The Insider Risk Management Team Charter

Insider risk, or the potential harm an insider (employee, contractor, vendor, or partner) can cause, is substantial and exists in every organization. Reducing this risk requires a dedicated focus to look for, investigate, and respond to insider incidents. This report provides specific guidance, a sample list of roles and responsibilities, and a sample charter for establishing an insider risk management (IRM) team — either as a standalone function or as part of another team like the security operations center (SOC). Security and risk leaders can use this report to define the IRM team’s role, describe its makeup, and identify critical success factors and metrics.