Which of the following are insider threat targets?

• A. Policies, regulations, budgets, calendars.
• B. Individuals, groups, facilities, resources, infrastructure, weapon systems, information systems.
• C. Markets, commodities, supply chains, and logistics.
• D. Training programs, manuals, and handbooks.

Answer: (B)

Insider threats revolve around the people and assets they can reach with legitimate access. Because insiders already hold trusted access, the most likely targets are those they can influence, tamper with, or exfiltrate without triggering immediate suspicion. This includes individuals and groups who can act on or facilitate wrongdoing, and the physical and digital assets they can reach: facilities and resources that support operations, critical infrastructure that keeps systems running, weapon systems that must be protected from tampering, and information systems that hold sensitive data. Targeting these areas inside an organization can cause widespread harm to security, operations, and safety.

The other options describe targets that are more external or governance-focused and do not capture the inside-access focus of insider threats. Policies, regulations, budgets, and calendars are organizational artifacts. Markets, commodities, supply chains, and logistics are external targets, and training programs, manuals, and handbooks are informational materials rather than the internal assets insiders typically threaten.