Insider Incident Response Checklist
Someone inside took data, misused access or is about to leave with your crown jewels. Work through 30 steps that keep the case lawful and fair: HR and legal first, evidence before action, proportionate monitoring, access removal timed with the HR meeting, and data recovery through counsel.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
A checklist for an insider case — data taken before someone leaves, access misused, or data sent to personal accounts. HR and legal come first, evidence is preserved before anyone acts, monitoring stays proportionate and lawful, access removal is timed with the HR meeting, and the subject is treated fairly. Employment and privacy law vary by country, so several steps tell you to check with counsel.
Your context
1. HR and legal first
An insider case is an employment matter and a security matter at the same time. Get the people who own the employment side involved before anyone acts.
Engage HR and employment counsel before any interview, confrontation, access change or monitoring decisionmaterial
Form a small need-to-know group with a code name; exclude the subject's manager and close colleagues unless counsel advises otherwise
Ask counsel whether the investigation should run under legal privilege and how findings should be recorded
Write down the trigger, the specific concern and the lawful basis for investigating, before collecting more dataGDPR Art. 6(1)(f)material
Check whether employee representatives, a works council or a collective agreement must be consulted on monitoring
2. Preserve evidence
Preserve logs before they age out: DLP, cloud-app and proxy logs, endpoint telemetry, SaaS audit logs, source-code platform logs, badge recordsmaterial
Collect and forensically image company devices with chain of custody; tell IT not to wipe or reissue themmaterial
Place mailbox, chat and file-storage legal holds so deletion by the subject or by retention policy does not destroy records
Do not access the subject's personal accounts, personal devices or private messages without explicit legal advicematerial
Keep an access log of who viewed investigation material and why
3. Proportionate monitoring
Monitoring can be justified, but it must be targeted, time-limited and consistent with what employees were told.
Confirm that any added monitoring is covered by your acceptable-use and monitoring notices and by local lawmaterial
Limit monitoring to the specific concern, the specific systems and a fixed period, and record the end date
Use covert monitoring only if counsel confirms it is lawful and necessary for this specific casematerial
Record a privacy impact assessment or equivalent for the monitoring
4. Access removal and timing
Decide whether harm is ongoing; if critical data is still leaving, contain now even if it tips the subject offmaterial
Coordinate full access removal with the HR meeting so it happens at the moment the subject is toldmaterial
Remove all access, not just the main account: SSO, VPN, SaaS with local logins, API tokens, SSH keys, code-platform tokens, shared credentials they knewmaterial
Remove company data from personal devices via mobile device management where enrolled
Recover company devices, badges and hardware tokens
5. Departing employee and data recovery
Review the subject's activity for the period that matters (often 30 to 90 days before notice) for bulk downloads, prints, forwarding and repository clones
Identify what was taken and how sensitive it is: trade secrets, source code, customer personal data, pricingmaterial
Through counsel, ask for return or deletion of company data and a signed certification; remind the subject of confidentiality obligations
With counsel, decide whether to contact the new employer if company data may reach them
6. Privacy and fairness for the subject
Treat the subject as innocent until the facts are established; consider innocent explanations (backup habits, a sanctioned project)
Give the subject a fair chance to explain, in a meeting run by HR with the right to be accompanied where applicable
Keep disclosure strictly need-to-know; no comments to colleagues beyond what HR agrees
Expect a data subject access request; ask counsel which exemptions apply and keep records accurate and professional
7. Outcome and lessons
If personal data was taken, run the data-breach notification assessment with the awareness time recordedGDPR Art. 33material
Decide with counsel whether to refer to law enforcement or pursue civil remedies
Fix the gaps: personal-cloud upload controls, alerts on bulk activity after resignation notice, faster offboarding
Decision log
Record each significant decision, who made it and why. Insider cases are often reviewed later by a tribunal or court.
What this template gives you
- Seven phases and 30 steps: HR and legal first, preserve evidence, proportionate monitoring, access removal and timing, departing-employee data, privacy and fairness for the subject, outcome and lessons.
- The summary warns you if the HR and legal foundation is not in place before you interview, monitor or confront anyone.
- Covers the traps that ruin insider cases: a laptop reimaged by routine offboarding, logging into a personal account, covert monitoring without legal advice, and access removed too early or too late.
- A decision log records who decided what and why, because insider cases are often reviewed later by a tribunal or court.
- Free to use and customise in your browser; exporting the record is part of any PlayCISO plan.
Frequently asked questions
Should security confront an employee suspected of taking data?
No. Security collects and preserves facts; HR runs the conversation, with counsel advising. A confrontation by security staff can tip the person off, lead to deletion of evidence and create a separate employment dispute.
When should we remove the person's access?
Usually at the moment they are told, coordinated with the HR meeting, and everywhere at once — SSO, VPN, SaaS with local logins, tokens, keys and shared passwords. If critical data is leaving right now, contain immediately even if it alerts them: ongoing harm outweighs the investigative benefit of waiting.
Can we monitor an employee we suspect?
Often yes on company systems, if it is covered by your notices and local law, targeted to the concern and limited in time. Covert monitoring is restricted in many countries and usually needs specific legal advice. Never access a person's personal accounts or devices without legal advice.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.