An official website of the United States government
Here's how you know
A .mil website belongs to an official U.S. Department of Defense organization in the United States.
A lock (lock ) or https:// means you’ve safely connected to the .mil website. Share sensitive information only on official, secure websites.

News | Sept. 18, 2019

Understanding the insider threat program’s mission

By Brian Sullivan DCMA Security

September is designated as Insider Threat Awareness Month, and the agency is currently observing week three of this initiative.

In support of this national initiative, the Defense Contract Management Agency insider threat program continues its efforts to raise awareness across the workforce in order to enhance the ability to prevent, deter, detect and mitigate actions by malicious insiders who represent a threat to national security or Department of Defense personnel, facilities, operations and resources.

While DCMA has always maintained a robust security program, a formal insider threat program was launched in July 2016 in order to implement the requirements of DoD Directive 5205.16, "The DoD Insider Threat Program,” and other national-level directives.

Since its inception, the program has undergone a comprehensive assessment by the National Insider Threat Task Force and continues to build its capabilities by teaming with a variety of DoD and federal government partners and through the training and integration of a multifunctional team of subject matter experts, collectively referred to as the insider threat hub, who facilitate program implementation. To date, 14 DCMA employees from such functions as human capital, security, counterintelligence, antiterrorism, inspector general, general counsel and information technology have received specialized training from the National Insider Threat Task Force.

All federal agencies employ education and awareness campaigns in an effort to deter insiders from becoming threats. Protecting DCMA from potential or actual malicious insiders is a monumental task considering the agency has more than 12,000 personnel with a global presence. As such, the program must rely on the vigilance of each employee to identify and report suspicious or anomalous behaviors or activities indicative of a potential threat. A job aid that lists potential insider threat risk indicators can be accessed at

Since the program’s inception, the insider threat program has received 292 reports of suspicious or anomalous behaviors and activities. These reports were received through a multitude of channels, both internal and external to the agency. Some reports resulted in the identification of threats that required mitigation strategies; however, after evaluation, many reports were found not to represent a credible threat and thus were referred to functional or management authorities or closed. In some cases, some reports identified employees requiring specialized support or assistance that once received, brought the employee back to a full-productive status.

Protecting DCMA’s vital resources, which incudes employees, is priority number one for the insider threat program. However, the program’s success requires employee support in identifying and reporting suspicious or anomalous behaviors or activities, which are potentially indicative of an insider threat. Working together, everyone can continue to ensure a safe and secure work environment in accomplishing the critical mission of supporting the warfighter. Remember, if you see something, say something.

Editor’s Note: For more information, contact Brian Sullivan, insider threat program manager, at 804-734-0805 or Additional information can be found at (login required) or