ADVISORY: Insider Threat Competency Resource Guide - U.S. Department Of .

UNCLASSIFIEDInsider Threat CRGTable 1. Definition and Key Work Activities for Insider ThreatDefinition: This CRG addresses activities to deter, detect, and mitigate insider threats. EO 13587states that an insider threat is the threat that an insider will use her/his authorized access, wittinglyor unwittingly, to do harm to the security of the United States. This threat can include damage tothe United States through espionage, terrorism, unauthorized disclosure of national securityinformation, or through the loss or degradation of departmental resources or capabilities. Note:Some departments and agencies (D/A) have expanded their insider threat programs to includedeterring, detecting, and mitigating workplace violence and suicide. While EO 13587, the NationalPolicy, and Minimum Standards do not specify these two issues, the contents of this CRG -- keywork activities, core and technical competencies, and KSAs -- are broad enough to cover themshould a D/A choose to do so.Key Work Activities:1. Conduct operational activities in response to potential insider threats: Insider threatprofessionals must understand insider threat risks, vulnerabilities, and indicators to: Gather: Identify, receive, and ingest data on potential insider threat incidents fromvarious sources following established policies and procedures. Analyze: Examine, integrate, interpret, and evaluate gathered data on potential insiderthreats using analytic tools, techniques, and methods. Assess: Interpret data and intelligence analyses, test hypotheses, prioritize alternatives,and contextually frame findings and conclusions. Respond: Conduct inquiries or investigations, as situations dictate, following establishedpolicies and procedures. Report: Document, classify, and properly handle insider threat information, and reportand/or refer potential insider threat incidents to relevant stakeholders, departments,and/or agencies following established policies and procedures.2. Counsel stakeholders on insider threat incidents and programmatic issues: Insider threatprofessionals must have the ability to: Advise program stakeholders and senior officials to facilitate review, response, andresolution of insider threat incidents and programmatic issues. Provide technical guidance and/or direct support to program stakeholders requiringassistance in matters related to insider threats.3. Establish, implement, and review policies and procedures: Insider threat professionalsmust have the ability to: Establish, implement, and/or evaluate departmental/agency policies and procedures forcoordinating insider threat program efforts with other mission areas consistent withprotections for privacy and civil liberties of the workforce. Establish, implement, and/or evaluate insider threat program standard operatingprocedures (SOPs) consistent with laws, policies, and regulations related to collection,retention, and dissemination of insider threat information.3UNCLASSIFIED

UNCLASSIFIEDInsider Threat CRG4. Execute insider threat awareness training requirements: Insider threat professionals musthave the ability to: Prepare and conduct briefings, or otherwise offer training to their department/agencyworkforce to promote awareness of potential insider threats and reportingrequirements. Prepare, conduct, and evaluate briefings and required training for insider threatprogram personnel to implement the department/agency insider threat program.5. Evaluate program effectiveness: Insider threat professionals must have the ability to: Facilitate the systematic assessment and evaluation of insider threat risks andvulnerabilities, insider threat trigger development, and efforts to effect early detection. Promote continuous improvement to the department or agency’s insider threatprogram by evaluating the program’s plan, policies, procedures, and metrics. Conduct reviews, surveys, and assessments to determine compliance with establishedpolicies and procedures, as well as the effectiveness of training in raising insider threatawareness.6. Manage resources: Insider threat professionals must have the ability to: Identify, justify, coordinate, and secure financial/budgetary resources required toexecute the insider threat program. Identify, coordinate, and/or manage personnel and physical resources (e.g. facilities,hardware, software) required to successfully pursue insider threat mission and/or rolesand responsibilities.Table 2. Competency Resource Guide Summary for Insider Threat Classification ManagementCounterintelligenceCyber OperationsData/Information ManagementEducation and TrainingEvidence GatheringExploitation AnalysisIncident ResponseTechnical Expertise Competencies Information and RecordsManagement Information Security Inquiry Inspection Intelligence Disciplines (INTs) Legal Theory and Practice Observation Personnel Security Policy DevelopmentOther CapabilitiesTools and Methods4UNCLASSIFIED Program ManagementResearching Security Awareness Security ProgramManagement Synthesis Threat Analysis Vulnerabilities AssessmentManagement

UNCLASSIFIEDInsider Threat CRGTable 3. IC Core Competencies5UNCLASSIFIED

UNCLASSIFIEDInsider Threat CRGTable 4. Core, Supervisory & Managerial, and Senior Officer Competencies Associatedwith Insider Threat KSAsIC Core and Leadership CompetenciesKSAsAccountabilityHolds self and others accountable formeasurable, high-quality, timely, andcost-effective results. Determinesobjectives, sets priorities, and delegateswork. Accepts responsibility for mistakes.Complies with established controlsystems and rules.Applying Policy and DirectivesIdentifies, interprets, complies with andstays current on relevant regulations,guidelines, laws, and directives. Knowledge of policy and procedures for identifying andreporting insider threat incidents. Knowledge of procedures for reporting to mitigation authorityor CI authorities. Skill in evaluating and testing applicable Federal protocols andprocedures covering insider threat methodologies. Skill in making referrals/ recommendations to mitigationauthorities. Knowledge of Executive Order 13587, National Policy, andMinimum Standards. Knowledge of relevant policies and protections for employees’civil liberties, civil rights, and privacy (e.g., whistleblowerprotections). Skill in applying relevant laws, concepts, executive orders,regulations, directives, policies, and procedures to accomplishmission-based goals and objectives of the insider threatprogram. Skill in developing and applying innovative improvements toplans, policies, and procedures.Creativity and InnovationDevelops new insights into situations;questions conventional approaches;encourages new ideas and innovations;designs and implements new or cuttingedge programs/processes.Customer ServiceAnticipates and meets the needs of bothinternal and external customers. Delivershigh-quality products and services; iscommitted to continuous improvement.DecisivenessMakes well-informed, effective, andtimely decisions, even when data arelimited or solutions produce unpleasantconsequences; perceives the impact andimplications of decisions.External AwarenessUnderstands and keeps up-to-date onlocal, national, and international policiesand trends that affect the organizationand shape stakeholders' views; is awareof the organization's impact on theexternal environment.FlexibilityIs open to change and new information;rapidly adapts to new information,changing conditions, or unexpectedobstacles. Skill in producing innovative, all-source products for a broadset of customers, including DoD, IC, Security, LawEnforcement, and other government agencies. Skill in analyzing multiple data points to determine the bestresponse (i.e., exoneration, internal review, or externalreferral). Skill in making effective and timely decisions with limitedinformation. Knowledge of emerging issues relevant to U.S. nationalsecurity. Ability to remain open to change and new information. Skill in recognizing and incorporating new information.6UNCLASSIFIED

UNCLASSIFIEDInsider Threat CRGIC Core and Leadership CompetenciesInfluencing/NegotiatingPersuades others, builds consensusthrough give and take, and gainscooperation from others to obtaininformation and accomplish goals.Information SharingShares information, as appropriate, withcustomers, colleagues, and others.Ensures colleagues receive organizationalinformation and recognizes theresponsibility and takes action to provideinformation within the IC, to otherfederal, state and local law enforcementor authorities, the private sector, and/orforeign partners, as appropriate.IntegrationSearches for opportunities to collaborateand actively promotes collaboration onwork products and across work domainsto enhance the quality of results.Oral CommunicationMakes clear and convincing oralpresentations. Listens effectively; clarifiesinformation as needed.PartneringDevelops networks and builds alliances;collaborates across boundaries to buildstrategic relationships and achievecommon goals.Planning and EvaluatingOrganizes work, sets priorities, anddetermines resource requirements;determines short- or long-term goals andstrategies to achieve them; coordinateswith other organizations or parts of theorganization to accomplish goals;monitors progress and evaluatesoutcomes.Problem SolvingIdentifies and analyzes problems; weighsrelevance and accuracy of information;generates and evaluates alternativesolutions; and makes recommendations.KSAs Skill in persuading others of the importance of the insiderthreat program. Knowledge of guidelines, procedures, and approaches thatsupport information sharing. Skill in providing technical guidance to program stakeholderson insider threat requirements. Skill in collaborating with other insider threat programs toreview relevant information. Skill in coordinating plan development and implementationwith other program offices and organizations (e.g., CI, OPSEC,Law Enforcement). Skill in leveraging opportunities to collaborate with othermission areas or agencies. Skill in presenting and justifying recommendations to variouslevels of officials. Skill in presenting briefings and training. Skill in developing collaborative, interagency relationships. Skill in evaluating and prioritizing insider threat information. Skill in evaluating and prioritizing program resource needs. Skill in monitoring progress and evaluating outcomes. Ability to understand and draw inferences from incompletedata. Skill in forming competing hypotheses, ranking alternatives forcomplex decisions, and creating decision-making criteria.7UNCLASSIFIED

UNCLASSIFIEDInsider Threat CRGIC Core and Leadership CompetenciesSystems ThinkingUnderstands how variables within asystem interact with one another andchange over time. Applies thisunderstanding to solve complexproblems and drive integration.Team BuildingInspires and fosters team commitment,spirit, pride, and trust. Facilitatescooperation and motivates teammembers to accomplish group goals.Technical CredibilityUnderstands and appropriately appliesprinciples, procedures, requirements,regulations, and policies related tospecialized expertise.Written CommunicationWrites in a clear, concise, organized, andconvincing manner for the intendedaudience.KSAs Knowledge of the Intelligence, Security, Law Enforcement, andCI communities, including their capabilities and jurisdictions. Skill in organizing and inspiring an insider threat team toaccomplish program goals. Knowledge of relevant insider threat concerns, issues, andchallenges. Knowledge of issues, behaviors, and motivators indicative ofinsider threat risk. Knowledge of behavioral science’s application to the insiderthreat program. Knowledge of insider threat program best practices. Knowledge of insider threat minimum standards for assessingprogram maturity. Skill in evaluating reporting thresholds for insider threat. Skill in developing complex written guidance and reportssummarizing a variety of information and drawing appropriateconclusions. Skill in editing analytic products or training materials. Skill in communicating ideas clearly and concisely.8UNCLASSIFIED

UNCLASSIFIEDInsider Threat CRGTable 5. Relevant Technical Expertise Competencies Associated with Insider Threat KSAsIC Technical Expertise CompetenciesKSAsClassification ManagementApplies the requirements for classifying,marking, redacting, handling,transporting, and safeguardingprotected (e.g., FOIA/Privacy Act) and/orclassified information.CounterintelligenceGathers information and conductsactivities to identify, deceive, exploit,disrupt, or protect against espionage,other intelligence activities, sabotage, orassassinations conducted for or onbehalf of foreign powers, organizations,or persons, or their agents, orinternational terrorist organizations oractivities.Cyber OperationsPerforms activities to gather evidenceon criminal or foreign intelligenceentities in order to mitigate possible orreal-time threats, protect againstespionage or insider threats, foreignsabotage, international terroristactivities, or to support otherintelligence activities.Data/Information ManagementFormats, catalogs, and/or filters dataand information to facilitate data access,integration, and interpretation. Knowledge of applicable rules and regulations regarding thehandling, distribution, filing, and storage of classified andunclassified materials.Education and TrainingConducts training of personnel withinpertinent subject domain. Develops,plans, coordinates, delivers, and/orevaluates training courses, methods,and techniques as appropriate.Evidence GatheringDevelops sources and recoversevidence. Analyzes data to determinecompliance with laws, regulations, andpolicies. Draws conclusions asappropriate. Knowledge of CI principles, methods, and functional services. Knowledge of reporting requirements for CI issues. Skill in identifying indicators, behaviors, and modus operandiassociated with foreign intelligence entities. Knowledge of user monitoring capabilities for automatedinformation systems. Knowledge of defensive measures in order to protectinformation, information systems, and networks from insiderthreats. Skill in monitoring computer networks for anomalous orunauthorized activities. Knowledge of relevant databases to find, extract, store, andretrieve relevant information. Knowledge of local and national intelligence informationdatabases. Skill in entering, updating, and organizing data in informationsystems/databases so that it can be accessed by self andothers. Knowledge of design principles for insider threat awarenesstraining. Skill in providing insider threat awareness training. Skill in collecting and aggregating information from varioussources to evaluate potential insider threat indicators.9UNCLASSIFIED

UNCLASSIFIEDInsider Threat CRGIC Technical Expertise CompetenciesKSAsExploitation AnalysisAnalyzes collected information to verifyvulnerabilities and potential forexploitation. Knowledge of processes to assess risks to the agency’s criticalassets from malicious insiders. Skill in analyzing collected information to identifyvulnerabilities and potential for exploitation.Incident ResponseResponds to crisis or urgent situationswithin the pertinent domain to mitigateimmediate and potential threats. Usesmitigation, preparedness, and responseand recovery approaches, as needed, tomaximize survival of life, preservation ofproperty, and information security.Investigates and analyzes all relevantresponse activities.Information and Records ManagementGathers, organizes, maintains, andmanages release and disposal of recordsand other information in accordancewith FOIA, Privacy Act, RecordsRetention Policies, and other applicableguidelines. Develops and maintainsdatabases, catalogs, or other lists; usesautomated systems to locate and trackitems.Information SecurityApplies knowledge of policies,procedures, and requirementsestablished under appropriateauthorities to protect information that,if subjected to unauthorized disclosure,could reasonably be expected to causedamage to national security.InquiryApplies techniques for gatheringinformation necessary to make legaldeterminations, develops new sourcesof information where appropriate,analyzes facts, and frames allegations todetermine compliance with laws,regulations, and policies. Determinesscope, methodology, and criteria toaccomplish investigations in accordancewith investigative standards,investigative policy, and standardoperating procedures.InspectionPlans and conducts organizationalevaluations to assess their effectivenessand efficiency in accomplishing themission. Ability to respond to crises or urgent situations in order tomitigate immediate and potential threats. Skill in identifying and reporting insider threat incidents. Skill in executing (or overseeing execution of) establishedprocesses and procedures for containing, mitigating, oraddressing the impact of insider threat incidents. Skill in conducting administrative inquiries of insider threatissues. Skill in coordinating responses to insider threat incidents. Knowledge of various dissemination mechanisms andsystems. Knowledge of the “need-to-know” criteria for insider threat. Knowledge of established administrative inquiry processes,procedures, and authorities. Skill in conducting insider threat interviews. Skill in conducting evaluations to assess effectiveness andefficiency in accomplishing the insider threat programmission.10UNCLASSIFIED

UNCLASSIFIEDInsider Threat CRGIC Technical Expertise CompetenciesIntelligence Disciplines (INTs)Applies knowledge of concepts andterminology, policies and directives,organizational missions, and functions,with respect to intelligence capabilities.Legal Theory and PracticeDemonstrates knowledge of legaltheory, the interrelationships among thecourts, Congress, the Executive Branch,laws, legal codes, practices, precedents,court procedures, executive orders,government organization/functions, andthe democratic process.ObservationDetects sequences in behavior andnotices/attends to others' verbal andnon-verbal cues. Maintains awareness ofphysical surroundings and detectsfactors that may impact physical,personnel, and operational security.Personnel SecurityApplies personnel security principles andmethods to process initial clearances,periodic re-investigations, and clearanceupgrades/downgrades and to completethe adjudication and appeals processes.Evaluates internal and external securityclearance requests and ensuresapplicants' actions are consistent withregulatory requirements. Analyzes andreports on clearance and appealsfindings to senior security officials andmakes appropriate notifications.Policy DevelopmentDevelops policy or advocates forchanges in policy that will support newinitiatives or requiredchanges/enhancements.Program ManagementApplies program managementprinciples, techniques, services, andpractices to effectively achieve domesticand international program goals andobjectives. Identifies performanceoutcomes and establishes metrics toassess the impact (e.g., return oninvestment) of programs and initiatives.KSAs Skill in relating insider threat subject-matter or functionalexpertise to intelligence needs. Knowledge of the legal requirements for insider threatpersonnel and programs. Skill in determining whether behavior patterns warrant eithercloser scrutiny or referral to an investigative or administrativeentity. Knowledge of the adjudicative process. Knowledge of the contents of Personnel SecurityInvestigation reports of investigation and their utility toinsider threat programs. Knowledge of Personnel Security Investigation types andinformation gathered. Knowledge of the personnel security and issues that mayaffect personnel security. Knowledge of policies and regulations on foreign travel,reporting contact with foreign nationals, etc. Skill in developing insider threat policies and procedures, andadvocating for changes to support initiatives orenhancements. Knowledge of requirements for insider threat programs.11UNCLASSIFIED

UNCLASSIFIEDInsider Threat CRGIC Technical Expertise CompetenciesResearchingIdentifies a need for and knows whereor how to gather information. Obtains,evaluates, organizes, and maintainsinformation.Security AwarenessUnderstands policies, regulations, andprocedures for securing government andcontractor facilities to preventunauthorized access to facilities andinformation. This may include assessingand mitigating technical and terroristthreats, and/or vulnerabilities.Security Program ManagementManages information securityimplications within the organization,specific program,

Execute insider threat awareness training requirements: Insider threat professionals must have the ability to: Prepare and conduct briefings, or otherwise offer training to their department/agency workforce to promote awareness of potential insider threats and reporting requirements.