8 top tips for an insider risk programme
Successfully managing and mitigating insider risk in your organisation requires a clear view of what you want to achieve, an information governance strategy, effective user training and close collaboration across the business.
Read our top tips for establishing a successful insider risk programme in your organisation:
#1 Define your WHY? We recommend you engage a wide range of stakeholders to decide where to focus – review recent HR issues, data breaches and look at how sensitive information is used and stored.
#2 Create your committee: Gather your stakeholders from Information Security, HR, Finance, Risk/Compliance. Collaboration is key to achieve a successful insider risk programme.
#3 Capture your current position: Is your risk management reactive or proactive currently? What exists at the moment (policy/process/training/tech)?
#4 Define your critical assets: Identify and catalogue the crown jewels in your organisation and their related potential for insider risk – this might not be related to malicious activity, it might people or assets that provide the greatest risk exposure for some other reason.
#5 Use pre-built templates for quick-wins: There are recommendations and templates built into the technology. Get started quickly by fully utilising Microsoft’s research – you don’t to re-invent the wheel!
#6 Get a multiplier effect: Leverage the other investments you’ve made in your compliance journey, by tapping into sensitivity labels or data loss prevention policies to enhance the effectiveness of your insider risk management deployment.
#7 Assign responsibility to workflows: You will need to make sure you have the people and processes set up to deal with the output from the system – ensuring there is a clear workflow to react to alerts and perform investigations.
#8 Align with user communication: Ensure deployment is well communicated to users to help employees understand what is being monitored as part of the insider risk management programme. Prevention is always better than cure so it’s also important to link into training teams to raise awareness of good information management behaviours, considering contextual training to reinforce these messages at key moments.
Act against threats from within
Find out more about our Manage and Investigate Risk Workshop and get in touch to discuss whether you are eligible for Microsoft funding to cover its costs.