Which statement below is the MOST accurate about insider threat controls?

The most accurate statement is that classification of information assets is a foundational control for mitigating insider threats. Data classification is the process of categorizing data based on its sensitivity, criticality, and value to the organization. This process is essential because it allows an organization to understand which assets are most important to protect. Once critical assets are identified, appropriate security controls—such as principle of least privilege, access controls, and data loss prevention (DLP) policies—can be applied in a targeted and cost-effective manner to protect them from unauthorized insider access, modification, or exfiltration.

B. Security awareness programs are a critical control for reducing insider threats, especially those stemming from negligence or unintentional actions, which constitute a large portion of incidents.
C. Detective controls (e.g., log review, audits) are designed to identify and respond to an attack after it has occurred or is in progress; they do not prevent it.
D. Rotation of duties is a well-established administrative control designed to decrease the likelihood of an insider threat by preventing any single individual from maintaining long-term, unchecked control.
E. Separation of duties is a principle that divides critical tasks among multiple employees to ensure no single person has excessive control, thereby preventing fraud and error.

1. Carnegie Mellon University, Software Engineering Institute. (2018). Common Sense Guide to Mitigating Insider Threats (6th ed.). Practice 1: Know and Protect Your Critical Assets. Page 11. "The first step in protecting critical assets is to determine what they are and where they are located... Once you have identified and prioritized your critical assets, you can focus your resources on protecting them."

2. NIST Special Publication 800-53, Revision 5. (2020). Security and Privacy Controls for Information Systems and Organizations. Control: AC-5 Separation of Duties. Page 103. This control explicitly mandates dividing duties to prevent individuals from having excessive control, directly contradicting option E.

3. NIST Special Publication 800-50. (2003). Building an Information Technology Security Awareness and Training Program. Section 2.1, Page 4. "An effective security awareness and training program requires the support of all employees... It can help the organization to avoid monetary loss... and increase the accountability of all employees." This directly contradicts the claim in option B.

4. Harris, S., & Maymi, F. (2016). CISSP All-in-One Exam Guide (7th ed.). Chapter 5: Identity and Access Management. Page 261. "Job rotation is a detective control in that it may uncover fraudulent activities... It is also a preventative control because it lets employees know their actions will be reviewed." This contradicts option D.