RS.CO-03.335
Does your organization have a documented process for notifying HR when malicious insider activity is detected?
Explanation
Coordination with HR on insider threats is the concern here: whether a documented process exists for notifying HR when malicious insider activity is detected. These activities might include data theft, unauthorized system access, sabotage, or other actions that violate security policies and potentially require disciplinary action.
Evidence could include a documented incident response procedure that specifically addresses insider threats and includes HR notification steps, communication templates for HR notifications, or records of previous incidents where HR was properly notified (with sensitive details redacted).
Implementation Example
Notify HR when malicious insider activity occurs
ID: RS.CO-03.335
Context
- Function
- RS: RESPOND
- Category
- RS.CO: Incident Response Reporting and Communication
- Sub-Category
- Information is shared with designated internal and external stakeholders
Related questions
- Do personnel understand their specific roles, responsibilities, and the order of operations during a security incident response?
- Does your organization have documented breach notification procedures that include a process for notifying affected customers in the event of a data breach?
- Does your organization have documented procedures for notifying business partners and customers of security incidents in accordance with contractual obligations?
- Does your organization have documented procedures for notifying law enforcement and regulatory bodies of security incidents that include specific notification criteria and required management approvals?
- Does your organization have documented processes for securely sharing information during incident response that align with established information sharing agreements?
- Does your organization voluntarily share information about observed threat actor tactics, techniques, and procedures (TTPs) with an Information Sharing and Analysis Center (ISAC) or similar industry group after removing sensitive data?
