Insider Risk
What is Insider Risk?
The potential for current or former employees, contractors, or partners to intentionally or accidentally compromise organizational security.
Terms that appear alongside insider risk
Each of these is named in at least one of the same controls as insider risk. The number is how many controls name both.
- security awareness 3 shared controls
- social engineering 2 shared controls
- phishing 2 shared controls
- insider threat 2 shared controls
- security awareness training 2 shared controls
- policy 2 shared controls
- purple team 2 shared controls
- red team 2 shared controls
Frameworks that govern insider risk
What the standards actually require on insider risk
Requirements naming insider risk across 5 standards, quoted from the control text.
Lloyds MS11.13 Security Awareness and Insider Risk - mandatory annual cyber security awareness training for all personnel + Senior Manager Function holders + Board + role-based deep training for IT + security + claims handlers + underwriters + actuaries + fina...
LLOYDS-MS11-Security-Awareness-Insider-Risk-Penetration-Testing-Independent-Assurance-MS11-13-16 · Lloyds MS11 Security Awareness + Insider Risk + Pen Testing + Assurance + MS11.13-16 →Conduct background screening for personnel with access to treatment and SCADA systems and monitor for insider risk.
AWWA-G430-14 · Personnel Security and Insider Threat →Address the human element through security awareness, role-based training for operators and engineers, and policies that reduce social-engineering and insider risk in the control environment.
CISA-ICS-DID-29 · The Human Element (Awareness and Training) →FIRST CSIRT Services Framework v2.1 Service Area 5 - Knowledge Transfer. SCOPE: building cybersecurity capacity in the constituency + the broader community through awareness + training + exercises + advisory.
FIRST-CSIRTF-SA5-KnowledgeTransfer · Service Area 5 - Knowledge Transfer (Awareness, Training, Exercises, Advisory) →Entities must ensure their personnel are suitable to access Australian Government resources and continue to meet this requirement throughout their engagement, with controls for ongoing suitability and insider risk.
PSPF-2024-OUTCOME-3 · Personnel Security Outcome →Questions people ask about insider risk
What is Insider Risk?
Why is Insider Risk important for compliance?
Which compliance frameworks address Insider Risk?
Where can I learn more about Insider Risk?
See how Insider Risk applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.