Insider Threat Program Template

ISPI-branded title page with the standards it is built on, version and date, fill-in fields for your organization, document owner and local version, and the disclaimer.

• Name a program owner (usually the Insider Threat Program Manager) and give this template to that person with a target completion date.
• Work through Parts 1 to 9 in order. Each part lists its basis in the cited standards so reviewers can trace every requirement.
• Fill in the fields, then mark each checklist item Done or N/A and record the evidence (a policy number, a file location or a meeting date) in the Notes column. Treat an item marked N/A as a decision that needs a short reason.

Plus purpose, scope, who it is for and 3 more how-to steps.

Table with an assigned-to field for each role: Senior Official (executive sponsor), Insider Threat Program Manager, Insider risk hub members (HR, security, IT or cyber, legal), Legal counsel, Privacy and civil liberties lead, Employee assistance or behavioral health liaison, Facility Security Officer or Cybersecurity Officer (ports), Supervisors and managers, All personnel.

Basis: NITTF Minimum Standard A (designation of senior official); NITTF Maturity Framework; NIST SP 800-53 PM-12, PS-1; CISA Guide, building an insider threat mitigation program

Establish who owns the program, under what authority, and within what legal and ethical limits.

Fill-in fields: Organization name; Program effective date; Senior Official (name and title); Insider Threat Program Manager (name and title); Authority for the program (board resolution, executive order or policy number); Laws, agreements and sector rules reviewed.

• A written insider threat policy is approved and signed by the Senior Official.
• A Senior Official is designated in writing with the authority and resources to run the program.
• A program charter defines purpose, scope, covered personnel, authorities and limits on the program.

+ 7 more checklist items, each with Done and N/A boxes and a notes field.

Basis: NITTF Minimum Standards B and C; CDSE INT122; CISA Guide, multidisciplinary team; NIST SP 800-53 PM-12

A small hub brings HR, security, IT and legal information together so that no single office acts on partial facts. In a small organization the hub may be three or four people who meet when a case is open.

Table: Hub membership and backups (columns: Function, Primary member (name and title), Backup, Contact). Rows include Program Manager (chair), Human resources, Security or Facility Security Officer, IT or cybersecurity, Legal counsel, Privacy lead and more.

• Hub members and backups are named, and each has a written appointment.
• Each hub member completes role-based insider threat training (for example CDSE INT122 or equivalent) within a set period of appointment.
• Hub members sign confidentiality and conflict-of-interest acknowledgments.

+ 4 more checklist items, each with Done and N/A boxes and a notes field.

Basis: CISA Guide, identify and protect critical assets; NIST SP 800-53 PS-2, RA-3, AC-6; NITTF Maturity Framework

Focus the program on what would hurt most if a trusted person misused access. Record each critical asset, who can reach it and the scenario you worry about.

Table: Critical asset register (columns: Critical asset, Owner, Who has access (roles), Insider scenario of concern, Existing controls, Gap and action).

• Critical assets are listed across people, facilities, information, IT systems, OT (gates, cranes, pumps, SCADA), cargo, keys and credentials.
• Privileged, administrator and remote access is mapped to named individuals and reviewed.
• Every position has a risk designation (high, moderate or low) based on access and potential harm.

+ 4 more checklist items, each with Done and N/A boxes and a notes field.

Basis: NIST SP 800-53 Rev. 5 PS-1 to PS-9, AC-2, AC-5; CISA Guide, personnel practices

These are the routine HR and access controls that reduce insider risk for everyone. Record the control, its owner and where the evidence is kept.

Fill-in fields: Target time to remove system and physical access at separation (hours); Rescreening frequency for high-risk positions; Contractor security clause reference.

• PS-1 Policy and procedures: personnel security policy and procedures are documented, owned and reviewed.
• PS-2 Position risk designation: designations are recorded for every position and reviewed when duties change.
• PS-3 Personnel screening: screening occurs before access is granted and is repeated for high-risk positions, consistent with applicable law (for example fair credit reporting and fair-chance hiring rules).

+ 7 more checklist items, each with Done and N/A boxes and a notes field.

Basis: NITTF Minimum Standards B, D and E; CISA Guide, detect and identify; NIST SP 800-53 AU-6, SI-4, AC-2, PM-12

Most insider incidents are preceded by behavior that someone noticed. Make it easy to report, and bring the right records together lawfully when a concern is raised.

Fill-in fields: Reporting channels (phone, email, web form, in person); Anonymous reporting option; Non-retaliation policy reference; Threshold for opening a case.

Table: Information sources the hub may review (columns: Data source, Owner, What is reviewed, Frequency or trigger, Legal basis and notice). Rows include HR records (performance, conduct, grievances), Physical access logs (badges, gates, CCTV), User activity and system logs, Data loss or email security alerts, Security incident reports, Open-source information (per policy).

• At least two reporting channels exist, including one that allows anonymous reports.
• A non-retaliation commitment is published and enforced.
• Supervisors are trained to recognize and report concerning behavior and are told what happens after a report.

+ 6 more checklist items, each with Done and N/A boxes and a notes field.

Basis: NITTF Minimum Standard B; CISA Guide, assess; NIST SP 800-53 IR-4(6), PM-12

Handle every report the same way: record it, triage it, gather facts, decide and document. Where a concern involves possible violence, apply the ISPI Behavioral Threat Assessment Checklist.

Table: Case log (columns: Case no., Date opened, Source, Category, Status, Next review, Date closed).

• Each report receives a case number and an intake record on the day received.
• Triage occurs within a defined time, and immediate danger is routed to emergency services first.
• A preliminary inquiry gathers facts from more than one source before any conclusion is drawn.

+ 4 more checklist items, each with Done and N/A boxes and a notes field.

Case outcome options used by this organization: No concern, close / Monitor and review / Supportive intervention / Administrative action / Referral to law enforcement or regulator.

Basis: CISA Guide, manage; NIST SP 800-53 IR-4(6), PS-4, PS-8, AC-2; 33 CFR 101.305 (ports)

Choose the least intrusive response that will reduce the risk, and act quickly on access when the risk is to systems or facilities.

• A written range of responses exists: supportive (employee assistance, workload or schedule change, mentoring), administrative (access restriction, reassignment, leave under policy), disciplinary and referral.
• Access changes are carried out by IT and facility security within the same day once decided.
• Responses are proportionate, consistent with past cases and documented.

+ 4 more checklist items, each with Done and N/A boxes and a notes field.

Basis: NITTF Minimum Standard F; NIST SP 800-53 AT-2(2), PM-13; CDSE insider threat curriculum

Training should explain why the program exists, how to report and how the organization supports people. Track completion.

Table: Training plan (columns: Audience, Content or course, Frequency, Owner, How completion is tracked). Rows include All personnel, New hires and contractors, Supervisors and managers, Hub members, Senior Official and board.

• All personnel complete insider threat awareness training at hire and at least annually.
• Hub members complete role-based training, and refresher training is scheduled.
• Supervisors are trained on recognizing, reporting and supporting.

+ 2 more checklist items, each with Done and N/A boxes and a notes field.

Basis: NITTF Insider Threat Program Maturity Framework; NIST SP 800-53 PM-14, CA-2; CISA Guide, program evaluation

Measure what the program does, test it, and improve it. Choose a few measures you can actually collect.

Table: Program measures (columns: Measure, Target, Result this period, Notes). Rows include Reports received and triaged on time, Average time from report to triage decision, Training completion rate, Access removed within target at separation, Corrective actions closed on time.

• An annual self-assessment against the elements of the NITTF Maturity Framework that fit the organization is completed.
• A tabletop exercise with the hub is run at least once a year.
• Findings feed a corrective action plan with owners and dates.

+ 1 more checklist items, each with Done and N/A boxes and a notes field.

Basis: NIST SP 800-53 Rev. 5 (release 5.2.0)

Use this crosswalk to show auditors where each control is addressed. Add your own control implementation notes.

Table: Control crosswalk (columns: Control, Control name, Where addressed, Implementation notes). Rows include PS-1, PS-2, PS-3, PS-4, PS-5, PS-6 and more.

Basis: CISA Guide, reporting; NITTF Minimum Standard B

Copy this form for each report. Record facts, not conclusions. Keep completed forms in the restricted program file.

Fill-in fields: Case number; Date and time received; Received by; Reporting person (or anonymous) and contact; Person of concern (name, role, unit); What was observed or reported; When and where; Others who saw or know about it; Records or evidence provided; Immediate safety concern (if yes, call emergency services first).

Name, signature and date for: Insider Threat Program Manager, Senior Official, Legal counsel, Human resources director, Facility Security Officer (ports, if applicable).

Version, date, description of change, changed by and approved by, starting with version 1.0 (October 30, 2026).

1. Executive Order 13587, Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information (October 7, 2011). Source
2. The White House, Presidential Memorandum: National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs (November 21, 2012). Source
3. National Insider Threat Task Force (NITTF), Insider Threat Program Maturity Framework (November 2018). Source
4. Defense Counterintelligence and Security Agency, Center for Development of Security Excellence (CDSE), Establishing an Insider Threat Program for Your Organization, course INT122.16. Source
5. Cybersecurity and Infrastructure Security Agency (CISA), Insider Threat Mitigation Guide (November 2020). Source
6. National Institute of Standards and Technology, NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (September 2020; release 5.2.0, August 27, 2025). Source
7. Carnegie Mellon University Software Engineering Institute, Common Sense Guide to Mitigating Insider Threats, Seventh Edition, CMU/SEI-2022-TR-019 (September 2022). Source
8. 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM), section 117.7(d), insider threat program requirements for cleared contractors. Source
9. 33 CFR Part 105, Maritime Security: Facilities, and 33 CFR 101.305, reporting (for MTSA-regulated port facilities). Source