The Insider Threat Program Senior Official (ITPSO) is responsible for establishing and maintaining what?

• A. An Insider Threat Program that gathers, integrates, and reports any information indicating an insider threat
• B. A Disaster Recovery Plan
• C. A Corporate Compliance Program
• D. A Physical Security Program

Answer: (A)

The main idea here is that the Insider Threat Program Senior Official is the leader who establishes and maintains an Insider Threat Program designed to detect internal risks. This role is all about bringing together information that could indicate someone inside the organization might pose a threat—data from HR, IT, security logs, audits, and other sources—and then integrating and reporting that information to the right leaders so actions can be taken. The goal is early detection and informed response to insider risk, while handling data with appropriate privacy and legal considerations.

Disaster recovery, corporate compliance, and physical security cover different areas. A disaster recovery plan focuses on IT and business continuity after disruptions, not on insider risk. A corporate compliance program deals with adhering to laws and regulations and broader policy enforcement. A physical security program concentrates on protecting facilities and physical assets. None of these capture the insider threat program’s unique purpose of identifying and reporting insider risk.