ASD ISM 1625 Develop insider threat mitigation programs
What it says
An insider threat mitigation program is developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCreate and manage a program to address threats from within the organisation.
An insider threat mitigation program helps organisations manage risks that come from their own employees, contractors, or business partners. This is crucial because trusted insiders can sometimes accidentally or intentionally cause harm, like leaking sensitive information or damaging systems, which can hurt the organisation's reputation and bottom line.
Free. Save your status, tasks and notes.
Why it matters
Without an insider threat mitigation program, malicious or inadvertent insiders can exfiltrate sensitive data, cause fraud, and disrupt services, damaging trust and compliance.
How to implement
The HR team, alongside the IT and security teams, should develop a clear policy that defines what an insider threat is and outlines the behaviours that raise red flags.
They can do this by researching best practices and adapting them to the specific context of the organisation.
Managers should organise regular training sessions for all employees about the signs of insider threats and what to do if they notice anything suspicious.
This can be done by bringing in a security expert to conduct workshops or by using online training modules.
IT staff should set up systems to monitor and log network activities to detect unusual patterns that could indicate insider threats.
This can include tracking access to sensitive data and monitoring for unusual downloads or data transfers.
Executives should establish a cross-departmental team to regularly review insider threat cases and program effectiveness.
The team can meet quarterly to discuss potential incidents, review past cases, and update policies as necessary.
The security lead should create a response plan detailing the steps to take during an insider threat incident.
This includes notifying the appropriate authorities, conducting an internal investigation, and applying disciplinary measures if needed.
Keep it running
Maintain the insider threat program by monitoring and reviewing indicators (access anomalies, privilege misuse) and regularly updating detection rules, reporting paths and response playbooks.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The insider threat policy document.
Look at
The clarity of the definitions and guidelines for identifying insider threats.
Good evidence
A detailed policy document that clearly defines insider threats and sets out expected behaviours and reporting procedures.
- Check 2 of 5What an auditor asks for
Look at
The attendance records and training content provided.
Good evidence
Is comprehensive training materials and a list showing regular attendance by all employees.
- Check 3 of 5What an auditor asks for
Ask for
Reports from the monitoring and logging systems.
Look at
Data access logs and any alerts triggered by unusual activities.
Good evidence
Includes detailed logs showing proactive monitoring and timely responses to potential incidents.
- Check 4 of 5What an auditor asks for
Look at
Documented discussions and decisions on threats and program updates.
Good evidence
Thorough records of meetings with noted action items and follow-ups.
- Check 5 of 5What an auditor asks for
Ask for
The insider threat incident response plan.
Look at
The clarity and completeness of the procedures described.
Good evidence
Plan is one that outlines step-by-step responses to various threat scenarios and includes contact details for responsible parties.
Mappings
Closest match in ISO/IEC 27001: A.6.1, Personnel background verification, which this control covers in full and more.
ISO/IEC 27001: 2 mappings
This control is broader than A.6.1.
ISM-1625 requires an insider threat mitigation program to be developed, implemented and maintained. Background verification before engagement and on an ongoing basis, as required by Annex A 6.1, is one of the core preventive measures such a program relies on to reduce the risk of trusted insiders. ISM-1625 is a broader program that also includes detection and response, whereas Annex A 6.1 addresses only personnel screening.
This control partially overlaps A.8.16.
ISM-1625 requires an insider threat mitigation program to be developed, implemented and maintained. Monitoring networks, systems and applications for anomalous behaviour under Annex A 8.16 is a key detection capability for such a program, as it surfaces unusual activity by authorised users. The insider threat program also covers personnel and procedural measures that Annex A 8.16 does not, while Annex A 8.16 also addresses external threats.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.