Insider Threat Migaon
Responses
Student Guide
April 2024
Center for Development of Security Excellence
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 1-1
Lesson 1: Course Introducon
Introduction
Welcome
While Insider Threat Programs may idenfy individuals comming espionage or other naonal
security crimes, not all incidents will result in the arrest of a spy. In fact, Insider Threat Programs
resolve most cases before they escalate into negave events through the proacve idenficaon of
individuals at risk of harming the organizaon—either wingly or unwingly—and the deployment
of alternave migaon opons. This allows the Insider Threat Program to protect informaon,
facilies, and personnel—and to retain valuable employees.
Welcome to the Insider Threat Migaon Responses course! This course describes the ability of
muldisciplinary insider threat teams to cra tailored and effecve responses to specific behaviors
or issues.
Muldisciplinary insider threat teams are comprised of subject maer experts from:
• Law enforcement
• Security
• Counterintelligence
• Cybersecurity
• Behavioral science
• Human resources
• Legal
Case Study
Let’s look at the case study of Mark Steven Domingo. Domingo held radicalized extremist views, and
frequently created social media and online forum posts advocang for acts of violence and terrorism
against religious groups, law enforcement, and military personnel. His ulmate plan was to detonate
two homemade improvised explosive devices at a rally in California, with the intent to kill innocent
civilians. Fortunately, the FBI was made aware of Domingo’s intent through an undercover informant.
Teaming with local law enforcement, they were able to intervene and arrest Domingo before he
could carry out the potenally deadly terror aack. Domingo was convicted of providing material
support to terrorists, and aempted use of a weapon of mass destrucon. He was sentenced to 25
years in prison. At his trial, Domingo tesfied that he was the one who chose to aack the rally,
chose to use the bombs, and chose to go through with the plot to commit mass murder. He
repeatedly stated that he was intent on killing innocent Americans and would have done so had he
not been stopped.
Visit the course Resources
to access a printable case study.
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 1-2
Objectives
Here are the course objecves. Take a moment to review them.
• Explain the role of Insider Threat Programs in migang the risks posed by insider threats
and how programs migate those risks
• Describe factors to consider when formulang a migaon response to an insider threat
incident
• Summarize the ability of muldisciplinary teams to cra migaon responses tailored to
insider threat incidents
• Idenfy reporng requirements that apply to Insider Threat Programs
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 2-1
Lesson 2: Migaon Overview
Introduction
Welcome
What would have happened if Mark Domingo’s acons were not idenfied and reported early? An
Insider Threat Program can employ alternave response opons to migate the threat. When
idenfied early, Insider Threat Programs can oen resolve common workplace issues, such as
interpersonal problems, financial issues, and even disgruntlement or violent tendencies. This results
in posive outcomes for both the individual and the organizaon.
Objectives
Here are the lesson objecves. Take a moment to review them.
• Describe the crical pathway model of insider threat and how it applies to migang the
threat
• Explain the role of Insider Threat Programs in migang the risks posed by insider threats
and how programs migate those risks
The Critical Pathway
Potential Risk Indicators
Domingo’s behavior and acvies are examples of potenal risk indicators (PRIs). PRIs are
observable and reportable behaviors and acvies that may be exhibited by those at risk of
becoming an insider threat. Specific PRIs come from a variety of sources in the security and
intelligence communies and may be specific to your organizaon.
PRIs may converge with adjudicave guidelines for determining eligibility for access to classified
informaon. Some organizaons use these to determine insider risk. PRIs generally belong to the
categories listed here:
• Access aributes
• Professional lifecycle and performance
• Foreign consideraons
• Security compliance and incidents
• Technical acvity
• Criminal, violent, or abusive conduct
• Financial consideraons
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 2-2
• Substance abuse and addicve behaviors
• Judgment, character, and psychological condions
Visit the course Resources
to access a printable reference of insider threat PRIs.
Behavioral Model of Insider Threat
Dr. Eric Shaw, clinical psychologist and consultant to Federal agencies on insider crime, originated the
“crical pathway” model for understanding insider aacks. The components of the model are:
1. Personal Predisposions
2. Stressors
3. Concerning Behaviors
4. Organizaonal Response
5. Insider Aack
It begins with personal predisposions and stressors, which oen correspond to behaviors that
emerge as PRIs. Over me, these factors may combine and increase the risk that an individual may
become an insider threat.
Consider the Mark Domingo case. While serving in the Army, Domingo displayed difficulty socializing
and making friends. He oen felt he was being mocked, cricized, and unfairly treated. He was later
involuntarily discharged and separated from service on disciplinary grounds. All of this fed directly
into his personal stressors. He felt angry, frustrated, and ostracized, and sought an outlet for his
negave emoons. These stressors led to concerning behavior by Domingo. He was very acve on
social media networks, forums, and chatrooms, where he frequently voiced support for violence,
religious extremism, and terrorist acvity. He acvely communicated with others who shared his
views and frustraons, and Domingo quickly became self-radicalized and prepared to take violent
acon. All of these factors culminated in Domingo deciding to detonate two improvised explosive
devices at a public rally with the intent to kill as many people as possible. Thankfully, the FBI and law
enforcement were able to detect these concerning behaviors, intervene, and prevent a potenal
disaster.
The model also demonstrates that there are mulple opportunies to redirect individuals from the
pathway into more posive behaviors. For example, if Domingo had been off-ramped from a path of
radicalizaon to terrorism, then his behavior may not have escalated. Early intervenon can mean
the difference between rehabilitaon and negave escalaon of behavior.
Role of Insider Threat Programs
Overview
Insider Threat Programs fulfill four funcons using a holisc approach. First, they help prevent
insider threats by providing leadership with threat informaon that may help to shape decisions
about managing insider risk and building resiliency throughout the workforce. Second, they deter
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 2-3
potenal insider threats by instung appropriate security countermeasures, including awareness
programs. Next, they detect individuals at risk of becoming insider threats and then finally migate
the risks associated with those individuals before the issue escalates.
Let’s examine these in greater detail.
Prevention, Deterrence, and Detection
Prevenon of insider threat acons typically is enabled by ensuring leaders are aware of the current
threat landscape, including pernent insider threat informaon, acvies, and behaviors. This is
supported by providing reports and recommendaons for threat management and ensuring the
workforce understands available resources. Prevenon acvies complement deterrence.
Deterrence occurs through strategic communicaons, ensuring personnel are aware of punive
acons that potenal offenders may face, and promong a security posture that detects malicious
insider threats. These deterrents support detecon.
Detecon of PRIs typically occurs through reporng by personnel and monitoring conducted by the
program. Once detected, the PRI becomes the catalyst for Insider Threat Program acvies,
including informaon gathering, analysis, reporng, and response.
Intervention
The deployment of migaon opons, or your organizaon’s “response” to the insider threat,
depends on mulple variables and the unique nature of the insider threat. The migaon strategy
may include referral outside of the Insider Threat Program when required or acons to migate the
risk internally.
Note that while some insider threat incidents may warrant referrals and intervenon from law
enforcement, not all meet reporng thresholds or result in an arrest.
In most cases, proacve migaon responses provide posive outcomes for the organizaon and the
individual. This allows the organizaon to protect informaon, facilies, and personnel and to retain
valuable employees, and offers intervenon to alleviate the individual’s stressors and guide them off
the crical pathway.
Effective Mitigation
According to the crical pathway model, without intervenon, concerning behavior may escalate,
causing potenal damage to naonal security, personnel, facilies, or other resources through an
insider aack. To be effecve, Insider Threat Programs must be aenve to potenal issues before
they pose a threat, have a risk assessment process in place, address potenal issues adequately, and
take acons that minimize risk while avoiding those that escalate risk.
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 2-4
Review Activities
Review Activity 1
You receive a report that Ted, an employee in your organizaon, frequently asks colleagues to loan
him money. Ted told one of his colleagues that he has a large gambling problem and a large debt he
needs to resolve. Where on the insider threat crical pathway is Ted’s situaon, based on this
report?
Select the best response. Then check your answer in the Answer Key at the end of this Student Guide.
Personal Predisposions
Stressors
Concerning Behaviors
All of the Above
Review Activity 2
Which of the following is an effecve way to migate a potenal insider threat based upon what you
know about Ted’s situaon?
Select the best response. Then check your answer in the Answer Key at the end of this Student Guide.
Refer Ted to law enforcement
Tell Ted’s colleagues to loan money to him
Provide him with support and resources to deal with his addicon
Terminate Ted’s employment
Review Activity 3
What funcons do Insider Threat Programs perform to reduce the risks posed by insider threats?
Select all that apply. Then check your answer in the Answer Key at the end of this Student Guide.
Provide leaders with informaon about the threat landscape
Mandate security awareness training for employees
Conduct user acvity monitoring
Document and make available the consequences of insider threat acvity
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 3-1
Lesson 3: Response Planning
Introduction
Welcome
Insider Threat Programs must carefully plan their migaon responses to avoid escalaon of risk and
to engender a thorough and measured approach to the iniaon of punive acon.
Objectives
Here are the lesson objecves. Take a moment to review them.
• Idenfy the primary tenets in responding to insider threat maers
• List possible consequences of inappropriate migaon responses
• Describe factors to consider when formulang a migaon response to an insider threat
incident
Response Basics
Overview
Insider Threat Programs must follow five primary tenets when planning responses to insider threat
incidents, the most important of which is “first, do no harm.” Insider Threat programs must also
establish and maintain internal procedures and authories, avoid alerng the individual that they
have been idenfied as a potenal insider threat, protect the individual’s privacy and civil liberes,
and preserve chain of custody and properly handle evidence.
Let’s examine these in greater detail.
First, Do No Harm
When an insider threat incident occurs, your Insider Threat Program must carefully assess the
situaon to avoid exacerbang the situaon or increasing risk. Consider whether there is imminent
danger to the individual or to others and whether there is an acve transmial of classified
informaon. The Insider Threat Program must thoroughly plan its response before taking acon and
avoid knee-jerk responses. When planning, communicate and coordinate with your Insider Threat
Program team members and other organizaonal elements.
Establish and Maintain Procedures and Authorities
Your Insider Threat Program must ensure that it has detailed procedures and authories in place for
migaon response opons and should maintain a general response plan that outlines the overall
roles and responsibilies of Insider Threat Program personnel and Hub members or other staff and
departments.
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 3-2
Avoid Alerting the Individual
In general, your Insider Threat Program should avoid alerng the individual that they have been
idenfied as a potenal insider threat. This allows the Program the me needed to determine an
appropriate response, ensures the privacy of the individual, and preserves evidence. Note that in
some cases immediate intervenon may be required.
Protect Privacy & Civil Liberties
Your Insider Threat Program must consider the individual’s privacy and civil liberes when
developing migaon response opons. Ensure that personal informaon is properly handled,
accessed, used, reported, and retained in accordance with applicable laws, policies, and regulaons.
Preserve Chain of Custody and Evidence
Your Insider Threat Program must ensure that early acons taken in incident response do not
interfere with the ability of law enforcement or counterintelligence to conduct invesgaons or
operaons, or inhibit future prosecuon, in cases that require reporng to external agencies. Work
with your general counsel and the referral agency to ensure that any evidence associated with the
incident is handled properly and adheres to the proper chain of custody.
The Preserving Invesgave and Operaonal Viability in Insider Threat course offers addional
informaon if you would like to learn more. You may register for this course through the Center for
Development of Security Excellence (CDSE) website.
Unintended Consequences
Impacts
Your Insider Threat Program’s response to insider threat indicators or incidents can have long-
reaching effects. Even seemingly viable soluons may have inadequate or negave impacts on the
individual, on the morale of other personnel, on the mission of your organizaon, and on public
percepon of your organizaon.
Individuals
Possible negave impacts on individuals include disgruntlement due to an overly aggressive
response that makes the individual feel poorly treated, which increases risk, and effects to the
career or life of the individual due to poor informaon handling that persists even if the
individual is exonerated of wrongdoing or was falsely accused.
Morale
Possible negave impacts on the morale of other personnel include disgruntlement throughout
the organizaon if others learn of an overly aggressive response. This may result in reduced
vigilance and hesitancy to report. Overly weak responses may also deter reporng, as it may
make personnel feel that it is pointless to report indicators. In addion, seeing a colleague
charged with or convicted of a crime, even when it is necessary, may impact morale.
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 3-3
Mission
A possible negave impact on the mission of the organizaon includes personnel that
circumvent the rules to get their work done due to onerous rule or procedure changes at the
organizaon level.
Public Perception
A possible negave impact on public percepon of your organizaon includes low morale and
diminished future recruitment capability due to media coverage on the situaon and your
response.
Threat Analysis
Overview
Insider Threat Programs must take the me to perform the proper gathering and analysis of data
before taking acon. If an indicator has a plausible explanaon and does not increase the risk
associated with an individual, an immediate reacon may do more harm than good. Conversely,
even if the risk associated with an individual is elevated, it is not necessarily a precursor to a naonal
security crime or act of violence. An immediate response in these instances may compromise the
ability of law enforcement and counterintelligence to pursue inquiries, invesgaons, or operaons.
Let’s take a closer look at the consideraons to keep in mind during threat analysis.
Analysis Goal
The Insider Threat Program should begin by establishing the goal of analysis. What quesons is the
team trying to answer? State your purpose clearly and in mulple ways to clarify meaning and scope,
and consider breaking the problem down into smaller pieces.
For example, consider these large quesons that Insider Threat Programs work to resolve:
• Is the individual currently harming the organizaon’s resources?
• If so, is the harm intenonal?
• Is there a risk that the individual will do so in the future?
Breaking these into smaller quesons can help you to grasp and manage your goal.
When formulang quesons, aim to be clear and precise. Anything is possible, so be specific. A clear
and precise queson might be to consider whether it is possible that the individual stole classified
informaon.
Focus on quesons that are significant, answerable, and relevant, such as, “Did the individual have
access to the safe? Does the individual display unexplained affluence?”
Finally, differenate between quesons that have a definive answer, are a maer of opinion, and
require consideraon of mulple viewpoints. The queson, “Were the individual’s credenals used
to log onto the system on a specific date?” has a definive answer, while the queson, “Was the
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 3-4
individual upset?” is a maer of opinion. While the answer may be relevant and the Program can
aggregate the opinions of mulple people to draw a conclusion, the answer is subjecve. Also
consider whether other viewpoints might reveal a plausible explanaon for an indicator. For
example, late night acvity on an informaon system may seem suspicious, but the cybersecurity
subject maer expert may idenfy the acvity as a common pracce of batch patching and updates
scheduled to occur when the system is at its lowest usage.
Fair and Balanced Assessment
Insider Threat Programs must also strive toward a fair and balanced assessment of each case. To do
so, first idenfy and acknowledge your assumpons. Consider whether they are jusfiable and how
they shape your point of view. Next, seek other points of view and evaluate their merits. Finally,
ground all claims with the informaon available. Ensure that your posion is supported by the
evidence and is based on relevant informaon. Crically evaluate your posion to determine
whether you have considered all of the relevant informaon, whether your conclusion goes beyond
the evidence available, and whether there is an argument to be made against your posion.
With these consideraons in mind, review the example real-world case study below.
Example
Jonathan Toebbe was a nuclear engineer holding the highest levels of naonal security eligibility,
as he had access to highly classified informaon concerning naval nuclear propulsion, design
elements, operang parameters, and performance characteriscs. Details of United States
nuclear assets and systems are one of our closest guarded secrets, so it's not surprising that they
are also the most sought aer by adversaries.
In April 2020, Toebbe sent a package to a foreign government containing a sample of Top Secret
nuclear reactor data and instrucons for establishing a covert relaonship to purchase addional
Top Secret data. He began corresponding via encrypted email with a representave of the
foreign government, who offered Toebbe $100,000 in cryptocurrency if he could provide them
with more data. With the help of his wife, Diana, Toebbe connued to secretly deliver stolen Top
Secret nuclear data via dead drops to his contact over several months.
Unknown to Toebbe, however, the package he inially sent to the foreign government was
intercepted by the United States Embassy and Federal Bureau of Invesgaon, and his foreign
contact was in fact an undercover agent. This iniated the undercover operaon that eventually
caught him. Both he and his wife were arrested and pleaded guilty to Conspiracy to
Communicate Restricted Data, and both were sentenced to over 20 years in prison.
Based on what we’ve seen in this lesson, what assumpons can be drawn about the Toebbes
and their movaons? Are there any possible alternave explanaons for their acons?
What do you think the use of stealthy dead drops and requests for cryptocurrency payments
might suggest about Toebbe?
How have his acons threatened our naonal security? Should the FBI have acted sooner
considering the category of informaon involved?
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 3-5
Review Activities
Review Activity 1
Put yourself into the Insider Threat Program at Jonathan Toebbe’s organizaon. In planning a
migaon response to what you have learned about his acons, which of the following should you
consider?
Select all that apply. Then check your answers in the Answer Key at the end of this Student Guide.
There is an acve transmial of classified informaon.
Toebbe should be nofied that he has been idenfied as a risk.
Toebbe’s personal informaon must be properly handled.
You should coordinate with law enforcement or counterintelligence to properly handle
evidence.
Review Activity 2
How can an Insider Threat Program effecvely plan migaon response opons?
Select the best response. Then check your answer in the Answer Key at the end of this Student Guide.
Establish the roles and responsibilies for involved personnel on a case-by-case basis
Act as quickly as possible to minimize how long the risk persists
Establish procedures, authories, and a general response plan
Gather evidence by any means necessary
Review Activity 3
Which of the following is NOT a potenal unintended consequence of a failed organizaonal
migaon response to a possible insider threat?
Select the best response. Then check your answer in the Answer Key at the end of this Student Guide.
Poor public percepon of the organizaon
Reduced employee morale
Monitoring of organizaon by federal law enforcement
Circumvenon of rules by personnel due to procedure changes
Review Activity 4
An insider threat incident occurred at your facility. Which of these approaches would support an
effecve migaon response?
Select the best response. Then check your answer in the Answer Key at the end of this Student Guide.
Act as quickly as possible to put the incident behind your organizaon.
Look for the simplest explanaon, as this is most likely to be accurate.
Ask smaller quesons to differenate fact from opinion.
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 4-1
Lesson 4: Muldisciplinary Migaon Responses
Introduction
Objectives
Muldisciplinary insider threat teams are uniquely posioned to cra migaon responses tailored
to specific insider threat incidents.
Muldisciplinary insider threat teams are comprised of subject maer experts from:
• Law enforcement
• Security
• Counterintelligence
• Cybersecurity
• Behavioral science
• Human resources
• Legal
Here are the lesson objecves. Take a moment to review them.
• Differenate between organizaonal and individual responses
• Summarize the ability of muldisciplinary teams to cra migaon responses tailored to
insider threat incidents
Types of Responses
Organizational and Individual
Responses to insider threat incidents may be organizaonal, individual, or both. Organizaonal
responses address a systemic problem with security procedures, training, hiring pracces, policies,
or other procedures that increase the risk associated with the insider threat. Individual responses
address a specific incident and are designed to migate the risk associated with or harm caused by a
specific individual. In some cases, an organizaonal response may be effecve in addion to or in
place of an individual response.
Organizational Response
Examples of organizaonal responses:
• Changing policy or Standard Operang Procedures (SOP) throughout the organizaon
• Disabling thumb drives across the organizaon to prevent downloading sensive
informaon
• Instung random bag checks
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 4-2
• Introducing metal detectors
• Providing training or briefings to:
o Increase awareness of taccs used by adversaries
o Prevent individuals from becoming unwing insider threats
Individual Response
Examples of individual responses:
• Internal referrals to human resources or security
• Referral to counterintelligence or law enforcement for inquiry, invesgaon, or
operaon
• Referral to counseling, such as mental health or financial
• Punive acons, such as revocaon of access or terminaon of employment
Tailored Multidisciplinary Mitigation Responses
Overview
The muldisciplinary nature of Insider Threat Programs allows them to cra responses tailored to
specific behaviors. A muldisciplinary team working together can provide the most effecve
responses, which oen include a mul-faceted implementaon that may include a mix of
organizaonal and individual responses that cover mulple disciplines.
To learn more about the disciplines that comprise a muldisciplinary insider threat team, refer to the
Developing a Muldisciplinary Insider Threat Capability course. You may register for this course
through the Center for the Development of Security Excellence (CDSE) website.
Human Resources (HR)
Example response opons specific to human resources:
• Referral to the Employee Assistance Program (EAP) for resources in financial counseling,
lending programs, mental health, and other well-being programs
• Medical referrals
• Mediaon with supervisors
• Training
• Employee terminaon procedures
• Other career opportunies
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 4-3
Cybersecurity
Example response opons specific to cybersecurity:
• Reduce privileges or system access
• Reconfigure hardware, such as to prevent the use of thumb drives or disc burning
• Limit downloadable file size
• Limit or prevent prinng
• Conduct training and awareness campaigns on phishing and other cyber targeng
methods
• Increase monitoring
Security
Example response opons specific to security:
• Log a security violaon or infracon
• Provide security counseling, training, or awareness
• Implement daily bag checks
• Implement random drug and alcohol tesng
• Conduct physical monitoring
• Modify Standard Operang Procedures (SOP)
Counterintelligence (CI)
Example response opons specific to counterintelligence:
• Referral to the cognizant CI acvity for inquiry, invesgaon, or operaon as warranted
• Provide training on foreign targeng methods and recruitment
• Develop a foreign travel brief/debrief program
• Provide threat awareness materials
Law Enforcement (LE)
Example response opons specific to law enforcement:
• Referral to the cognizant LE acvity for inquiry or invesgaon as warranted
• Provide criminal threat briefings and awareness materials
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 4-4
Behavioral Science
Example response opons specific to mental health and behavioral science:
• Treatment recommendaons
• Referral to marital, grief, or other mental health counseling
• Referral to substance abuse rehabilitaon programs
• Referral to suicide prevenon
Legal
Be sure to include legal in the development of response opons to ensure the potenal
response aligns with privacy protecon requirements and other policies.
Monitoring Response
Once the Insider Threat Program implements a migaon response, it must monitor the response to
determine if the risk has been minimized. Note that implemenng a migaon response opon does
NOT eliminate risk.
Coordinate with your Insider Threat Program partners to determine whether addional migaon is
required. Keep in mind that law or policy may prevent some partners from sharing informaon with
the Program. These may include Employee Assistance Programs, law enforcement, and
counterintelligence. As such, the Insider Threat Program should remain vigilant for addional or
escalang indicators and document behaviors or acvies of concern.
Finally, be sure to periodically re-evaluate the migaon response to determine if it remains the best
opon.
Case Study
Recall Mark Steven Domingo, who provided material support to terrorists and aempted to use a
weapon of mass destrucon. Let’s assume for a moment that a colleague, friend, or family member
reported Domingo’s online acvies early on rather than allow his behavior to escalate. What
migaon responses might a muldisciplinary Insider Threat Program have used to proacvely
redirect Domingo away from the crical pathway?
Some possible migaon responses that may have applied to the Domingo case include a
combinaon of:
• Referral to counseling resources to help him manage his anger and address depression
(individual response; Behavioral Science)
• Monitoring user acvies and implemenng key word triggers (organizaonal response;
Cybersecurity)
• Instung daily bag checks within the organizaon (organizaonal response; Security)
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 4-5
• Referral to law enforcement for criminal acvity, such as threats of violence or preparaon
to commit a mass aack (individual response; Law Enforcement)
• Referral to counterintelligence for affiliaon with known or suspected terrorists (individual
response; Counterintelligence)
• Referral to an employee assistance program or terminaon of employment. Domingo was
separated from the Army due to his behavior. His separaon did not diminish the risk of him
posing a violet threat to others. (individual response; HR)
Note that migaon responses are not a one-size-fits-all soluon. No two insider threat incidents are
alike, even when similar potenal risk indicators are present, so be sure your team evaluates each
incident on a case-by-case basis.
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 4-6
Review Activities
Review Activity 1
For each migaon response, select whether it is an organizaonal or individual response. Then
check your answers in the Answer Key at the end of this Student Guide.
Referral to counterintelligence or law enforcement
Organizaonal
Individual
Provide threat awareness materials
Organizaonal
Individual
Issue a security violaon
Organizaonal
Individual
Terminate employment
Organizaonal
Individual
Offer career path opons
Organizaonal
Individual
Provide an Employee Assistance Program
Organizaonal
Individual
Conduct user acvity monitoring of informaon technology systems
Organizaonal
Individual
Referral to mental health counseling
Organizaonal
Individual
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 4-7
Review Activity 2
In the Jonathan Toebbe case study, which of the following disciplines were instrumental in detecon
and migaon? Visit Resources
to access the case study.
Select all that apply. Then check your answers in the Answer Key at the end of this Student Guide.
Law Enforcement
Human Resources
Counterintelligence
Behavioral Science
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 5-1
Lesson 5: Reporng Requirements
Introduction
Objectives
Insider Threat Programs must report certain types of informaon. This lesson describes reporng
requirements for DOD, Federal, and industry Insider Threat Programs.
Here is the lesson objecve. Take a moment to review it.
• Idenfy reporng requirements that apply to Insider Threat Programs
Reporting
Overview
DOD, Federal agency, and industry Insider Threat Programs operate under different regulaons and
requirements for reporng. When reporng, your Program may need to cease its acvies, such as
when the referral agency iniates an inquiry or invesgaon. In other instances, the Program may be
able to employ alternate migaon opons concurrent with external acons. Coordinate with the
referral agency and your General Counsel to determine the appropriate steps to take aer reporng.
Let’s examine the reporng requirements for DOD, Federal, and industry Insider Threat Programs in
greater detail.
DOD Requirements
DOD Insider Threat Programs are obligated to report certain types of informaon to:
• The Federal Bureau of Invesgaon (FBI)
• The DOD Insider Threat Management and Analysis Center (DITMAC)
• The cognizant Military Department Counterintelligence (MILDEP CI) Office
In addion, DOD Insider Threat Programs must report adverse informaon pursuant to the
adjudicave guidelines to informaon systems such as the Defense Informaon System for Security
(DISS) or other databases as required by the organizaon. DOD Insider Threat Programs must also
report criminal acvity to the appropriate military or local law enforcement organizaon. Finally, the
Program must comply with any other internal reporng procedures it has established.
FBI Reporting
Secon 811 of the Intelligence Authorizaon Act requires reporng the to the FBI when
classified informaon is being, or may have been, disclosed in an unauthorized manner to a
foreign power or an agent of a foreign power. To report to the FBI, use the FBI Headquarters
email point of contact for secure reporng or contact your local field office.
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 5-2
Visit the course Resources to access a job aid for Secon 811 referrals.
DITMAC Reporting
The DITMAC sets their own reporng thresholds, which are connuously updated based on
threats. DITMAC thresholds were published in 2022. When reporng to the DITMAC, use the
DITMAC System of Systems (DSOS).
Visit the course Resources
to access the current DITMAC reporng thresholds.
MILDEP CI Office Reporting
Enclosure 4 of DOD Direcve (DODD) 5240.06, Counterintelligence Awareness and Reporng
lists behaviors that DOD enes must report to the MILDEP CI Office, including contacts,
acvies, indicators, and behaviors related to foreign intelligence, internaonal terrorism, and
foreign intelligence enty (FIE) associated cyberspace.
Check your organizaon’s procedures for reporng to your cognizant MILDEP CI Office.
Federal Requirements
Federal Insider Threat Programs are obligated to report to the FBI under Secon 811 of the
Intelligence Authorizaon Act when classified informaon is being, or may have been, disclosed in an
unauthorized manner to a foreign power or an agent of a foreign power.
In addion, Federal Insider Threat Programs must follow any other internal reporng procedures
established within the organizaon.
Industry Requirements
Industry Insider Threat Programs are obligated to report certain types of informaon to the FBI and
the Defense Counterintelligence and Security Agency (DCSA).
Secon 117.8 of 32 CFR Part 117, known as the Naonal Industrial Security Program Operang
Manual or “NISPOM rule”, requires cleared industry to report actual, probable, or possible
espionage, sabotage, terrorism, or subversive acvies at any locaon to the FBI and DCSA. The
NISPOM rule also requires cleared contractors to report adverse informaon.
In addion, industry Insider Threat Programs must report via informaon systems such as DISS or
other databases as directed and follow any other internal reporng procedures as established by
their Insider Threat Program.
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 5-3
Review Activities
Review Activity 1
For each requirement, select whether it applies to DOD, Federal, and industry Insider Threat
Programs. Then check your answers in the Answer Key at the end of this Student Guide.
Report to the FBI when classified informaon is disclosed in an unauthorized manner to a foreign
power
DOD
Federal
Industry
Report to the DITMAC
DOD
Federal
Industry
Report adverse informaon to DCSA
DOD
Federal
Industry
Review Activity 2
Which would you report under Secon 811 of the Intelligence Authorizaon Act?
Select the best response. Then check your answer in the Answer Key at the end of this Student Guide.
Authorized disclosure of unclassified informaon to a foreign government
Unauthorized disclosure of classified informaon to a foreign government
Unauthorized disclosure of classified informaon to a domesc-owned company
Authorized disclosure of unclassified documents to a domesc media outlet
Review Activity 3
Which reporng thresholds meet DITMAC requirements?
Select all that apply. Then check your answer in the Answer Key at the end of this Student Guide.
Unauthorized disclosure
Allegiance to the United States
Serious threat
Criminal conduct and affiliaon
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page 6-1
Lesson 6: Course Conclusion
Conclusion
Summary
Insider Threat Programs migate the threats posed by wing and unwing insiders through the
deployment of muldisciplinary responses designed to lead the individual away from the crical
pathway to becoming an insider threat and reporng informaon outside of the Program as
required.
As you work within your Program to cra tailored and effecve migaon responses, remember that
each insider threat incident is unique and should be carefully analyzed and assessed to prevent
causing further harm.
Lesson Summary
Congratulaons! You have completed the Insider Threat Migaon Responses course.
You should now be able to perform all of the listed acvies.
• Explain the role of Insider Threat Programs in migang the risks posed by insider threats
and how programs migate those risks
• Describe factors to consider when formulang a migaon response to an insider threat
incident
• Summarize the ability of muldisciplinary teams to cra migaon responses tailored to
insider threat incidents
• Idenfy reporng requirements that apply to Insider Threat Programs
To receive course credit, you must take the Insider Threat Migaon Responses examinaon. If you
accessed the course through the Security Training, Educaon, and Professionalizaon Portal (STEPP),
please use that system to access the online exam.
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page A-1
Appendix A: Answer Key
Lesson 2 Review Activities
Review Activity 1
You receive a report that Ted, an employee in your organizaon, frequently asks colleagues to loan
him money. Ted told one of his colleagues that he has a large gambling problem and a large debt he
needs to resolve. Where on the insider threat crical pathway is Ted’s situaon, based on this
report?
Personal Predisposions
Stressors
Concerning Behaviors
All of the Above (correct response)
Feedback: Ted’s situaon falls under all stages of the crical pathway. He has an admied gambling
addicon (personal predisposion), a large debt (stressor), and frequently tries to borrow money
from friends/colleagues (concerning behavior).
Review Activity 2
Which of the following is an effecve way to migate a potenal insider threat based upon what you
know about Ted’s situaon?
Refer Ted to law enforcement
Tell Ted’s colleagues to loan money to him
Provide him with support and resources to deal with his addicon (correct response)
Terminate Ted’s employment
Feedback: In Ted’s situaon, migaon is best achieved through providing him with support and
resources to deal with his addicon.
Review Activity 3
What funcons do Insider Threat Programs perform to reduce the risks posed by insider threats?
Provide leaders with informaon about the threat landscape
Mandate security awareness training for employees
Conduct user acvity monitoring
Document and make available the consequences of insider threat acvity
Feedback: These are all examples of funcons performed by Insider Threat Programs, including
prevenon, deterrence, detecon, and migaon.
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page A-2
Lesson 3 Review Activities
Review Activity 1
Put yourself into the Insider Threat Program at Jonathan Toebbe’s organizaon. In planning a
migaon response to what you have learned about his acons, which of the following should you
consider?
There is an acve transmial of classified informaon. (correct response)
Toebbe should be nofied that he has been idenfied as a risk.
Toebbe’s personal informaon must be properly handled. (correct response)
You should coordinate with law enforcement or counterintelligence to properly handle
evidence. (correct response)
Feedback: In assessing the situaon, it is necessary to consider the amount of risk, including whether
classified informaon is acvely being transmied. Although you should avoid alerng the individual,
it is also sll necessary to ensure the subject’s privacy and civil liberes are preserved, and that any
acons taken by the Insider Threat Program do not hinder later acons by law enforcement or
counterintelligence.
Review Activity 2
How can an Insider Threat Program effecvely plan migaon response opons?
Establish the roles and responsibilies for involved personnel on a case-by-case basis
Act as quickly as possible to minimize how long the risk persists
Establish procedures, authories, and a general response plan (correct response)
Gather evidence by any means necessary
Feedback: Insider Threat Programs should maintain detailed procedures and authories for
migaon response opons, as well as a general response plan that outlines roles and
responsibilies.
Review Activity 3
Which of the following is NOT a potenal unintended consequence of a failed organizaonal
migaon response to a possible insider threat?
Poor public percepon of the organizaon
Reduced employee morale
Monitoring of organizaon by federal law enforcement (correct response)
Circumvenon of rules by personnel due to procedure changes
Feedback: The unintended circumstances of a failed migaon response by an organizaon can
affect the individual, the organizaon’s morale, the mission, and public percepon.
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page A-3
Review Activity 4
An insider threat incident occurred at your facility. Which of these approaches would support an
effecve migaon response?
Act as quickly as possible to put the incident behind your organizaon.
Look for the simplest explanaon, as this is most likely to be accurate.
Ask smaller quesons to differenate fact from opinion. (correct response)
Feedback: When performing analysis for a migaon response, take the me to plan thoroughly,
clarify and be specific with your goals, and strive for a fair and balanced assessment of the case.
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page A-4
Lesson 4 Review Activities
Review Activity 1
Referral to counterintelligence or law enforcement
Organizaonal
Individual (correct response)
Feedback: A referral to counterintelligence addresses a specific incident and aims to migate the risk
associated with the individual.
Provide threat awareness materials
Organizaonal (correct response)
Individual
Feedback: Training and awareness campaigns address systemic issues across the organizaon.
Issue a security violaon
Organizaonal
Individual (correct response)
Feedback: A logged security violaon addresses a specific incident and aims to migate the risk
associated with the individual.
Terminate employment
Organizaonal
Individual (correct response)
Feedback: Terminaon of employment is a punive acon that addresses a specific incident and aims
to migate the risk associated with the individual.
Offer career path opons
Organizaonal (correct response)
Individual
Feedback: A program offering career opportunies is an organizaonal response.
Provide an Employee Assistance Program
Organizaonal (correct response)
Individual
Feedback: An Employee Assistance Program is an organizaonal response.
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page A-5
Conduct user acvity monitoring of informaon technology systems
Organizaonal (correct response)
Individual
Feedback: User acvity monitoring is a way to migate risk across the organizaon.
Referral to mental health counseling
Organizaonal
Individual (correct response)
Feedback: A referral to mental health counseling aims to migate the risk associated with the
individual.
Review Activity 2
In the Jonathan Toebbe case study, which of the following disciplines were instrumental in detecon
and migaon? Visit Resources
to access the case study.
Law Enforcement (correct response)
Human Resources
Counterintelligence (correct response)
Behavioral Science
Feedback: Toebbe was prevented from disclosing unauthorized informaon as a result of a
muldisciplinary response comprised by counterintelligence and law enforcement. This includes his
contact with a foreign country and the resulng invesgaon by the Federal Bureau of Invesgaon.
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page A-6
Lesson 5 Review Activities
Review Activity 1
Report to the FBI when classified informaon is disclosed in an unauthorized manner to a foreign
power
DOD (correct response)
Federal (correct response)
Industry
Feedback: DOD and Federal Insider Threat Programs must report to the FBI when classified
informaon is or may have been disclosed in an unauthorized manner to a foreign power, per the
Intelligence Authorizaon Act. Industry must report the loss of classified informaon to DCSA, and
espionage, sabotage, or terrorism to both the FBI and DCSA, per the NISPOM Rule.
Report to the DITMAC
DOD (correct response)
Federal
Industry
Feedback: DOD Insider Threat Programs must report informaon that meets DITMAC reporng
thresholds to the DITMAC.
Report adverse informaon to DCSA
DOD
Federal
Industry (correct response)
Feedback: Industry Insider Threat Programs must report adverse informaon as listed in the NISPOM
Rule to DCSA.
Review Activity 2
Which would you report under Secon 811 of the Intelligence Authorizaon Act?
Authorized disclosure of unclassified informaon to a foreign government
Unauthorized disclosure of classified informaon to a foreign government (correct response)
Unauthorized disclosure of classified informaon to a domesc-owned company
Authorized disclosure of unclassified documents to a domesc media outlet
Feedback: Secon 811 of the Intelligence Authorizaon Act concerns the unauthorized release of
classified informaon to foreign powers or agents.
Insider Threat Migaon Responses Student Guide
April 2024 Center for Development of Security Excellence Page A-7
Review Activity 3
Which reporng thresholds meet DITMAC requirements?
Unauthorized disclosure (correct response)
Allegiance to the United States (correct response)
Serious threat (correct response)
Criminal conduct and affiliaon (correct response)
Feedback: All of these thresholds act as a guide for DOD Component Hubs to use when determining
whether an incident involved a DOD covered person and should be reported as an insider threat to
the DITMAC.
