Navigate

AT-2 (2)

AT-2 (2): Insider Threat

The organization includes security awareness training on recognizing and reporting potential indicators of insider threat.

Supplemental

Potential indicators and possible precursors of insider threat can include behaviors such as inordinate, long-term job dissatisfaction, attempts to gain access to information not required for job performance, unexplained access to financial resources, bullying or sexual harassment of fellow employees, workplace violence, and other serious violations of organizational policies, procedures, directives, rules, or practices. Security awareness training includes how to communicate employee and management concerns regarding potential indicators of insider threat through appropriate organizational channels in accordance with established organizational policies and procedures.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
Classified, Cross Domain (Access), Cross Domain (Multilevel), Cross Domain (Transfer), Int-A, Int-B, Int-C

Related Controls

The controls below (if any) were marked by NIST as being related to AT-2 (2).

Control	Description
PL-4	The organization: PL-4a.: Establishes and makes readily available to individuals requiring access to the information system, the rules that describe their responsibilities and expected behavior with regard to information and information system usage; PL-4b.: Receives a signed acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system; PL-4c.: Reviews and updates the rules of behavior [Assignment: organization-defined frequency]; and PL-4d.: Requires individuals who have signed a previous version of the rules of behavior to read and re-sign when the rules of behavior are revised/updated.
PM-12	The organization implements an insider threat program that includes a cross-discipline insider threat incident handling team.
PS-3	The organization: PS-3a.: Screens individuals prior to authorizing access to the information system; and PS-3b.: Rescreens individuals according to [Assignment: organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of such rescreening].
PS-6	The organization: PS-6a.: Develops and documents access agreements for organizational information systems; PS-6b.: Reviews and updates the access agreements [Assignment: organization-defined frequency]; and PS-6c.: Ensures that individuals requiring access to organizational information and information systems: PS-6c.1.: Sign appropriate access agreements prior to being granted access; and PS-6c.2.: Re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or [Assignment: organization-defined frequency].

Enhancements

The controls below (if any) add on to the requirements of AT-2 (2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AT-2 (2).

CCI	Definition
CCI-002055	The organization includes security awareness training on recognizing and reporting potential indicators of insider threat.