Insider threat indicators include attempts to obtain information without authorization and unsafe handling of sensitive material. They are reasons to report a concern, not proof of malicious intent. For a cleared employee, the useful response is to describe the behavior accurately, protect the information involved, and use the reporting route established by your organization.

What do insider threat indicators actually tell you?

An indicator identifies something that deserves attention. It does not establish who caused an incident, whether the conduct was deliberate, or what action should follow. Your reporting responsibility and the organization’s assessment responsibility are different parts of the response.

DCSA’s Insider Threat Awareness course teaches common indicators and encourages reporting concerning workplace behavior to support positive workforce outcomes. That purpose matters when you are new to a cleared workplace: reporting should help the appropriate office understand a risk, rather than turn uncertainty into an accusation.

A colleague may have access you do not know about, an approved assignment outside your team, or a legitimate reason for unusual hours. You can report an apparent access problem while acknowledging those limits. Write that you could not confirm authorization, if that is true; saying someone had no authorization is a different claim.

For career preparation, learn the reporting process during onboarding alongside the broader responsibilities of a cleared professional. Being dependable includes knowing where to take an unresolved concern.

Which access and handling behaviors deserve priority?

Give concrete information-security concerns priority over personality judgments. Attempts to bypass access controls, exposure of sensitive information, or a direct threat provide a clearer basis for reporting than a coworker’s mood. Use your training and local procedures to determine the route and urgency.

The DCSA/CDSE 2024 awareness briefing includes unauthorized personal storage, uploads of sensitive files to an outside site, and allowing people without access into workspaces among its examples. It also cautions that exhibiting potential risk indicators does not necessarily make someone a threat. The table below offers practical ways to describe a concern; these are illustrative situations, not findings about any employee.

If the situation involves an apparent unauthorized transfer, tell the receiving office whether it may still be happening. Avoid opening additional files merely to make the report more convincing. The purpose of the first report is to get an actionable concern to someone authorized to assess it.

How should you describe combinations or changes over time?

Describe related events you actually observed, with their sequence and relevant work context. A pattern can be useful context, but you should not wait for repetition when the conduct already needs reporting. Nor should you assemble a coworker’s personal history to manufacture a pattern.

Suppose someone asks you to share an account and later asks how to avoid a logging requirement. Describe both requests and explain that they came from the same person. That account is more useful than describing the colleague as secretive. If you learned something secondhand, identify it as secondhand instead of blending it into your own observation.

Ordinary stress, disagreement, or a change in working arrangements does not establish malicious intent. Resist the temptation to fill gaps with assumptions about someone’s finances, health, family, nationality, or beliefs. If you have a specific concerning behavior to report, give the behavior and let authorized reviewers decide what additional context is relevant.

The awareness briefing expressly distinguishes lawful expression and legitimate whistleblowing from insider-threat actions. A complaint about management therefore needs to be described accurately, without recasting disagreement as a security offense. If a complaint includes a threat or disclosure concern, report that specific conduct through the appropriate route.

What should your report contain?

Give the receiving office enough information to locate the event: what happened, when and where it happened, the people or accounts involved, the information or system affected, and any immediate safety concern. Separate observation, uncertainty, and information supplied by someone else.

A useful opening might be: “During an assigned document review, I saw a file marked for restricted handling attached to a message addressed outside the approved group. I have not opened the attachment or confirmed whether the recipient was authorized.” This is a fictional reporting example. It identifies a concern while preserving the uncertainty that security staff must resolve.

Include the time as accurately as you can. If you only remember an approximate period, label it approximate. Record the location of an existing message or record using the approved reporting method; do not copy sensitive contents into a personal notebook or an unapproved ticketing system.

Explain any action already taken, such as contacting the help desk or moving away from an unsafe situation. Include a safe way for the receiving office to reach you. Before submitting, replace labels such as “disloyal” or “unstable” with the actual words or actions that led to your concern.

Which reporting channel should you use?

Follow your organization’s emergency procedures for immediate danger, its cyber incident process for an active system concern, and its designated security or insider-threat route for reportable behavior. When channels overlap, explain whom you have already contacted so responders can coordinate.

For cleared industry, 32 CFR 117.8(a) covers contractors and their cleared employees. It requires reporting specified events affecting eligibility, safeguarding, insider threats, and actual or suspected compromise. It also requires internal procedures making employees aware of their responsibilities to report pertinent information to the facility security officer, or FSO.

The same section assigns formal reporting obligations to the contractor. Those obligations should not be mistaken for instructions that every employee personally send every concern to every outside authority. Ask your FSO or designated office how your employer’s process applies to your situation; government employees should use their agency’s procedures.

If your normal contact is involved in the concern or unavailable, use the alternate channel identified in your training. Learn that route before an incident. Avoid circulating the report among colleagues to see whether others share your suspicions.

Foreign-contact questions can involve separate reporting duties. The distinction between a routine relationship and a reportable event deserves the same care described in foreign-contact reporting guidance; do not use nationality as a substitute for describing conduct.

How can you preserve evidence without investigating?

Tell authorized responders where existing evidence is located, preserve it according to approved procedures, and ask for instructions if necessary. A stronger report does not require you to search someone else’s account, test their access, or gather material outside your duties.

Keep your handling within your authorization. Forwarding a message to personal email, photographing a restricted screen, or transferring files to an unapproved device can create a separate handling problem. If a reporting form cannot accept the classification or sensitivity of the information, contact security for an approved method.

The distinction has a regulatory basis: 32 CFR 117.8(d)(1) assigns the preliminary inquiry into a reported classified-information security violation to the contractor. That is an organizational responsibility, rather than a general invitation for observing coworkers to investigate. Follow authorized incident-response instructions if investigating is actually part of your assigned job.

Also avoid confronting the person to obtain an admission. Report what you already know, including facts that might explain the behavior innocently. If you later discover that an access request was approved, send that correction through the same channel.

Who decides what the behavior means?

Authorized security, insider-threat, incident-response, and other responsible offices assess the facts within their roles. Your report can identify uncertainty without resolving motive, credibility, or clearance consequences. Those decisions require information and authority an observing employee may not have.

Under 32 CFR 117.8(c)(1), contractors must not base adverse-information reports on rumor or innuendo. That restriction concerns the contractor’s report; it is also a useful reason to keep your own account factual. If you are unsure whether observed conduct meets a threshold, seek guidance rather than declaring either guilt or harmlessness.

Support, clarification, corrective training, and risk mitigation may be relevant responses, alongside any investigation or other action the facts warrant. Reporting does not let you predict the outcome. Questions about your own reporting responsibilities belong with security too, including the kinds of personal events discussed in self-reporting guidance for cleared employees.

Frequently Asked Questions

Do I need proof that someone is an insider threat?

You need an accurate basis for the concern you report, not a personal finding of malicious intent. Describe observed conduct, identify what you cannot verify, and ask the designated office for guidance when the threshold is unclear. Avoid presenting speculation as evidence.

Should I wait until I see a pattern?

Repetition can add context, but it is not a reason to postpone reporting an immediate threat, apparent compromise, or other event your procedures require you to report. Give the receiving office the facts available now and identify any related observations without conducting a search for more.

Does reporting mean the employee will lose a clearance?

A report does not establish that outcome. Reviewers must assess the underlying information through the applicable process. Keep the report focused on the concern, and avoid making predictions about a coworker’s employment or national security eligibility.

What should I do before starting a cleared assignment?

Find the current security reporting instructions during onboarding. Record the approved FSO or security contact, insider-threat contact, emergency route, and alternate route in a location your organization permits, so you can reach the right office without improvising during an incident.