Insider Risk Management

People are a major security risk. Most cybersecurity incidents originate from, or are facilitated by, a current or former insider of the victim organization or its business partners. Effective insider risk management requires a risk-based, multi-functional approach by an organization’s various departments and disciplines (e.g. senior management, human resources, procurement, risk management, IT, physical security and legal) to deter, prevent, detect and respond to cybersecurity incidents caused by insiders. Insider risk management requires an organization to carefully select, educate, train and disengage insiders, and to establish and implement administrative, technological and physical security policies and practices to protect the IT systems and data of the organization and its relevant business partners and to monitor and verify compliance.

Managing insider risk presents legal challenges, including ensuring that risk management practices are legally effective and comply with applicable law. Timely legal advice can assist an organization to effectively address generally applicable legal requirements and ensure compliance with laws specific to the organization or its activities.

Read more here.