A cleared IT specialist with Top Secret clearance since 2020 copied information from at least 133 intelligence reports without need-to-know authorization. He burned files to discs labeled for unclassified material, then walked out of a SCIF with them in his jacket pocket. He later transmitted material to Ethiopian officials through an encrypted messaging app. He pleaded guilty to espionage.
Every control that could have caught that behavior is known. The decision is which combination you fund and in what order. This guide walks you through it.
The Decision You Are Facing
You need to decide where to focus insider threat investment: technical monitoring, access governance, or personnel-centered detection. Most programs can't fund all three fully in one cycle. The wrong sequence leaves a gap that a trusted, privileged user will find.
The incident above exposed all three failure points. The individual had "downdraft" authority to move files between classification levels, a privileged function. He accessed non-home-agency classified portals without documented need. He removed media through a physical boundary. Each maps to a distinct control family.
Key Factors That Affect Your Choice
Answer these before picking a path.
Do you handle classified information or only Controlled Unclassified Information? If you hold a facility clearance, the National Industrial Security Program requires a formal insider threat program with a designated senior official, user activity monitoring on classified systems, and employee reporting channels. If you only handle CUI under DFARS 252.204-7012, your driver is NIST SP 800-171 and the practices assessed under 32 CFR Part 170.
Where do your privileged users sit? Staff with transfer, sanitization, or administrative authority carry the highest risk. Identify them first.
What's your physical boundary posture? Controlled spaces only help if media and notes are governed at the exit.
What telemetry do you already collect? Audit Logging that nobody reviews is a liability, not a control.
Path A: Technical Monitoring and Data Loss Prevention
Choose this path if your environment is mostly digital, your Audit Logging is collected but under-analyzed, or your privileged users operate across multiple systems.
If you can't currently detect bulk access to documents outside a user's assigned work, then start here. Drivers include:
- NIST SP 800-53 Rev 5 AU controls for Audit Logging and review, plus AC-6 (Least Privilege), which includes logging of privileged function use.
- NIST SP 800-171 3.3.1 and 3.3.2, which require creating and retaining audit records and ensuring actions are traceable to individual users.
- 3.1.7, which prevents non-privileged users from executing privileged functions and captures privileged function execution in logs.
- Removable media controls under 3.8.7 and 3.8.8, which restrict removable media use and prohibit it when no identifiable owner exists.
Deploy Data Loss Prevention to flag classification marking removal and writes to optical or removable media. Add user activity monitoring that baselines access patterns per role. In the case described, accessing 133 reports outside need-to-know is exactly the kind of deviation a role baseline surfaces.
Limit to know: Technology detects behavior, not intent. Someone who copies by hand into a notepad defeats every endpoint tool. Path A alone is insufficient.
Path B: Access Governance and Need-to-Know Enforcement
Choose this path if your users can reach more than their mission requires, or if clearance level is functioning as a proxy for access.
If a Top Secret clearance in your environment effectively grants broad portal access, then you have a need-to-know enforcement problem, not a monitoring problem. Clearance establishes eligibility. It doesn't establish authorization to a given compartment or report.
Priorities:
- Implement Role-Based Access Control tied to documented duties, and require written approval for access outside a user's home system. The failure was enforcement.
- Apply separation of duties (NIST SP 800-171 3.1.4) so that the person who can move data between classification domains can't also approve or sanitize his own transfers.
- Enforce two-person integrity on cross-domain transfers where mission allows.
- Run periodic access recertification, not just at onboarding.
Limit to know: Tight access governance creates friction and can slow mission delivery. You'll need leadership backing to hold the line.
Path C: Personnel-Centered Detection, Training, and Reporting
Choose this path if your technical stack is reasonably mature but your program doesn't connect HR, security, and counterintelligence signals.
If nobody in your organization is positioned to notice unexplained financial behavior, unusual after-hours presence, or note-taking on classified material, then invest here. In the case described, some of the most telling indicators were observed by coworkers and bank staff, not tooling.
Priorities:
- Stand up employee reporting channels and train staff on what to report. NISP insider threat requirements include awareness training and reporting obligations.
- Build a cross-functional hub where security, HR, and legal share indicators under defined rules.
- Reinforce training on a recurring basis, tied to real scenarios rather than annual slide decks. NIST SP 800-171 3.2.3 requires insider threat awareness training.
- Make clear that continuous evaluation applies to everyone, including senior and trusted staff. That's how you balance trust and verification: the verification applies by role and access, not by suspicion of individuals.
Limit to know: Poorly handled reporting programs damage morale and generate false positives. Define thresholds and protect the privacy of employees who are cleared by review.
Summary Matrix
| Factor | Path A: Technical | Path B: Access Governance | Path C: Personnel-Centered |
|---|---|---|---|
| Best when | Logs exist but aren't analyzed | Clearance equals broad access | Tools are mature, signals siloed |
| Key requirements | NIST SP 800-171 3.3.1, 3.3.2, 3.8.7; 800-53 AU, AC-6 | 3.1.4, 3.1.5; Role-Based Access Control | 3.2.3; NISP reporting duties |
| Catches | Bulk access, media writes, marking removal | Out-of-scope access | Behavioral and financial indicators |
| Misses | Handwritten notes, intent | Authorized users misusing legitimate access | Fast, quiet exfiltration |
| Main cost | Tooling and analyst time | Process friction | Cultural and legal effort |
Choosing Your Sequence
If you can fund only one first move, match it to your weakest link. Logs nobody reads point to Path A. Over-broad access points to Path B. Siloed human signals point to Path C. Then sequence the others within the next assessment cycle.
No single path would have stopped a determined, privileged insider alone. The layered design, where each path covers what another misses, is what makes detection likely before 133 reports become a plea agreement.
