NIST 800-53 r5 · Controls catalogue · Family PM

PM-12Insider Threat Program

Implement an insider threat program that includes a cross-discipline insider threat incident handling team.

Last updated: 22 August 2026 07:11 UTC

Implementations targeting this control (0)

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE	Name	CVEs	Why this control addresses it
`CWE-862`	Missing Authorization	10,200+	Dedicated team detects missing authorization checks being bypassed by insiders through monitoring and response procedures.
`CWE-284`	Improper Access Control	6,900+	Program provides ongoing monitoring and handling of access-control violations that insiders could otherwise exploit undetected.
`CWE-863`	Incorrect Authorization	3,900+	Insider threat processes catch and remediate incorrect authorization decisions before or after exploitation occurs.
`CWE-269`	Improper Privilege Management	3,400+	Cross-discipline incident team detects and responds to improper privilege assignments or escalations by insiders.
`CWE-732`	Incorrect Permission Assignment for Critical Resource	1,900+	Program reviews and corrects overly permissive resource assignments that insiders could exploit for unauthorized access.
`CWE-285`	Improper Authorization	1,500+	Incident handling team identifies and mitigates authorization failures that allow insiders to perform unauthorized actions.
`CWE-250`	Execution with Unnecessary Privileges	300+	Insider threat program enforces least-privilege reviews and monitors privileged actions, directly reducing abuse of unnecessary rights.

CVE	Risk	CVSS	EPSS	Match
No CVEs annotated to this control yet — the per-CVE backfill is in progress.