On January 28, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published a new resource on Assembling a Multi-Disciplinary Insider Threat Management Team.  The guidance is intended to assist critical infrastructure stakeholders, which includes private sector entities across various sectors, with implementing an insider threat mitigation program that combines physical security, cybersecurity, personnel awareness, and community partnerships.  Although framed for critical infrastructure, CISA’s guidance is relevant to a broader range of organizations, including those outside of critical infrastructure sectors—a point echoed in Covington’s 2025 insider threat webinar series, discussed further below.

Insiders—individuals with institutional knowledge and current or prior authorized access—can cause significant harm to organizations, including through data compromise, operational disruption, reputational damage, loss of revenue and market share, and risks to personnel safety.  According to CISA, assembling a Multi-Disciplinary Insider Threat Management Team is a critical part of an insider threat program that can reduce the damage and frequency of insider threats.  

CISA emphasizes that effective insider threat management depends on integrating multiple disciplines –security, human resources, legal, information technology, and operations – in a manner consistent with the organization’s risk tolerance, structure, and culture.

CISA’s emphasis on multi-disciplinary insider threat management teams is also consistent with a broader legal trend reflected in recent state statutes, as discussed in our prior article, When Physical and Cyber Threats Converge: Six Tips for Companies.  For example, since 2020, several states have enacted or amended statutes requiring schools or other educational entities to establish programs for responding to threats, including by establishing multi-disciplinary threat assessment teams.

The POEM Framework

At the center of the guidance is CISA’s four-phase POEM (Plan, Organize, Execute, and Maintain) framework, which is intended to structure the lifecycle of an insider threat management team.

1. In the planning phase, organizations are encouraged to structure and scope the role of the threat management team.  The planning phase includes defining the team’s purpose, identifying critical assets and priorities, determining risk tolerance, and establishing reporting pipelines.
2. In the organizing phase, the team guides employee awareness, encourages a culture of reporting, and provides needed support to relevant departments as they identify potential insider threat activity.  CISA advises that “a trusted staff, with varied expertise in a wide range of disciplines, will be better able to synthesize and analyze data from sources across the organization” in order to better provide needed support. 
3. The execution phase addresses operation of the program, including implementing mandatory training, integrating information, establishing an analysis hub, and leveraging organizational assets.  CISA encourages teams to seek guidance from legal counsel to ensure compliance with state, local, federal, and other laws.
4. The maintenance phase requires maintaining and developing the threat management team.  To adapt to emerging insider threats, CISA emphasizes providing ongoing training, incorporating mitigation strategies into new lines of business, revising policies and procedures, soliciting employee feedback, and utilizing external resources.  CISA characterizes insider threat management as an ongoing and dynamic process rather than a one-time effort.

Team Composition and Operational Considerations

CISA recommends that insider threat management teams draw from a broad range of internal stakeholders and external assistance.  Internal team members may include insider threat analysts, human resources, legal counsel, information security (such as the CIO or CISO), physical security, and operations.  External team members may include law enforcement, investigators, external risk screening professionals, and medical or mental health professionals.

CISA advises that teams establish clear leadership, meet routinely, and complete training on topics such as threat assessment, investigations, records management, and data privacy. 

Information Handling and Legal Context

The guidance underscores that insider threat management teams routinely handle sensitive, private, and personally identifiable information.  As a result, CISA notes the need for strict confidentiality, secure handling of records, and sharing information only on a need-to-know basis.  The resource notes the importance of consulting legal counsel to ensure compliance with applicable federal, state, and local laws governing privacy, employment, and records retention.

Takeaways

As organizations face increasingly complex risk environments, CISA’s guidance underscores that insider threats are a significant risk that should be integrated into companies’ cybersecurity and broader risk management frameworks, and that a multi-disciplinary threat management team is an integral component to insider threat mitigation.  Covington also provided guidance on the importance of a well-designed insider threat program in its 2025 insider threat webinar series, which covered foundational concepts related to insider threats, risk and recovery considerations, monitoring and investigation practices, and preparation and prevention measures, including how various teams and personnel within an organization can contribute to those efforts.  By taking a structured, multi-disciplinary approach, organizations can better align their internal capabilities, ensure legal and operational consistency, and strengthen overall resilience against insider threats.

*            *            *

Covington regularly advises companies on their insider threat programs and helps companies respond to insider threat incidents.  Please reach out to a member of the Data Privacy and Cybersecurity practice group if you need any assistance.