Population

The workforce cohort subject to an organisation’s policies, controls, and access governance. In insider risk work, it includes employees, contractors, affiliates, and other personnel whose actions or inactions can create harm. The term matters because it gives investigators a defined governance boundary for behaviour, access, and accountability.

Expanded Definition

In insider risk and identity governance, population means the defined group of people whose activity falls inside a security programme’s scope. That scope may include employees, contractors, consultants, interns, affiliates, and other personnel with organisational access or obligations. NHI Management Group uses the term as a governance boundary, not as a demographic label. It identifies who is covered by policy, monitoring, investigation, training, and access review processes.

This matters because different teams often use the term differently. In some programmes, population is the full workforce. In others, it is a narrower operational subset such as users with access to sensitive systems, privileged accounts, or regulated data. The definition should therefore be explicit in policy and case handling, especially where insider risk, compliance, and identity lifecycle controls overlap. That approach aligns with the risk-based structure of the NIST Cybersecurity Framework 2.0, which expects organisations to define scope and accountability clearly.

The most common misapplication is treating population as “all workers” when the control objective only applies to a specific access-bearing subgroup, which occurs when scope is copied from a general policy instead of being tied to a live risk model.

Examples and Use Cases

Implementing population rigorously often introduces scope-management overhead, requiring organisations to balance precise governance coverage against the cost of maintaining accurate group definitions across HR, IAM, and security tooling.

• An insider risk team defines its population as all personnel with access to finance, engineering, or customer data systems, so alerts and reviews target the relevant risk-bearing cohort.
• A privileged access review limits population to administrators and service owners, rather than the entire employee base, because the control objective is tied to elevated access.
• A third-party risk process includes contractors and affiliates in the population when they use corporate identities, shared workspaces, or managed endpoints.
• An organisation excludes dormant alumni accounts from the active population once access has been revoked, preventing outdated records from distorting investigations.
• Security operations uses population definitions to decide whose behaviour is measured for anomalies, training completion, or policy exceptions, consistent with identity governance guidance in NIST SP 800-63 Digital Identity Guidelines.

Why It Matters for Security Teams

Population is important because bad scoping leads directly to bad decisions. If the group is too broad, teams drown in false positives, spend time on low-value monitoring, and create unnecessary privacy tension. If it is too narrow, risky behaviour can go unobserved, access reviews miss key identities, and investigations lose their governance basis. For identity and insider risk teams, population is the bridge between organisational structure and enforcement logic: it determines whose credentials, actions, and exceptions are subject to control.

This is also why population must stay synchronised with IAM, HR, contractor management, and case management systems. When roles change, accounts are terminated, or external workers rotate in and out, the security meaning of the term changes with them. NHI Management Group treats this as a control-design issue, not a taxonomy exercise. The concept becomes especially relevant after an incident, when investigators discover that the affected person was never included in the monitored population and the control failure is no longer theoretical.

For organisations handling regulated environments or high-trust access, the right population definition also supports audit defensibility and access assurance. Where workforce identity proofing is involved, the boundaries should be consistent with NIST SP 800-63 Digital Identity Guidelines so that identity status and governance scope do not drift apart.

Related resources from NHI Mgmt Group

• How do IAM and IGA programmes adapt when automation becomes a core identity population?
• Segregation of Duties Review Population
• Identity Population
• Privileged Population