high-risk individual
A classification applied to a person — typically a user, employee, contractor, or other organizational insider — for whom credible evidence indicates a significant likelihood of causing harm to organizational systems, data, assets, or operations, either through malicious intent or as a vector adversaries can exploit. The category is operationalized in access-control and incident-response policy: once someone is designated high-risk, controls such as time-bounded account disablement, heightened monitoring, and expedited notification of relevant personnel are triggered. Across the field the designation is context-driven and organization-defined, covering a spectrum from the disgruntled insider with demonstrated intent to the compromised account holder through whom external threat actors act.
Framework senses
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A classification applied to a person — typically a user, employee, contractor, or other organizational insider — for whom credible evidence indicates a significant likelihood of causing harm to organizational systems, data, assets, or operations, either through malicious intent or as a vector adversaries can exploit. The category is operationalized in access-control and incident-response policy: once someone is designated high-risk, controls such as time-bounded account disablement, heightened monitoring, and expedited notification of relevant personnel are triggered. Across the field the designation is context-driven and organization-defined, covering a spectrum from the disgruntled insider with demonstrated intent to the compromised account holder through whom external threat actors act.DR-088 backfill from the noun definition column