PM-12 Insider Threat Program

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Not in a baseline	Organization	None

Related controls: AC-6, AT-2, AU-6, AU-7, AU-10, AU-12, AU-13, CA-7, IA-4, IR-4, MP-7, PE-2, PM-16, PS-3, PS-4, PS-5, PS-7, PS-8, SC-7, SC-38, SI-4, PM-14

Control statement

Implement an insider threat program that includes a cross-discipline insider threat incident handling team.

NIST discussion

Organizations that handle classified information are required, under Executive Order 13587 EO 13587 and the National Insider Threat Policy ODNI NITP , to establish insider threat programs. The same standards and guidelines that apply to insider threat programs in classified environments can also be employed effectively to improve the security of controlled unclassified and other information in non-national security systems. Insider threat programs include controls to detect and prevent malicious insider activity through the centralized integration and analysis of both technical and nontechnical information to identify potential insider threat concerns. A senior official is designated by the department or agency head as the responsible individual to implement and provide oversight for the program. In addition to the centralized integration and analysis capability, insider threat programs require organizations to prepare department or agency insider threat policies and implementation plans, conduct host-based user monitoring of individual employee activities on government-owned classified computers, provide insider threat awareness training to employees, receive access to information from offices in the department or agency for insider threat analysis, and conduct self-assessments of department or agency insider threat posture.

Insider threat programs can leverage the existence of incident handling teams that organizations may already have in place, such as computer security incident response teams. Human resources records are especially important in this effort, as there is compelling evidence to show that some types of insider crimes are often preceded by nontechnical behaviors in the workplace, including ongoing patterns of disgruntled behavior and conflicts with coworkers and other colleagues. These precursors can guide organizational officials in more focused, targeted monitoring efforts. However, the use of human resource records could raise significant concerns for privacy. The participation of a legal team, including consultation with the senior agency official for privacy, ensures that monitoring activities are performed in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.

Assessment objectives (SP 800-53A)

Objectives and methods for PM-12

Determine if an insider threat program that includes a cross-discipline insider threat incident handling team is implemented.

Interview: Organizational personnel with information security and privacy program planning and plan implementation responsibilities; organizational personnel responsible for the insider threat program; members of the cross-discipline insider threat incident handling team; legal counsel; organizational personnel with information security and privacy responsibilities.

Test: Organizational processes for implementing the insider threat program and the cross-discipline insider threat incident handling team; mechanisms supporting and/or implementing the insider threat program and the cross-discipline insider threat incident handling team.

Policy statement

• The Chief Information Security Officer shall implement an insider threat program. (PM-12)
• The program shall include a cross-discipline insider threat incident handling team, with members from at least security, human resources, legal and privacy. (PM-12)

Federal systems

Executive Order 13587 (October 7, 2011), section 2.1(b), requires the heads of agencies that operate or access classified computer networks to “implement an insider threat detection and prevention program consistent with guidance and standards developed by the Insider Threat Task Force” that section 6 establishes.

• If the agency operates or accesses classified computer networks, the insider threat program shall meet Executive Order 13587, section 2.1(b), and the guidance and standards of the Insider Threat Task Force. (PM-12)

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-12 asks for an insider threat program that includes a cross-discipline team to handle insider threat incidents. NIST’s PM-12 discussion describes the program’s core as the centralized integration and analysis of technical and nontechnical information, to spot potential insider threat concerns. A senior official is designated to run and oversee it. The discussion also lists insider threat policies and implementation plans, awareness training, access to information from other offices, and self-assessments of the program.

PM-12 is in no SP 800-53B baseline, but the PM policy includes its clause, so it applies. The discussion says the program can build on an incident handling team you already have, such as the computer security incident response team.

Common implementations. The Program Management policy has the Chief Information Security Officer implement the program. Its team has members from at least security, human resources, legal and privacy. A charter names the senior official who runs it, the team, the information each office provides, and how referrals are handled. Section 7 of the Information Security Program Plan points to that charter.

The program draws on controls you already run:

• Insider threat awareness training, with one reporting channel (AT-2(2))
• Monitoring of privileged and user activity (AU-6, SI-4), under the system monitoring standard and the log review procedure
• Personnel actions from human resources (PS-4, PS-5, PS-8), through the onboarding, transfer and termination checklist
• Disabling accounts quickly on credible indicators, as section 5.5, step 6, of the account management procedure does under AC-2(13)

NIST’s discussion warns that using human resources records “could raise significant concerns for privacy.” It calls for the legal team, with the senior agency official for privacy, to make sure monitoring follows applicable law. Involve the senior privacy official from the start, and record the legal basis and limits of each kind of monitoring before you start it.

Organization-defined parameters. PM-12 has none. The choices the PM-12 clause makes, typical values your organization may set differently:

Choice	Typical value
Who implements the program	The Chief Information Security Officer
Members of the insider threat incident handling team	At least security, human resources, legal and privacy

Evidence assessors ask for.

• The program charter or policy, and the designation of the senior official who runs it
• The team’s membership, with the office each member represents
• The information sources the program receives, and the agreements with the offices that provide them
• Records of referrals handled, with the team’s decisions
• The legal and privacy review of the program’s monitoring
• Insider threat awareness training records, and the program’s last self-assessment

Inheritance. PM-12 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. Systems supply audit records and alerts to the program.

Common findings.

• A program on paper with no team that has ever met or handled a referral.
• A security-only team with no human resources, legal or privacy members.
• Monitoring of employees started without a legal or privacy review.
• Human resources information that never reaches the program, so behavioral indicators are missed.
• Different reporting channels for training, the help desk and the program.

Enhancements. PM-12 has no enhancements.

Federal systems (as of October 2026). OMB Circular A-130, Appendix I, section 4.i(7), requires agencies to “continuously monitor, log, and audit the execution of information system functions by privileged users” to detect misuse “and to help reduce the risk from insider threats.” Its footnote 88 lists an insider threat implementation plan among the plans related to contingency planning.

Executive Order 13587 (October 7, 2011; the Federal Register lists no revocation or amendment as of October 2026), section 2.1(b), requires the heads of agencies that operate or access classified computer networks to “implement an insider threat detection and prevention program consistent with guidance and standards developed by the Insider Threat Task Force.” The PM policy carries this in its PM-12 federal block.

Artifacts

• Program Management Decision Worksheet
• Program Management Policy