Insider Threat
Insider threats may seem unlikely, but they’re one of the most significant risks facing organizations within the defense and national security communities. During Insider Threat Awareness Month, we’re reinforcing key concepts around insider threat and highlighting how each of us plays an important role in identifying and reporting early indicators.
Every cleared contractor facility is required to maintain an organization wide Insider Threat Program Plan. This plan outlines how the organization identifies, responds to, and mitigates insider threat risks, and ensures personnel know how to report potential concerns. All personnel should have access to their facility’s Insider Threat Program Plan. If you have not received information about yours, contact your Facility Security Officer (FSO) or Insider Threat Program Security Official (ITPSO) immediately.
Understanding Insider Threats
Insider threats occur when individuals with authorized access (employees, contractors, or trusted partners) use that access, either intentionally or unintentionally, in ways that could harm national security, the organization, its personnel, or its information. Insider threats are not limited to espionage or classified information compromise. They can also involve the mishandling of CUI, cybersecurity risks, fraud, workplace violence, sabotage, serious negligence, and more.
Insider threat risks often develop gradually over time. In many cases, early indicators are observable long before any damage occurs. These indicators may appear as changes in behavior, attempts to bypass security procedures, unusual access patterns, or signs of personal stressors that could impact judgment.
You are not expected to investigate or diagnose these concerns, only to recognize and report them. The Insider Threat Program is designed to evaluate information, provide support when needed, and ensure risks are addressed early and appropriately.
Indicators of an Insider Threat
Insider threat indicators are observable behaviors, actions, or circumstances that may suggest an individual is at risk of misusing their authorized access. These indicators do not confirm wrongdoing, and they are not intended to diagnose a situation. Instead, they help identify concerns that may warrant further review by your security team. The examples below are not exhaustive, and insider threat indicators can appear in many different ways depending on the situation and the individual involved.
Behavioral Indicators
Behavioral indicators are actions or patterns that appear unusual or inconsistent with normal expectations. Examples include:
- Attempts to ignore or work around security rules
- Sudden or unexplained frustration with the organization or coworkers
- Noticeable changes in reliability or personal conduct
- Expressions of resentment or hostility toward the workplace
- Personal stressors such as financial difficulties or legal issues that appear to affect judgment
Information Security and Cyber Indicators
Information security indicators involve suspicious or inappropriate activity related to systems or digital information. Examples include:
- Attempts to access information without a valid need to know
- Excessive downloading or transferring of files
- Use of unauthorized devices, storage media, or applications
- Repeated failed login attempts or unusual access patterns
- Attempts to alter or delete data without authorization
Workplace and Professional Indicators
Workplace indicators reflect unusual changes in behavior or performance within the professional environment. Examples include:
- Repeated conflicts with supervisors or colleagues
- Efforts to operate outside assigned duties or responsibilities
- Unexplained decline in work quality or consistency
- Resistance to feedback or corrective measures
- Attempts to conceal mistakes or avoid accountability
Physical Security Indicators
Physical security indicators relate to attempts to gain access to areas or information without proper authorization. Examples include:
- Attempting to enter restricted or classified areas without approval
- Tailgating or escort issues
- Leaving badges unattended or allowing others to use access credentials
- Unusual interest in physical layouts or security procedures
Personal Conduct Indicators
Personal conduct indicators involve circumstances that may impact judgment or increase vulnerability. Examples include:
- Sudden financial strain or unexplained wealth
- Substance misuse
- Threatening statements or conduct
- Significant life stressors affecting behavior or workplace engagement
- Expressions of desperation or withdrawal paired with unusual workplace behavior
Reporting Insider Threat Concerns
Reporting insider threat indicators is one of the most effective ways to prevent harm before it occurs. Most insider threat incidents do not happen suddenly. They typically develop over time, and early warning signs are often visible long before any damage is done. When personnel report concerning behaviors or unusual activity early, the security team can review the information, provide support when appropriate, and take steps to reduce risk to national security, the organization, and all personnel.
Reporting concerns does not mean you are accusing someone of wrongdoing. It simply ensures that your security officials can evaluate the situation and determine what actions, if any, may be needed. Even a small observation can be an important part of a larger picture.
It is important to note that we should report information relevant to the concerning behavior or activity and avoid sharing personal details that are not connected to the concern.
How to Report
Reporting insider threat concerns is simple. If you observe behavior or activity that seems unusual, inconsistent with policy, out of place, or otherwise concerning, document what you saw and notify your security officials as soon as possible. Include dates, times, observations, and any context you feel may be helpful. You do not need certainty or proof. You only need to share what you observed.
If you are unsure whether something should be reported, make the report and allow your security officials to determine next steps.
Who to Report To
All insider threat concerns must be reported directly to your Facility Security Officer (FSO) or your Insider Threat Program Security Official (ITPSO). These officials are responsible for reviewing the information, coordinating with other security and counterintelligence personnel when needed, and ensuring all actions align with regulatory requirements. If you work at a government site or a host contractor location, you may also notify their security staff but always ensure your facility FSO or ITPSO is informed.
Resources and Additional Learning
Continued learning is an important part of supporting a strong security program. The resources below offer helpful guidance, job aids, training modules, and official policy documents that reinforce the topics discussed in this newsletter. We encourage all personnel to explore these materials and become familiar with the tools and requirements that govern and support your organization’s industrial security program.
CDSE Insider Threat Awareness course
CDSE Insider Threat for Industry Curriculum
32 CFR Part 147 (Adjudicative Guidelines)
As always, if you have any questions…ask your FSO! Your company’s FSO is the best person to help you navigate any questions you have about security compliance, briefing, and reporting requirements. As security professionals, we are here to help you navigate all things security and ensure you fulfill all security requirements.
