§2225 Insider Threat Detection

Summary

The Secretary of Defense must create a program to protect Department of Defense computer systems and to spot and stop insiders who try to access, use, or send classified or controlled unclassified information without permission. The program must include technology tools (seven types) such as controls on external ports and read/write access, ways to disable removable media ports, electronic auditing of unusual user activity, data-loss prevention and rights-management tools, a roles-based access certification system, cross-domain guards for moving data between networks, and patch management. It must also have supporting policies and procedures (including for international and interagency work in hostile areas), a governance setup that links to clearance checks and anomaly detection and speeds up classification review, ongoing gap analysis and upgrades beyond the initial full operating capability, a baseline to measure performance, a plan to secure other agencies that access DoD networks, and an enforcement plan to make sure the program is used consistently.