CISA’s 2026 Insider Threat Guide: What Central Valley IT Leaders Should Fix First

What changed in CISA’s 2026 Insider Threat Mitigation Guide?

CISA released an updated Insider Threat Mitigation Guide on September 9, 2026, adding current guidance for hybrid and remote work, AI-enabled deception, physical access control, visitor screening, and adverse employee separations. For Central Valley organizations, the takeaway is simple: insider risk is no longer just an HR concern or a cybersecurity concern. It is an operational resilience issue.

CISA’s update is timely because many organizations now run on distributed work, cloud applications, shared vendor access, outsourced IT workflows, and AI tools that move faster than traditional policy review. The old model — disable a badge, collect a laptop, and assume the risk is closed — is not enough. An insider threat program has to connect people, identity, devices, facilities, data, and escalation procedures before a harmful event occurs.

That matters for Modesto, Fresno, Stockton, Merced, and other Central Valley organizations with lean teams. A clinic, city department, school district, accounting firm, or agricultural business may not have a dedicated insider threat team. But it still has sensitive systems, privileged accounts, physical offices, vendors, former employees, and data that can be copied, exposed, deleted, or misused.

CISA’s guidance is useful because it does not treat insider threat as a single kind of malicious employee. It frames insider risk as a spectrum that can include intentional harm, negligent behavior, compromised accounts, policy violations, workplace violence indicators, unauthorized data movement, and mistakes made by trusted users. That broader framing is exactly what regulated and mid-market organizations need.

Why should Central Valley organizations care about insider threat now?

Central Valley organizations should care because insider threat is tied to everyday business workflows: onboarding, offboarding, remote access, Microsoft 365 permissions, vendor access, badge access, shared mailboxes, file shares, EHR systems, student data systems, finance platforms, and privileged admin roles. The risk is not exotic. It is usually sitting inside ordinary access that nobody has reviewed recently.

CISA’s insider threat resources define an insider as someone who has or had authorized access or knowledge of an organization’s resources, including personnel, facilities, information, equipment, networks, or systems.¹ That definition matters because it includes current employees, former employees, contractors, vendors, volunteers, temporary staff, interns, and third parties with access to systems or locations.

For a Central Valley healthcare clinic, that could mean an employee with access to patient scheduling, billing, EHR records, shared drives, or a remote desktop session. For a school district, it could mean a staff member or vendor with access to student information systems, device management tools, or Google Workspace / Microsoft 365 files. For a city or county department, it could mean access to public safety records, permitting systems, finance systems, or network infrastructure. For a private business, it could mean customer lists, payroll files, executive inboxes, bank portals, or line-of-business applications.

The point is not paranoia. The point is control clarity. If nobody owns the full lifecycle of access, the organization is relying on luck.

Datapath sees this problem most often as an accountability gap between HR, IT, security, operations, and department leaders. HR knows someone is leaving. IT may know which accounts exist. A department head knows which shared folders or applications the person used. Facilities knows badge status. Finance knows whether the person had payment authority. But if those facts never converge into a repeatable workflow, the organization cannot prove that access was removed, monitored, or escalated correctly.

What is the first control to review after CISA’s update?

The first control to review is offboarding, especially for adverse or urgent separations. Offboarding should disable identity access, recover devices, revoke tokens, remove shared mailbox and file permissions, terminate VPN and remote access, close vendor portals, preserve logs where needed, and document who verified each step.

CISA’s September 2026 announcement specifically highlights new content around adverse employee separations, access control, visitor screening, hybrid work, and AI-enabled deception.² Those are not abstract categories. They map directly to the moments when real organizations lose control of data: a rushed termination, an unmanaged admin account, a former contractor with a still-active login, a personal device with synchronized files, or a disgruntled employee with physical access.

A strong offboarding workflow should answer these questions:

• Who notifies IT before access needs to change?
• Which systems are included in the standard termination checklist?
• Which roles trigger a high-risk offboarding procedure?
• Who disables Microsoft 365, Google Workspace, VPN, EHR, ERP, finance, CRM, RMM, backup, firewall, and identity-provider access?
• Who removes the user from shared mailboxes, Teams, SharePoint, network shares, and distribution lists?
• Who checks for privileged roles, delegated mailbox access, OAuth grants, service accounts, and break-glass exceptions?
• Who recovers laptops, phones, keys, badges, tokens, and removable storage?
• Who reviews recent file downloads, forwarding rules, mailbox rules, data exports, failed logins, and unusual access?
• Who signs off that the offboarding is complete?

For many organizations, the answer is “we think IT handles it.” That is not a control. A control has an owner, a trigger, a procedure, evidence, and review.

Datapath has related guidance on employee offboarding security and Microsoft Entra emergency access accounts. Those are good starting points because identity is where insider risk becomes measurable.

How should organizations handle hybrid work and AI-related insider risk?

Organizations should handle hybrid work and AI-related insider risk by tightening data boundaries, logging access, defining approved tools, monitoring unusual activity, and making policy violations reportable without turning every employee into a suspect. The goal is controlled access, not blanket surveillance.

Hybrid work changed insider risk because employees and contractors now access sensitive systems from home networks, unmanaged spaces, personal phones, shared family devices, coworking spaces, and travel environments. AI changed the risk again because users can copy sensitive data into tools that feel like productivity helpers but may not be approved for regulated information.

CISA’s update calls out hybrid and remote work and AI used to manipulate or deceive as evolving workplace considerations.² For a regulated organization, that means the insider threat program should explicitly cover:

• Which AI tools are approved for company, patient, student, client, or financial data.
• Which data classes are prohibited from public AI tools.
• How employees request exceptions for new tools.
• Whether browser extensions and OAuth applications are reviewed.
• Whether data loss prevention policies exist for regulated files.
• Whether suspicious forwarding, downloads, sharing, or exports generate alerts.
• Whether privileged access is limited by role and reviewed periodically.
• Whether remote access requires phishing-resistant MFA for high-risk roles.

NIST SP 800-53 Rev. 5 is also relevant because its control families include Access Control, Audit and Accountability, Identification and Authentication, Incident Response, Personnel Security, Risk Assessment, and System and Services Acquisition.³ Those families provide a useful structure for translating CISA’s insider threat concepts into auditable IT controls.

For mid-market organizations, the practical version is this: make sure users only have the access they need, make sure activity is logged, make sure someone reviews high-risk access, and make sure there is a documented path for unusual behavior or suspicious activity to reach the right people.

What should healthcare clinics review first?

Healthcare clinics should review EHR access, shared accounts, remote access, terminated-user access, billing-system permissions, Microsoft 365 audit logs, and vendor access. The highest-risk users are not always executives. They are often users with broad access to patient records, billing systems, file shares, imaging systems, or administrative portals.

A specialty clinic or medical group in Modesto or Fresno should start with a simple access map:

• EHR and practice management roles.
• Billing and claims access.
• Shared mailboxes used for referrals or scheduling.
• Remote access to clinical systems.
• Vendor access for EHR support, imaging, phones, backup, and managed services.
• Local administrator rights on clinical workstations.
• File shares containing scanned records, IDs, authorizations, or insurance documents.
• MFA status for all remote and administrative access.

The goal is not to build a massive governance bureaucracy. The goal is to know who can access protected information, why they need it, how access is approved, how it is reviewed, and how it is removed. Datapath’s healthcare cybersecurity services and HIPAA technical safeguards checklist are natural follow-on resources.

What should K-12 districts review first?

K-12 districts should review student information system access, identity lifecycle processes, Google Workspace or Microsoft 365 sharing, device management permissions, vendor accounts, and privileged admin roles. Districts should also run tabletop exercises that include insider threat and account misuse scenarios.

CISA’s cybersecurity scenario resources include tabletop exercise packages covering insider threats, ransomware, phishing, K-12, local government, and vendor supply chain compromise.⁴ That is useful for districts because insider threat is rarely a purely technical event. It often involves student data, staff conduct, HR timing, parent communications, legal obligations, and vendor coordination.

A district should ask:

• Are student information system roles reviewed each semester?
• Are former employees and contractors removed from identity systems quickly?
• Are shared Google Drives, Teams, and SharePoint sites reviewed?
• Are admin roles limited to named users?
• Are help desk technicians using individual accounts instead of shared admin credentials?
• Are vendor accounts time-bound and monitored?
• Are suspicious downloads or mass sharing events detectable?
• Do HR, IT, cabinet leadership, and site administrators know the escalation path?

The tabletop matters because most gaps do not appear in the written policy. They appear when someone asks, “Who actually calls the vendor?” or “Who has authority to suspend access before the investigation is complete?”

Datapath’s K-12 managed IT services and K-12 identity management checklist are relevant internal next steps.

What should city and county IT teams review first?

City and county IT teams should review privileged access, physical access to network spaces, remote access, CJIS-related systems, finance platforms, public works systems, vendor accounts, and incident escalation paths. Local government insider risk is partly cyber risk and partly operational continuity risk.

A city department may rely on a small number of people who understand legacy applications, building access, network closets, utility systems, police or dispatch integrations, finance workflows, and public records systems. That concentration of knowledge is useful operationally but risky if access is not documented, monitored, and transferable.

City and county teams should review:

• Domain administrator and local administrator membership.
• VPN and remote desktop access.
• Vendor accounts for public safety, finance, permitting, utilities, and backup.
• Physical access to server rooms and network closets.
• Shared service accounts and scheduled tasks.
• Terminated employee and retired contractor access.
• Backup console access.
• Logging for privileged changes.
• Escalation procedures for suspicious insider behavior.

Datapath’s CJIS compliance checklist and municipal IT modernization guidance can help local government teams connect access governance to operational resilience.

What should a 30-day insider threat review include?

A 30-day insider threat review should include identity cleanup, privileged access review, offboarding testing, vendor access review, physical access reconciliation, logging verification, AI tool policy review, and a short tabletop exercise. The deliverable should be evidence, not just a policy update.

Here is a practical 30-day plan:

1. Inventory high-risk access. List domain admins, Microsoft 365 global admins, EHR admins, SIS admins, finance admins, backup admins, firewall admins, VPN users, and vendor accounts.
2. Review terminated users. Compare HR termination records against identity, email, VPN, badge, device management, and line-of-business applications.
3. Check privileged roles. Remove standing admin access where it is no longer justified. Document exceptions.
4. Review shared access. Identify shared mailboxes, shared drives, shared admin accounts, and unmanaged service accounts.
5. Validate logs. Confirm that sign-ins, administrative actions, file sharing, mailbox rules, VPN activity, and endpoint events are retained and reviewable.
6. Audit remote access. Verify MFA, conditional access policies, geo-risk handling, and inactive accounts.
7. Review vendor access. Confirm owner, business purpose, MFA status, expiration date, and support procedure for each vendor account.
8. Reconcile physical access. Compare badge systems, keys, alarm codes, network room access, and visitor procedures against current staff and contractors.
9. Clarify AI rules. Publish which AI tools are approved, which data is prohibited, and how exceptions are requested.
10. Run a tabletop. Simulate a high-risk termination, suspicious file download, unauthorized AI upload, or vendor account misuse.

This is not a one-time cleanup. It should become a quarterly access governance rhythm tied to leadership review.

What evidence should leadership expect?

Leadership should expect evidence that access is approved, reviewed, monitored, and removed. Good evidence includes access review exports, ticket records, offboarding checklists, sign-in logs, privileged role reports, vendor account registers, policy acknowledgments, tabletop notes, and remediation tickets.

The most useful executive summary is not a 40-page technical report. It is a short decision brief:

• What critical systems were reviewed?
• Which high-risk accounts were found?
• Which accounts were removed or reduced?
• Which logging gaps remain?
• Which vendors still need access review?
• Which departments missed offboarding steps?
• Which policy decisions require leadership approval?
• Which risks need budget, tooling, or process changes?

This is where Datapath’s Accountability-as-a-Service™ model is useful. The problem is rarely that no one cares. The problem is that no one has a complete picture. A good managed IT partner turns scattered access facts into a reviewable operating model.

If your organization needs help turning CISA’s 2026 insider threat guidance into a practical access governance plan, start with Datapath’s cybersecurity risk assessment services or managed IT services in Modesto.

FAQ

Is insider threat only about malicious employees?

No. Insider threat can include malicious acts, negligent mistakes, compromised accounts, accidental data exposure, unauthorized data movement, policy violations, or misuse by someone who has or had trusted access. A strong program should address intentional and unintentional risk.

Does a small organization need an insider threat program?

Yes, but it does not need a federal-agency-sized program. A small or mid-market organization can start with offboarding, privileged access review, vendor access review, MFA, logging, clear reporting paths, and quarterly leadership review.

What is the most common insider threat gap?

The most common gap is incomplete access lifecycle management. HR, IT, facilities, department heads, and vendors each hold part of the access picture, but nobody owns the full workflow from onboarding through role changes and offboarding.

How often should privileged access be reviewed?

Privileged access should be reviewed at least quarterly, and immediately after terminations, role changes, incidents, mergers, system migrations, or vendor changes. High-risk roles should have tighter review cycles and stronger authentication requirements.

Should insider threat monitoring include physical access?

Yes. CISA’s approach connects cyber and physical risk. Badge access, visitor procedures, server room access, keys, alarm codes, and device custody can all matter when sensitive systems or critical operations are involved.

What should Central Valley organizations do first?

Start with a 30-day access review focused on terminated users, privileged accounts, vendor access, remote access, logging, and offboarding evidence. Then run a tabletop exercise that includes HR, IT, operations, legal, and leadership.

Footnotes

1. CISA, “Insider Threat Mitigation,” describing insider threat definitions, program steps, and resources. Source ↩

2. CISA, “CISA Releases Updated Insider Threat Guide With New Insights to Mitigate Physical and Cyber Threats,” released September 9, 2026. Source ↩ ↩²

3. NIST, “SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations,” official CSRC publication page. Source ↩

4. CISA, “Cybersecurity Scenarios,” listing tabletop exercise packages for insider threats, K-12, local government, ransomware, phishing, and vendor supply chain compromise. Source ↩