RACI IRM Program Template

How to use this template: Insider Risk Management programs depend on a combination of technology, processes and people. Use this template to engage with and align the right stakeholders in your IRM program. Every organization is unique, so the roles and responsibilities assigned in this RACI template are intended to be a guide rather than the rule - edit as needed.

CIO - How can I report to the board that we have data risk caused by employees covered?
CISO/VP of Security - How can I ensure I have visibility without being a roadblock to the business?
General Council - How can I ensure we don't violate any regulations?
Head of HR - How can I protect my employee's privacy and culture?
Security Program Manager - How can I operationalize this program and role this out to the company?
Security Engineers and Analysts - How do I architect a system that will support this program?

Leadership Support - Appoint an executive level leader to champion the program, drive priorities, budget, and organizational support.
Insider Risk Management Program Senior Officer - Prioritize the program by creating a senior level role to lead the strategy and manage the team. Give this individual a seat at the table with peers.
Insider Risk Management Program core team - Build a team of subject matter experts with skillsets comprising data protection, endpoint and network security, incident response, forensics, and compliance.

Organizational buy-in - Start a working group and gain support and cooperation from Legal, HR, Security, IT, and the Business. Make them partners and leverage them in all phases of program planning and execution.
Appropriate technology tools - Select and deploy the right tools for your mission. Don’t over-tool the program.
Defined workflows - Write a comprehensive playbook on how daily operations of your IRMP will flow from investigations to escalation and triage to reporting and metrics.