Framework
Insider Risk Programme Framework
This framework defines the organization's approach to insider risk: the risk that current or former employees, contractors, or trusted third parties act in ways (intentional or unintentional) that harm the organization. It establishes the programme objectives, the governance model, the detection and response capabilities, the privacy and due-process safeguards, and the coordination with HR, Legal, Privacy, and Internal Audit.
- Type
- Framework
- Version
- 1.0.8
- Date
- 2026-10-24
- Owner
- Chief Information Security Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Information Security
- Review frequency
- Annual and upon material change to workforce, regulator-expected posture, or threat-actor pattern
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Scope
- Programme objectives
- Insider risk categories
- Governance model
- Pillars
- Privacy and due-process safeguards
- Out-of-scope deliberate exclusions
- Coordination with adjacent programmes
- Metrics
- Framework alignment
- Limitations
Frameworks it maps to
- ISO/IEC 27001:2022
- ISO/IEC 27002:2022
- NIST SP 800-53 Rev. 5
- CERT Insider Threat Center
- NITTF
- GDPR (EU) / UK GDPR
- ILO Code of Practice on the Protection of Workers' Personal Data (1997)
Related documents
- Information Security Policysecurity
- Acceptable Use Policysecurity
- Personnel Security Screening Standardsecurity
- Data Loss Prevention Standardsecurity
- Logging and Monitoring Standardsecurity
- Privileged Access Management Standardsecurity
- Security Disciplinary Process Proceduresecurity
- IT Onboarding and Offboarding Proceduresecurity
- Privacy and Data Governance Policyprivacy
- Human Capital and Ethical Conduct Frameworkgovernance
- Whistleblower and Incident Reporting Proceduregovernance
Next
All Documents