Insider Risk Maturity Model: Five Levels

Many organisations buy monitoring or data loss prevention tooling and call it an insider risk programme, then discover during a real case that HR never told security about the resignation, legal never approved the monitoring, and the leaver's keys still work. This model uses NHI Mgmt Group's five levels (Ad hoc, Developing, Defined, Managed and Optimised) to score an insider risk programme across six capability areas: governance and authority, indicators and risk assessment, monitoring and detection, HR and personnel integration, privacy and oversight, and access and credential hygiene for people and the machine credentials they touch. It gives evidence tests for each level, self-assessment questions and a roadmap. It is for insider risk leads, CISOs, HR and legal partners, and auditors. For how to build the programme itself, read the Insider Threat Programme Guide; this page measures where you stand.

Key takeaways

Insider risk is cross-functional by definition: NIST SP 800-53 PM-12 calls for a cross-discipline insider threat incident handling team, and no level above Developing is possible while security works alone.
Privacy caps maturity: monitoring that has no documented legal basis, no impact assessment and no oversight cannot score above Level 2, however good the tooling, because it will not survive a challenge.
Leavers are the sharpest test: a programme is not Defined until departures trigger revocation of accounts and rotation of the keys, tokens and secrets the person could reach.
CISA frames the work as define, detect and identify, assess, and manage: the higher levels add measured outcomes and early, supportive intervention rather than more surveillance.
Use existing yardsticks alongside this model: CISA offers an Insider Risk Mitigation Program Evaluation tool, and the US National Insider Threat Task Force publishes an Insider Threat Program Maturity Framework for federal agencies.

The five levels

Level	Name	What it looks like
1	Ad hoc	No programme, owner or definition. Cases are handled by whoever finds them, often after the data has gone. HR, legal and security do not share information. Leaver access is removed when someone remembers.
2	Developing	A named owner and a working definition of insider threat. DLP or user activity monitoring deployed for some data, alerts reviewed by the SOC. HR notifies IT of leavers, but not reliably of resignations or disciplinary matters. Monitoring rules exist but legal review is partial.
3	Defined	Approved charter with a senior official, a working group (security, HR, legal, privacy, physical security, business), documented case handling and escalation. Critical assets identified. Legal basis and impact assessment for monitoring, staff told what is monitored. Joiner, mover and leaver events feed access changes and enhanced review for higher-risk departures. Contractors and outsourced staff inside scope.
4	Managed	Technical and non-technical indicators correlated in one case view. Risk-based monitoring tiers instead of blanket collection. Metrics reported to the oversight panel: time to triage, cases by outcome, false positive rate, leaver revocation time. Annual self-assessment against a recognised framework. Machine credentials owned by individuals are rotated on departure.
5	Optimised	Early, supportive intervention (wellbeing, management conversations) resolves most concerns before harm. Lessons from cases change access design, onboarding and culture. External assessment, tested playbooks for theft, sabotage and fraud, and coverage extended to AI tools and agents that act with employee authority.

Capability areas

Score each area at the highest level where every statement holds across the whole workforce in scope, including contractors.

Area	Level 1 Ad hoc	Level 3 Defined	Level 5 Optimised
Governance and authority	No owner or charter	Charter approved by senior leadership; designated senior official; working group meets on a schedule; case handling procedure with decision rights	Independent oversight panel reviews statistics, scope changes and complaints; programme objectives tied to enterprise risk appetite
Indicators and risk assessment	Indicators unknown; reaction to incidents only	Documented technical, behavioural and organisational indicators; critical assets and high-risk roles identified; triage criteria written	Indicators weighted from case outcomes; assessment of interest, motive and ability done by a trained multidisciplinary team, as CISA describes
Monitoring and detection	None, or logs reviewed only after an incident	DLP and activity monitoring scoped to critical data and high-risk roles; alerts routed by severity to SOC, data owner or working group	Risk-tiered monitoring that scales up for specific triggers and back down; correlation of HR, identity and technical signals; tuning driven by measured false positives
HR and personnel integration	HR and security do not share information	HR notifies security of resignations, dismissals and relevant disciplinary events; screening proportionate to role; enhanced review around departures	Personnel security aftercare throughout employment; managers trained to spot and support; positive incentives and reporting routes for staff concerns
Privacy, legal and oversight	Monitoring without legal review	Legal basis documented; data protection impact assessment before high-risk monitoring; staff informed; covert monitoring only with senior authorisation	Regular review of necessity and proportionality; access to case data logged and limited; transparency report to staff representatives where appropriate
Access and credential hygiene	Standing broad access; leaver accounts linger	Least privilege for sensitive systems; access reviews; leaver revocation within a defined time; secrets and keys a leaver could reach identified and rotated	Just-in-time access to sensitive data; case-bound access for support roles; signing keys in managed key stores with named owners; departure triggers automated rotation

Evidence for each level

Level	Acceptable evidence	Not sufficient on its own
2 Developing	Named owner; DLP or monitoring policy list; leaver notification records	A tool licence or a vendor dashboard
3 Defined	Signed charter; working group minutes; case handling procedure; monitoring DPIA and staff notice; joiner, mover, leaver integration showing triggers into identity systems	A policy that says "monitoring may occur"
4 Managed	Metrics pack to oversight panel; correlated case records; annual self-assessment results; leaver revocation and rotation times	Alert counts
5 Optimised	Cases resolved by early intervention; changes made to access design after cases; external assessment report; exercise reports	Absence of known incidents

Why privacy sets a ceiling

PM-12's discussion notes that some insider incidents follow non-technical workplace behaviour, which is why HR records matter, and warns in the same passage that using them could raise significant privacy concerns. In the UK, the ICO's guidance on monitoring workers expects an impact assessment before high-risk monitoring, transparency with workers except in exceptional cases, and senior authorisation for covert monitoring. The UK National Protective Security Authority (NPSA) now speaks of insider risk, the likelihood and impact of harm through an insider's action or inaction, which places the focus on reducing risk rather than catching people. A programme that collects everything and justifies it later is fragile: one grievance or tribunal can stop it. This model therefore caps any area at Level 2 while monitoring lacks a documented legal basis and assessment. See the DPIA Guide.

Existing maturity frameworks

CISA's insider threat mitigation material describes four steps (define, detect and identify, assess, manage), points organisations to its Insider Threat Mitigation Guide and offers an Insider Risk Mitigation Program Evaluation tool for measuring programme maturity. The National Insider Threat Task Force, under the joint leadership of the Attorney General and the Director of National Intelligence, released an Insider Threat Program Maturity Framework to help US federal agencies go beyond the national minimum standards. The Carnegie Mellon SEI Common Sense Guide to Mitigating Insider Threats recommends annual self-assessments and external assessments. Use this model for a quick, comparable score across private and public organisations, and use those frameworks for a deeper review.

Self-assessment questions

Charter: is there a signed charter naming a senior official, what data the programme may receive and who may open a case?
Working group: do HR, legal, privacy and security meet on a schedule, and can each name the last case they discussed together?
Critical assets: can you list the data, systems and keys whose misuse by an insider would hurt most, and who has access to each today?
Resignations: does security learn of a resignation on the day it is given, not the day the person leaves? The CERT guide recommends that HR notify IT so it can perform enhanced monitoring, and its intellectual property theft example reviews activity for 30 days before and after resignation.
Leaver credentials: when an engineer leaves, are the signing keys, API keys and tokens they could reach rotated, not only their accounts disabled? In the Coupang breach, a former developer used a token signing key that was never revoked after he left, and harvested data for roughly seven months.
Support roles: can support staff and contractors view any customer record, or only records tied to an open case? In the Coinbase insider breach, bribed support agents used legitimate access to copy data on 69,461 customers.
Monitoring basis: has legal approved each monitoring use, has an impact assessment been completed, and have staff been told?
Triage: are DLP and monitoring alerts routed by severity, and is there a written timeline for each step from alert to closure?
Outcomes: do you record how cases end (no issue, coaching, HR action, legal action), and does that data change your indicators?
Support: do managers know how to raise a concern about a colleague under stress, and is there a route to help that is not disciplinary?

Moving up: roadmap

From Ad hoc to Developing

Name an owner and agree a working definition, using CISA's definition as a starting point.
Identify the top ten critical assets and who can reach them.
Agree with HR that every leaver triggers access removal on the last day.
Deploy DLP for the most sensitive data with alerts reviewed by the SOC. See the Data Loss Prevention (DLP) Guide.

From Developing to Defined

Write and sign the charter; set up the working group and case handling procedure with legal counsel involved from the start.
Complete an impact assessment for each monitoring use and publish a clear notice to staff.
Connect HR events (resignation, dismissal, role change) to identity lifecycle triggers. See the Joiner-Mover-Leaver Guide.
Add rotation of keys, tokens and secrets to the leaver procedure for technical roles. See the NHI Offboarding and Decommissioning Guide.
Bring contractors and outsourced support staff into scope, with the same access reviews and reporting.

From Defined to Managed

Correlate HR, identity and technical signals in one case view; behaviour analytics can help where data volumes justify it. See the UEBA Guide.
Introduce monitoring tiers: baseline for all, enhanced for specific documented triggers, with time limits and review.
Report the metrics below to an oversight panel and run an annual self-assessment.
Restrict support and operations roles to case-bound or just-in-time access for sensitive records.

From Managed to Optimised

Train managers in early, supportive intervention and track concerns resolved without formal action.
Exercise playbooks for data theft and sabotage with HR and legal. See the Insider Data Theft Response Playbook and Insider Sabotage Response Playbook.
Extend scope to AI tools and agents acting with employee authority. See the Insider Risk from AI Tools Guide.
Commission an external assessment and feed findings into access design.

Metrics that show progress

Metric	What it shows	Level where it becomes expected
Median time from HR departure notice to full access and credential revocation	Leaver control	3
Share of monitoring uses with a completed impact assessment	Legal resilience	3
Median time from alert to triage decision	Operational capacity	4
Cases by outcome, including no issue found	Proportionality and false positives	4
Share of sensitive data access that is case-bound or just in time	Exposure reduction	4
Concerns resolved by early intervention	Prevention, not detection	5

Small and large organisations

Aspect	Small or mid-sized organisation	Large or regulated organisation
Working group	Monthly meeting of the security lead, HR manager and an external or in-house lawyer	Dedicated hub with full-time analysts and documented feeds from HR, identity and physical security
Monitoring	Built-in DLP and audit logs of existing platforms, scoped to the few systems holding critical data	Specialist tooling with risk tiers, case management and analyst workflows
Realistic 12-month target	Level 3 in governance, HR integration, privacy and credential hygiene	Level 4 in every area, with external assessment

For a small organisation, the leaver path and case-bound access usually remove more risk than any monitoring tool, and cost far less. Large organisations gain most from correlation, because volume hides the signal.

Common failure patterns

Tool first, programme later: monitoring is deployed before a charter, legal basis or case procedure, so the first serious case cannot be acted on.
Security working alone: without HR, the programme misses the context that explains most anomalies and the warnings that precede most deliberate acts.
Accounts disabled, keys left live: leaver procedures cover directory accounts but not signing keys, tokens and shared secrets.
Contractors outside scope: outsourced support and engineering staff hold the same access as employees with weaker oversight.
Surveillance culture: blanket monitoring with no transparency erodes trust and reduces the staff reporting a mature programme depends on.
Counting alerts: alert volume is reported as success while time to triage and case outcomes go unmeasured.

Framework mapping

Capability area	NIST CSF 2.0	NIST SP 800-53 Rev. 5	MITRE ATT&CK (behaviour to detect)
Governance and authority	GV.RR-04	PM-12 Insider Threat Program
Monitoring and detection	DE.CM-03	AU-6	T1567 Exfiltration Over Web Service, T1052 Exfiltration Over Physical Medium
HR and personnel integration	GV.RR-04	PS-3, PS-4, PS-5
Access and credential hygiene	PR.AA-05	AC-2, AC-6	T1078 Valid Accounts
Awareness and reporting	PR.AT-01	AT-2

Practitioner checklist

Score all six areas and record the evidence for each.
Confirm a signed charter, a designated senior official and a working group that includes HR, legal and privacy.
Check every monitoring use for a legal basis, impact assessment and staff notice; cap scores at Level 2 where missing.
Test the leaver path end to end, including rotation of keys and tokens the leaver could reach.
Bring contractors and outsourced staff into the same controls.
Restrict support roles to case-bound access for sensitive records.
Report time to revocation, time to triage and case outcomes to an oversight panel.
Set a target level per area for the next 12 months and reassess annually.

Insider Risk Maturity Model: Score Governance, Monitoring, HR Integration and Privacy