CISA issues guidance on building insider threat management teams

What happened

The US Cybersecurity and Infrastructure Security Agency (CISA) published guidance on 28 January 2026 to help organisations responsible for critical infrastructure build teams to manage insider threats.

According to Inside Privacy, which reported on the guidance, the resource sets out an approach combining physical protection, cybersecurity, staff awareness and partnerships outside the organisation. Its intended audience includes private-sector businesses across critical infrastructure sectors.

CISA recommends involving security, human resources, legal, information technology and operations staff. The agency says the arrangements should reflect each organisation’s structure, workplace culture and willingness to accept risk, rather than treating insider threats solely as a technical security problem.

The CISA resource uses a four-stage framework called POEM: Plan, Organize, Execute and Maintain. It covers the team’s development from defining its responsibilities to keeping its work effective as circumstances change.

Planning involves deciding why the team exists and what falls within its remit. Organisations are encouraged to identify their most important assets, set priorities, establish how much risk they can accept and create routes through which concerns can be reported.

Organising focuses on helping employees understand insider threats and encouraging them to report concerns. The team also supports departments that identify activity which may indicate an insider risk.

Execution covers the programme’s day-to-day operation. CISA’s recommendations include compulsory training, bringing information together for assessment, establishing a central analysis function and making use of resources already available within the organisation.

The fourth stage, maintenance, addresses the continuing development of the team rather than treating its creation as the end of the process.

The background

Insiders are people who know an organisation from within and have, or previously had, authorised access. The source identifies potential consequences ranging from compromised data and interrupted operations to reputational harm, lost revenue or market share, and risks to people’s safety.

That scope helps explain the proposed team membership. Alongside insider threat analysts, CISA identifies human resources, legal advisers, information security leaders, physical security staff and operations personnel as possible internal participants.

External contributors may include police, investigators, professionals who conduct risk screening, and medical or mental health specialists. The guidance therefore extends beyond the departments usually associated with protecting computer systems.

The connection between physical safety and insider threat reporting is also reflected in an earlier Coast Guard account of a crew stopping an armed colleague from boarding a cutter. The service said intelligence from its insider threat programme enabled the intervention in March 2024.

Bringing information from different functions together also creates responsibilities over its handling. CISA notes that teams routinely deal with sensitive material, including private information and data that can identify individuals.

The agency recommends keeping that material confidential, protecting records and restricting access to people who need the information for their work. It also advises consulting lawyers about applicable privacy, employment and records-retention laws at federal, state and local level, alongside other relevant legal requirements.

Shared oversight is a theme in other recent guidance. Adaptive Security’s recommendations on insider threat programmes similarly combine technical monitoring, employee training and responsibility across departments, covering deliberate misuse, mistakes and compromised accounts.

What people are saying

CISA says a team whose trusted members bring different areas of expertise is better placed to assess information drawn from across an organisation, according to Inside Privacy’s account. The agency identifies such a team as an important means of reducing both the occurrence of insider threats and the damage they cause.

Inside Privacy says the resource is useful beyond its principal critical infrastructure audience. It points to Covington’s 2025 webinar series, which covered insider threat fundamentals, risk and recovery, monitoring and investigations, and preparation and prevention, including the contributions different teams can make.

The publisher also places CISA’s approach alongside developments in state law. It reports that, since 2020, several US states have introduced or changed laws requiring schools or other educational bodies to establish threat-response programmes, including teams drawn from multiple disciplines.

In its assessment, Inside Privacy says insider threats should form part of both cybersecurity planning and wider organisational risk management. It argues that a structured approach involving different functions can help bring legal obligations and operational work into alignment.

What happens next

For organisations putting the guidance into practice, CISA recommends establishing clear leadership and holding regular team meetings. Members should receive training in assessing threats, conducting investigations, managing records and protecting personal information.

The maintenance stage calls for continuing training and updates to policies and procedures as threats develop. It also asks organisations to build measures for reducing insider risk into new business activities, rather than leaving them confined to existing operations.

Employee feedback and outside resources are further elements of that continuing work. CISA presents insider threat management as a process that needs regular adjustment, with the team developing alongside the organisation it serves.