Insider Threat Assessment Framework for Island Organizations

Summary of the paper

This ISPI research report asks whether standard insider threat frameworks, including the Carnegie Mellon CERT Common Sense Guide to Mitigating Insider Threats and DHS Insider Threat Program guidance, work as designed in small island-state organizations, and what should replace them if they do not. It draws on practitioner case analysis from documented behavioral threat assessments in island and small-state organizations, a comparison of standard framework requirements against island organizational scale, and post-incident records from insider threat cases in Hawaii and Pacific Island organizations.

The report opens with an anonymized case: a Pacific Island territory health department found that a network administrator had copied patient records to a personal cloud account for fourteen months. In a twelve-person IT department, one person was the administrator, the backup administrator and the access auditor. The report argues that this incompatibility between enterprise-scale frameworks and small island organizations is the defining pattern, and it proposes a four-component framework built for those conditions.

What the paper finds

• Standard frameworks assume conditions small island organizations cannot meet: dedicated security staff, formal HR investigation independent of line management, reporting channels that are truly anonymous, and access segregation. In organizations of 12 to 50 employees, none of the four can be achieved through standard implementation.
• Reporting, not detection, is where failures happen. Colleagues also share churches, youth sports teams and multi-generational family ties. The report finds that this social cost of reporting is the primary reason behavioral warning signs go unaddressed.
• Workforce irreplaceability changes the response. The person of concern may be the only ICU nurse, the only administrator who knows a legacy system or the only certified port operations manager, so a standard detect-assess-remove sequence can create an operational crisis.
• Sectors need their own adaptations: political relationship mapping in government agencies, clinical continuity assessment in healthcare, cargo flow anomaly detection at ports and critical infrastructure, and rapid baseline calibration for seasonal hospitality workforces.

What it recommends

• The framework: (1) behavioral baselines calibrated for culture, role and community context; (2) third-party assessment pathways that route concerns to an external assessor outside the social network; (3) compensating access controls such as scheduled third-party access audits, automated anomaly detection, peer oversight and managed security services; and (4) graduated response across Observation, Concern, Alert and Response levels, with workforce continuity planning before any personnel action.
• Federal agencies and regulators: require island-specific insider threat frameworks for critical infrastructure operators in Hawaii and the Pacific territories.
• State and territorial governments: fund shared third-party assessment services for organizations with fewer than 100 employees.
• Researchers, DHS and HIEMA: commission culturally calibrated baseline research, reform territory compliance rules to allow compensating controls, and weigh island-specific insider threat capacity in homeland security grant eligibility.

Limitations the paper notes

Case documentation is anonymized, and the behavioral baseline findings come from ISPI's practitioner assessment record rather than a controlled study. The report calls for academic validation of the calibration differences it identifies.

Who it's for

Security, HR, IT and compliance leads in small island organizations, including government agencies, hospitals, ports, utilities and resorts; critical infrastructure regulators and grant administrators; and researchers working on behavioral threat assessment in Pacific Island and Native Hawaiian settings.

Cite as

Pulley, Warren (2026). Organizational Insider Threat Assessment Framework for Island and Small-State Communities: A Practitioner-Grounded Detection and Response Architecture for Organizations Mainstream Frameworks Cannot Serve (ISPI WP-02). Island Security Policy Institute, Honolulu. https://ispiglobal.com/papers-landing/wp02-insider-threat-framework https://doi.org/10.5281/zenodo.23450049

@techreport{ispiwp022026,
  author      = {Pulley, Warren},
  title       = {Organizational Insider Threat Assessment Framework for Island and Small-State Communities: A Practitioner-Grounded Detection and Response Architecture for Organizations Mainstream Frameworks Cannot Serve},
  institution = {Island Security Policy Institute},
  address     = {Honolulu, HI},
  number      = {ISPI WP-02},
  year        = {2026},
  url         = {https://ispiglobal.com/papers-landing/wp02-insider-threat-framework},
  doi         = {10.5281/zenodo.23450049}
}

Related analysis