“Assembling a Multi-Disciplinary - Insider Threat Management Team.”
The Cybersecurity and Infrastructure Security Agency (DHS CISA) published
Why this matters
Critical infrastructure organizations can be disrupted by insiders—people with current or prior authorized access. Insider incidents can expose sensitive information, damage reputation, create financial loss, and threaten people or key assets.
The core recommendation
CISA encourages an insider threat mitigation program that combines:
Physical security
Cybersecurity
Personnel awareness
Community partnerships
Why a multi-disciplinary team works better
Compared to a single individual, a team approach can:
Scale as the organization grows
Identify risk factors earlier
Recognize patterns during incidents
Produce more accurate, holistic assessments
Quick setup tips
Pick a supportive-sounding name that helps earn workforce trust (e.g., “Incident Management Team” or “Case Management Team”).
Staff the team with experienced professionals (often including HR, legal, operations, IT/security leadership, and insider threat SMEs) and define how you’ll coordinate with outside partners (like law enforcement) when needed.
Assembling a Multidisciplinary …
A multi-disciplinary threat management team is a critical part of making that program work, running the program, monitoring for risks, and intervening when needed.
Use POEM to guide the program
CISA’s simple framework is POEM:
Plan: define priorities, critical assets, and team structure
Organize: promote reporting culture, protect PII, ensure confidentiality and legal compliance
Execute: train the team, coordinate analysis/response, centralize information, leverage key internal records with legal guidance
Maintain: keep improving with training, policy updates, exercises, and employee feedback
