FSO PROS Snippet Category: Insider Threat
Monthly Newsletter
Insider Threat
Insider threats may seem unlikely, but they’re one of the most significant risks facing organizations within the defense and national security communities. During Insider Threat Awareness Month, we’re reinforcing key concepts around insider threat and highlighting how each of us plays an important role in identifying and reporting early indicators.
Every cleared contractor facility is required to maintain an organization wide Insider Threat Program Plan. This plan outlines how the organization identifies, responds to, and mitigates insider threat risks, and ensures personnel know how to report potential concerns. All personnel should have access to their facility’s Insider Threat Program Plan. If you have not received information about yours, contact your Facility Security Officer (FSO) or Insider Threat Program Security Official (ITPSO) immediately.
Understanding Insider Threats
Insider threats occur when individuals with authorized access (employees, contractors, or trusted partners) use that access, either intentionally or unintentionally, in ways that could harm national security, the organization, its personnel, or its information. Insider threats are not limited to espionage or classified information compromise. They can also involve the mishandling of CUI, cybersecurity risks, fraud, workplace violence, sabotage, serious negligence, and more.
Insider threat risks often develop gradually over time. In many cases, early indicators are observable long before any damage occurs. These indicators may appear as changes in behavior, attempts to bypass security procedures, unusual access patterns, or signs of personal stressors that could impact judgment.
You are not expected to investigate or diagnose these concerns, only to recognize and report them. The Insider Threat Program is designed to evaluate information, provide support when needed, and ensure risks are addressed early and appropriately.
Indicators of an Insider Threat
Insider threat indicators are observable behaviors, actions, or circumstances that may suggest an individual is at risk of misusing their authorized access. These indicators do not confirm wrongdoing, and they are not intended to diagnose a situation. Instead, they help identify concerns that may warrant further review by your security team. The examples below are not exhaustive, and insider threat indicators can appear in many different ways depending on the situation and the individual involved.
Behavioral Indicators
Behavioral indicators are actions or patterns that appear unusual or inconsistent with normal expectations. Examples include:
- Attempts to ignore or work around security rules
- Sudden or unexplained frustration with the organization or coworkers
- Noticeable changes in reliability or personal conduct
- Expressions of resentment or hostility toward the workplace
- Personal stressors such as financial difficulties or legal issues that appear to affect judgment
Information Security and Cyber Indicators
Information security indicators involve suspicious or inappropriate activity related to systems or digital information. Examples include:
- Attempts to access information without a valid need to know
- Excessive downloading or transferring of files
- Use of unauthorized devices, storage media, or applications
- Repeated failed login attempts or unusual access patterns
- Attempts to alter or delete data without authorization
Workplace and Professional Indicators
Workplace indicators reflect unusual changes in behavior or performance within the professional environment. Examples include:
- Repeated conflicts with supervisors or colleagues
- Efforts to operate outside assigned duties or responsibilities
- Unexplained decline in work quality or consistency
- Resistance to feedback or corrective measures
- Attempts to conceal mistakes or avoid accountability
Physical Security Indicators
Physical security indicators relate to attempts to gain access to areas or information without proper authorization. Examples include:
- Attempting to enter restricted or classified areas without approval
- Tailgating or escort issues
- Leaving badges unattended or allowing others to use access credentials
- Unusual interest in physical layouts or security procedures
Personal Conduct Indicators
Personal conduct indicators involve circumstances that may impact judgment or increase vulnerability. Examples include:
- Sudden financial strain or unexplained wealth
- Substance misuse
- Threatening statements or conduct
- Significant life stressors affecting behavior or workplace engagement
- Expressions of desperation or withdrawal paired with unusual workplace behavior
Reporting Insider Threat Concerns
Reporting insider threat indicators is one of the most effective ways to prevent harm before it occurs. Most insider threat incidents do not happen suddenly. They typically develop over time, and early warning signs are often visible long before any damage is done. When personnel report concerning behaviors or unusual activity early, the security team can review the information, provide support when appropriate, and take steps to reduce risk to national security, the organization, and all personnel.
Reporting concerns does not mean you are accusing someone of wrongdoing. It simply ensures that your security officials can evaluate the situation and determine what actions, if any, may be needed. Even a small observation can be an important part of a larger picture.
It is important to note that we should report information relevant to the concerning behavior or activity and avoid sharing personal details that are not connected to the concern.
How to Report
Reporting insider threat concerns is simple. If you observe behavior or activity that seems unusual, inconsistent with policy, out of place, or otherwise concerning, document what you saw and notify your security officials as soon as possible. Include dates, times, observations, and any context you feel may be helpful. You do not need certainty or proof. You only need to share what you observed.
If you are unsure whether something should be reported, make the report and allow your security officials to determine next steps.
Who to Report To
All insider threat concerns must be reported directly to your Facility Security Officer (FSO) or your Insider Threat Program Security Official (ITPSO). These officials are responsible for reviewing the information, coordinating with other security and counterintelligence personnel when needed, and ensuring all actions align with regulatory requirements. If you work at a government site or a host contractor location, you may also notify their security staff but always ensure your facility FSO or ITPSO is informed.
Resources and Additional Learning
Continued learning is an important part of supporting a strong security program. The resources below offer helpful guidance, job aids, training modules, and official policy documents that reinforce the topics discussed in this newsletter. We encourage all personnel to explore these materials and become familiar with the tools and requirements that govern and support your organization’s industrial security program.
CDSE Insider Threat Awareness course
CDSE Insider Threat for Industry Curriculum
32 CFR Part 147 (Adjudicative Guidelines)
As always, if you have any questions…ask your FSO! Your company’s FSO is the best person to help you navigate any questions you have about security compliance, briefing, and reporting requirements. As security professionals, we are here to help you navigate all things security and ensure you fulfill all security requirements.
September is Insider Threat Awareness month! While insider threat is a significant concern that must be considered throughout the year, we would like to take a little time this month to emphasize the importance of deterring, detecting, and mitigating threats posed from trusted insiders, and foster a deeper understanding of indicators and reporting requirements related to insider threat.
What is an Insider? An insider is anyone that has, or has had access to an organization’s resources, facilities and information, network or systems.
What is an Insider Threat? The threat that an insider will use their authorized access, wittingly or unwittingly, to do harm to their organization or the security of the United States.
Understanding Insider Threat
Most insider threats do not start out as a threat; rather, they evolve into a threat over time. The pathway to an insider incident is often complex. Minor frustrations and stressors, both personal and professional, can add up and increase the possibility that an individual may become careless, negligent, or malicious.
Insider threats occur for a wide variety of reasons and can be deliberate or unintentional. Insiders do not need to hold a high rank or position to inflict grave damage. Technology can empower individuals at all levels.
Regardless of intent, an insider threat can cause grave and irrevocable damage, including: resource degradation, harm to national security, reduced military strength; loss of organizational reputation, innovation, and industry advantage; financial instability; and even potential injury to persons or loss of life.
Every organization should have an Insider Threat Program designed to deter, detect, and mitigate actions by insiders who may pose a threat. The organization’s Insider Threat Program Senior Official (ITPSO) implements insider threat program activities. The Facility Security Officer (FSO) is in charge of managing security in the organization’s facilities.
Recognizing Reportable Insider Threat Indicators
Your responsibility is simple: report concerning behavior to the appropriate individuals within your organization. Common categories of concerning behaviors include:
- Professional Lifecycle and Performance Indicators
- Security/Compliance Incidents
- Technical Activities and Technology Related Indicators
- Questionable Allegiance to the United States
- Foreign Considerations, Influence, and Preference
- Financial Considerations
- Criminal, Violent, and Abusive Conduct
- Substance and Alcohol Abuse or Misuse
- Judgment, Character, and Psychological Conditions
- Violent Behavior and Violent Extremist Mobilization Indicators
- Suspicious Contact and Unauthorized Disclosure
Whistleblower Protection
It is important to note that making a protected disclosure does not indicate an insider threat. Whistleblowing is the reporting of waste, fraud, abuse, corruption, or dangers to public health and safety to someone who is in the position to rectify the wrongdoing. Employees are protected from employer retaliation via the Whistleblower Protection Act and Security Executive Agent Directive (SEAD) 9.
The DoD National Hot Line is always available to all individuals to report fraud, waste, abuse, corruption, or dangers to public health and safety.
Email: dodighotline@dodig.mil | Phone: 1-800-424-9098 | Website: https://www.dodig.mil/Hotline
Why Reporting is Critical
An organization’s workforce is the first line of defense against insider threats. Any concerning behavior must be reported to your organization’s FSO and ITPSO immediately upon discovery.
NEVER assume someone else has or will report a concern! Failure to report can result in fines, prison, or both.
Resources and Additional Learning
- CDSE Insider Threat Awareness
- DITMAC – DOD Insider Threat Management and Analysis Center
- Insider Threat Toolkit
- 32 CFR Part 117 (NISPOM Rule)
As always, if you have any questions, ask your FSO!