1
Ordered by stage, not by category
Follows the six-stage critical pathway in the CISA Insider Threat Mitigation Guide. Stage sets urgency: exploration still leaves room to intervene, execution leaves only forensics.
What This Resource Includes
Not another list of warning signs. Every indicator is tied to the data source that has to surface it, which turns the file into a telemetry gap assessment.
2
Every row names its signal source
The log, agent or platform that has to produce the evidence. Rows whose source you do not have will never fire — read those as your gap list.
3
Stage 0: telemetry baseline
Seven prerequisites. Without them the other forty rows cannot trigger, no matter who they are assigned to.
Knowing The Signal is Not The Same as Seeing It
Most insider threat lists stop at naming the behaviour. Bulk download is a signal — but the question that decides the outcome is which log was supposed to show it, and who was supposed to be looking. Ponemon Institute’s 2026 Cost of Insider Risks (n=354 organisations, 7,490 incidents) puts average containment at 67 days, with only 13% of incidents contained inside 30 days.
- A four-tier triage table — S1 to S4 — with trigger conditions, response windows, who is involved and which evidence to preserve first.
- Scope boundaries written into the file: human-factor signals go through HR channels only, personal life and devices are out of scope, and elevated monitoring of a named individual needs written Legal and HR approval with an expiry date.
- Thresholds appear as placeholders. Copying template numbers produces noise, and an alert nobody reads is not a control.
- Stage-level mapping to ISO/IEC 27001:2022, NIST SP 800-53 Rev.5 and SOC 2 for audit questions.
