NIST 800-53 REV 5 • INCIDENT RESPONSE
IR-4(6) — Insider Threats
Implement an incident handling capability for incidents involving insider threats.
CMMC Practice Mapping
No direct CMMC mapping
NIST 800-171 Mapping
No direct NIST 800-171 mapping
Related Controls
No related controls listed
Supplemental Guidance
Explicit focus on handling incidents involving insider threats provides additional emphasis on this type of threat and the need for specific incident handling capabilities to provide appropriate and timely responses.
Practitioner Notes
Insider threats — whether malicious employees or compromised accounts — require different handling than external attacks. You need specialized procedures because the threat actor already has legitimate access.
Example 1: Enable Microsoft Purview Insider Risk Management in M365 to detect risky user behaviors like mass file downloads, unusual email forwarding patterns, or data exfiltration to personal cloud storage. Configure alerts to go to HR and legal in addition to your security team.
Example 2: Create a specific insider threat section in your IR plan that includes coordination with HR and legal counsel before taking action. Document when to involve law enforcement. Keep insider threat investigations in a restricted access ticket queue separate from normal IT incidents.