Does this standard require an insider risk program?

Some sources require explicit insider threat program elements; others provide controls or outcomes that support insider risk. Applicability depends on sector, contract, data type, jurisdiction, and scope.

Can this be mapped to the IRCF™?

Yes. The security controls, processes, and governance objectives outlined in Insider Threat Matrix and Insider Risk map directly to the Insider Risk Capability Framework™ (IRCF™). Specifically, the core provisions align with the primary Investigation capability component, with supporting provisions aligning across the Analysis, Monitoring, Data Protection, IAM, Governance components.

Back to Standards Hub

Cybersecurity & Control Catalogs

Reviewed: June 24, 2026Role: Principal Security Advisor, ITMG®

Official Source: Forscie Limited

Insider Threat Matrix and Insider Risk

The Insider Threat Matrix(TM) is an open framework maintained by Forscie Limited for computer-enabled insider threat investigations. It provides investigation language across motive, means, preparation, infringement, and anti-forensics.

Why This Standard Matters

Insider Threat Matrix helps organizations define expectations, evidence, and accountability for reducing exposure created by trusted access. In insider risk, the relevant question is not only whether a control exists, but whether it reduces the likelihood, impact, or duration of misuse, negligence, compromise, or unauthorized disclosure.

Insider Risk Relevance

•Always attribute the Insider Threat Matrix(TM) to Forscie Limited.
•Do not imply ITMG® owns the Matrix, and do not reproduce beyond applicable license or trademark guidance.

Required Tools & Evidence Categories

These operational files, approvals, and records provide defensible evidence that the organization's insider safeguards are actively reducing exposure:

Policy and governance records

Risk register entries and accepted-risk records

Access review evidence and joiner/mover/leaver data

Logging, alerting, monitoring, and case-management evidence

Data classification, DLP, DSPM, encryption, retention, and legal hold evidence

Training, acknowledgement, workforce communication, and privacy review records

Implementation: Controls vs. Common Mistakes

Controls and Procedures

✓Governance and ownership
✓Access authorization and periodic review
✓Monitoring approval and privacy review
✓Detection, triage, investigation, containment, and closeout
✓Evidence preservation and lessons learned
✓Metrics, assurance, and management reporting

Common Mistakes to Avoid

Treating the framework as a checklist instead of a risk-management source.
Mapping too many controls without identifying the exposure each control reduces.
Ignoring workforce trust, privacy, legal, and labor considerations.
Collecting evidence that proves activity happened but not that risk was reduced.
Duplicating IRCF™ capability content instead of linking to the canonical IRCF™ page.

IRCF™ Component Map

Primary Alignment

Investigation

Related Capabilities

AnalysisMonitoringData ProtectionIAMGovernance

Primary IRCF™ component: Investigation. Related IRCF™ components: Analysis; Monitoring; Data Protection; IAM; Governance. This page links external guidance to the canonical IRCF™ capability model without replacing IRCF™ component pages.

Explore Canonical IRCF™ Model

Common Applied Use Cases

Mapping investigative observations to insider-specific objects

Explaining preparation, infringement, and anti-forensics behaviors

Connecting case evidence to IRCF™ components

Using a shared taxonomy across cyber, investigations, and program leadership

Legal & Privacy Constraints

Monitoring, investigation, employee data processing, disciplinary action, and evidence handling can trigger legal, privacy, works council, labor, contract, and ethics obligations. This page is educational and is not legal advice.

Common Questions for Insider Threat Matrix and Insider Risk

Evaluate Your Organization Against Insider Threat Matrix and Insider Risk

Use RiskTKO® or an ITMG® Guided Exposure Assessment to translate Insider Threat Matrix into prioritized insider risk exposure actions and executive-ready evidence.

Schedule Assessment Demo RiskTKO® Platform