. It does not compare one jurisdiction with another, it does not rank, it does not grade an organization’s readiness, and it is not advice on compliance. A row reports, and the decision stays with whoever has to make it.

Where a source stops, the row stops with it. “What the group decides is not stated” is a better row than one that quietly implies an answer.

Entry of a row#

A row enters after its source has been read at the address the row cites. A search engine’s summary, a recollection from practice, or a secondary account does not qualify. The address is opened before it is cited, and removed when it stops resolving.

The check is the passage. A row arrives with a verbatim extract carrying the point, with the article, paragraph, or page it comes from, in the original language, and an English rendering where the original is not English. A contribution cites the provision and its location in the document.

Only sources European in origin. American material is not listed, by choice rather than by oversight: that part of the record is gathered already, and what is collected here can be used in a European organization without first subtracting the assumptions that do not hold there.

The mark, and its two readings#

Every row carries a mark, and the mark is taken from the kind of the source rather than decided row by row.

In INTRA the mark states the row’s binding force. A row is mandatory where the source is an instrument that binds in that jurisdiction, recommended where it is a standard or guidance, reported where it is research. A mandatory row is the only kind that carries a control identifier; a standard and a study are cited by their own reference. Where a row rests on more than one source, the strongest governs, because a statute is not made softer by the guidance cited beside it.

In ITER the mark states the row’s evidential standing. A row is binding where the source is the act itself or a decided case, reported where it is a register or guidance from the body that applies the act, provisional where it is an announcement, unresolved where the source records no settled position. Where a row rests on more than one source, the weakest governs, because a row is no more settled than its least settled source.

The two rules point in opposite directions and they are the same rule: what governs is what the mark measures. One record measures force, the other measures evidence, and each is read the way its mark demands.

Where a record says what something means rather than what a source establishes, it says so on its own line, marked as inference and drawn differently, so that a reader can see where the sources stop at a glance.

Dates and re-reading#

Every source carries the date it was read, and a kind, and the kind sets the interval after which it has to be read again. In ITER: two years for an act or a decided case, six months for a register or guidance, three for an announcement or an address. In INTRA: six months for guidance, two years for law and for research. Past its interval a source is named at build, and in ITER every row resting on it says stale; past twice its interval ITER’s build stops. Every measure in INTRA carries besides the date it was added and the date it was last changed. A row whose source is past its interval is marked before anyone can cite it.

Absences#

A measure nothing has been found for says so on its own page rather than leaving the gap to be discovered. A jurisdiction nothing has yet been read for is drawn unlit and listed as not yet worked in: a state of the reading, not a finding that the jurisdiction has said nothing. And where the thing itself does not exist, no European symposium, no European professional body, no program standard at Union level, the record says that too, the way it says a jurisdiction has said nothing.

Durations are not there. No source read here states how long an organization takes to do anything, so it is asked of the reader and the page does the arithmetic. No default, no typical value, no benchmark. A prefilled number is a suggestion, and a suggestion is where a record stops being a reading of the law.

Versions and the check of a copy#

Each record is two Markdown files in a public repository, under a license that lets anyone use them, change them, and build on them as long as they credit them. The data file the site reads is generated from the two files, so a correction goes to the Markdown and never to the JSON. The data file is published with its checksum, in the repository and on the site, and the two are the same bytes, so the copy you cite can be checked against the copy that was published.

The record is tagged at each release, and a citation names the tag. A tag names the state of the record on a date, with the changes since the previous tag, and the citation file says which version you have. What has changed since the tag is on the main branch, and the contributors are named.

Contributions#

The record grows by contribution and by argument. A jurisdiction may have spoken where it says nothing; a row may be formulated wrongly; a source address may have changed; a source that belongs here may be missing. Each is raised as an issue; the repositories state what a contribution carries. Whoever points at a European source the record is missing is named on the contributors page, with their agreement.