| name | PM-12_insider-threat-program |
| description | Implement an insider threat program that includes a cross-discipline insider threat incident handling team. |
| category | configuration |
| version | 5.2.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-53","rev5","pm-12","pm"] |
| tech_stack | ["any"] |
| cwe_ids | [] |
| chains_with | ["AC-6","AT-2","AU-6","AU-7","AU-10","AU-12","AU-13","CA-7","IA-4","IR-4"] |
| prerequisites | [] |
| severity_boost | {"AC-6":"Chain with AC-6 for comprehensive security coverage","AT-2":"Chain with AT-2 for comprehensive security coverage","AU-6":"Chain with AU-6 for comprehensive security coverage"} |
PM-12 Insider Threat Program
High-Level Description
Family: Program Management (PM)
Framework: NIST SP 800-53 Rev 5
Organizations that handle classified information are required, under Executive Order 13587 EO 13587 and the National Insider Threat Policy ODNI NITP , to establish insider threat programs. The same standards and guidelines that apply to insider threat programs in classified environments can also be employed effectively to improve the security of controlled unclassified and other information in non-national security systems. Insider threat programs include controls to detect and prevent malicious insider activity through the centralized integration and analysis of both technical and nontechnical information to identify potential insider threat concerns. A senior official is designated by the department or agency head as the responsible individual to implement and provide oversight for the program. In addition to the centralized integration and analysis capability, insider threat programs require organizations to prepare department or agency insider threat policies and implementation plans, conduct host-based user monitoring of individual employee activities on government-owned classified computers, provide insider threat awareness training to employees, receive access to information from offices in the department or agency for insider threat analysis, and conduct self-assessments of department or agency insider threat posture.
Insider threat programs can leverage the existence of incident handling teams that organizations may already have in place, such as computer security incident response teams. Human resources records are especially important in this effort, as there is compelling evidence to show that some types of insider crimes are often preceded by nontechnical behaviors in the workplace, including ongoing patterns of disgruntled behavior and conflicts with coworkers and other colleagues. These precursors can guide organizational officials in more focused, targeted monitoring efforts. However, the use of human resource records could raise significant concerns for privacy. The participation of a legal team, including consultation with the senior agency official for privacy, ensures that monitoring activities are performed in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.
What to Check
How to Test
Step 1: Review Documentation
