What is an appropriate response to a suspected insider threat?

• A. Ignore until confirmed.
• B. Initiate threat assessment, restrict access, notify supervisors, preserve evidence, and coordinate with security and legal authorities while protecting due process.
• C. Dismiss the employee and forget.
• D. Publicly announce rumors.

Answer: (B)

When dealing with a suspected insider threat, the priority is to contain risk while starting a formal, coordinated response that protects both security and due process. Quickly assess the potential risk and, if warranted, restrict access to sensitive systems to prevent further harm. Notify the appropriate supervisors and the security team so the incident can be managed through a structured process. Preserve evidence and maintain a clear chain of custody to support the investigation and any ensuing disciplinary or legal actions. Coordinate with security and legal authorities to ensure actions follow policies and laws, while safeguarding the employee’s due process rights. This approach enables rapid containment, accurate risk assessment, and lawful handling, rather than delaying action or spreading rumors.