IR-4(6): Insider Threats – Specific Capabilities

Control Family:

Incident Response


(Not part of any baseline)

Next Version:

Control Statement

The organization implements incident handling capability for insider threats.

Supplemental Guidance

While many organizations address insider threat incidents as an inherent part of their organizational incident response capability, this control enhancement provides additional emphasis on this type of threat and the need for specific incident handling capabilities (as defined within organizations) to provide appropriate and timely responses.