---
title: "Contents"
url: https://insiderthreatresearch.com/contents
description: "The complete chapter index of the manual: foundations, controls and response."
---

# Contents

[Manual home](https://insiderthreatresearch.com/) / Contents

Front matter · chapter index

The complete chapter list, with a one-line abstract for each chapter.

## Foundations

1. 01[What insider risk means](https://insiderthreatresearch.com/what-insider-risk-means)Separates insider risk from insider threat, and sets the boundaries this manual works within.
2. 02[The four types of insider threat](https://insiderthreatresearch.com/types-of-insider-threats)The classification the guide works from: sabotage, fraud, intellectual property theft and accidental threat.
3. 03[Warning signs and what they are worth](https://insiderthreatresearch.com/warning-signs)Behavioural and technical observations, and the reasons they cannot be used as a test.

## Controls

1. 04[Building an insider risk programme](https://insiderthreatresearch.com/building-a-programme)Scope, governance, the functions involved, and what to write down before starting.
2. 05[Access and data controls](https://insiderthreatresearch.com/access-and-data-controls)Least privilege, the joiners-movers-leavers cycle, and segregation of duties.
3. 06[Monitoring, and the limits it works within](https://insiderthreatresearch.com/proportionate-monitoring)What monitoring can establish, what it cannot, and why transparency about it is a control.

## Response

1. 07[Responding to a suspected insider incident](https://insiderthreatresearch.com/responding-to-an-incident)Triage, evidence handling and the order in which containment steps are taken.
2. 08[Recurring patterns](https://insiderthreatresearch.com/recurring-patterns)Generalised shapes that recur across cases, with the trigger and the control for each.
3. 09[Glossary](https://insiderthreatresearch.com/glossary)Definitions of the terms used across the manual.

## Front matter

1. ·[Scope of the manual](https://insiderthreatresearch.com/scope) What the manual covers, how the chapters are ordered, and where it stops.