NIST SP 800-53 Rev 5 binds US federal systems, and reaches other organizations through contracts and flow down clauses. For everyone else it is a reference catalog: a detailed, public description of what a control can look like. PM-12, Insider Threat Program, reads in full: implement an insider threat program that includes a cross discipline insider threat incident handling team.
The guidance explains the background. Organizations that handle classified information must have such programs under Executive Order 13587 and the National Insider Threat Policy. It says the same standards can improve security for controlled unclassified and other information in non national security systems. Programs combine controls to detect and prevent malicious insider activity through centralized integration and analysis of technical and nontechnical information.
What it means in practice
The word insider covers employees, contractors, and anyone with legitimate access. The risk is deliberate misuse, but also mistakes and compromised accounts.
The phrase cross discipline matters. No single team sees all the signals. Security sees logs. HR sees performance and departures. Legal sees policy and law. Managers see behavior. A program joins them under a defined process so a concern reaches someone who can act, and so action respects privacy and employment law.
Evidence to collect
- A program charter naming the team members from security, HR, legal, and the business.
- A documented handling procedure from report to closure.
- Data sources used for detection, such as access logs, data loss alerts, and badge records.
- A record of team meetings and case handling, with details removed.
- Training given to staff on reporting concerns.
- Legal review of monitoring practices.
Common gaps
- Monitoring exists but no team owns the response.
- HR is not part of the process, so departures are not tied to access removal.
- Monitoring that staff have never been told about.
- No criteria for what counts as a concern, so cases are handled differently each time.
How to implement it
Keep it proportionate. A small company can form a three person group that meets when a case arises and quarterly otherwise. Define a few signals: bulk downloads, access outside role, privileged account changes, and offboarding gaps.
Start with fundamentals that cut insider risk anyway. Least privilege, regular access reviews, and fast offboarding catch more than any dashboard. Write a clear policy about monitoring, and get legal advice for the jurisdictions where you operate.
Make reporting safe. People raise concerns when they trust the process to be fair.
Try it yourself
Access review is the most practical insider risk control for small teams. The demo shows how a review works.
Click through it at your own pace, or open it full screen.
Quick check
Do non federal companies need a PM-12 program?
Only if a contract or framework you follow requires it. The guidance says the practices help in other settings too.
Is monitoring employees legal?
It depends on jurisdiction and notice. Involve legal counsel and tell staff what is monitored.
