When an insider threat is suspected, which action helps balance safety with due process?

• A. Immediate firing of the employee without investigation.
• B. Coordinate with security and legal authorities while preserving evidence and due process.
• C. Publicly accuse the person.
• D. Isolate them with no investigation.

Answer: (B)

Balancing safety with due process is essential when an insider threat is suspected. The best action is to involve the right parties—coordinate with security teams and legal authorities—while preserving evidence and upholding due process. Security can handle immediate containment to protect people and assets and begin a preliminary assessment, while legal ensures the investigation, data handling, and any disciplinary or prosecutorial steps comply with laws, policies, and privacy protections.

Preserving evidence and maintaining a clear chain of custody are crucial so the investigation remains credible and defensible. This approach prevents actions like abrupt termination or public accusations from creating legal liability, reputational damage, or unsafe outcomes. Isolating someone without investigation can disrupt operations and destroy evidence, undermining understanding of what happened and how to prevent recurrence.

By coordinating with security and legal, an organization can respond quickly to risk while safeguarding rights and ensuring a lawful, thorough resolution.