Policy brief on cybersecurity and digital insider threat for island organizations with small IT teams.
Policy brief on cybersecurity and digital insider threat for island organizations with small IT teams. Free under Creative Commons Attribution 4.0 — no registration required.
Summary of the paper
"The Digital Insider Threat" is an ISPI policy brief on cybersecurity risk in island organizations where IT and security functions overlap. It argues that standard digital insider threat frameworks assume a segregation of duties that small island organizations cannot achieve, because a handful of IT staff carry every privileged function.
The brief recommends treating that gap as a design constraint and managing it with alternative controls, rather than treating it as a compliance failure.
What the paper finds
- Segregation of duties is often structurally impossible. In small island agencies and companies, the same few people may handle network administration, system administration, application support and security monitoring.
- Cloud adoption has outpaced access governance. The brief identifies a digital insider risk category in small island governments and businesses that continental frameworks do not address.
- Social dynamics suppress reporting. The same close-knit dynamics that discourage reporting of concerning behavior also discourage reporting of digital anomalies.
- Compensating controls exist. Managed security service providers, third-party access auditing and cloud governance frameworks can provide controls without a large internal IT workforce.
What it recommends
- Develop island-specific digital insider threat guidance that prescribes alternative controls for organizations that cannot segregate duties.
- Require third-party access auditing for critical island government systems.
- Ask CISA to develop small-organization digital insider threat guidance for Pacific Island territory and small island government environments.
- Establish shared managed security service arrangements for Pacific Island territory governments.
Who it's for
IT and security leads, CIOs and auditors in island governments and small organizations, CISA and territorial cybersecurity officials, and managed security providers serving the Pacific.
This research connects to the 39 Small Island Developing States worldwide through the Samoa Pathway and BPOA+30 framework. Every ISPI research product carries a mandatory SIDS global bridge per the ISPI Research Architecture.
Cite as
Pulley, Warren (2026). The Digital Insider Threat: Cybersecurity Risks in Island-State Organizations Where IT and Security Functions Overlap (ISPI PB-06). Island Security Policy Institute, Honolulu. https://ispiglobal.com/papers-landing/pb06-digital-insider-threat https://doi.org/10.5281/zenodo.23449988
BibTeX
@techreport{ispipb062026,
author = {Pulley, Warren},
title = {The Digital Insider Threat: Cybersecurity Risks in Island-State Organizations Where IT and Security Functions Overlap},
institution = {Island Security Policy Institute},
address = {Honolulu, HI},
number = {ISPI PB-06},
year = {2026},
url = {https://ispiglobal.com/papers-landing/pb06-digital-insider-threat},
doi = {10.5281/zenodo.23449988}
}Related analysis
AnalysisHow to Implement an Insider Threat Program in a Small Island Organization →AnalysisWhat Is Insider Threat in Island Organizations? Why Standard Programs Fail in Small Communities →AnalysisBehavioral Threat Assessment in Island Communities — Why Cultural Calibration Changes Everything →PaperPB-05 — Supply Chain Security Policy Brief — Island Communities →PaperPB-07 — Supply Chain Insider Risk at Island Ports →GuideInsider Threat in Island Communities: Research and FAQ →Pulley, Warren. "Digital Insider Threat in Island Organizations." Island Security Policy Institute, 2026. https://ispiglobal.com/papers-landing/pb06-digital-insider-threat
