Insider Threat Programs Under NSPM-33

TL;DR: NSPM-33’s research security program requirement does not create a standalone “Insider Threat Program” element by that name. Insider-threat awareness and reporting channels are folded into Element 3 (research security training) of the four mandated elements. A separate, more prescriptive statutory Insider Threat Program — with a designated Insider Threat Program Senior Official (ITPSO), monitoring, and formal reporting obligations — is required only for facilities cleared under 32 CFR Part 117 (NISPOM), tracing back to Executive Order 13587 and the 2012 National Insider Threat Policy and Minimum Standards. This guide walks through what each framework actually requires an institution to build: the behavioral-indicator content a compliant training program needs to cover, and the reporting-channel mechanics — intake, confidentiality, escalation, non-retaliation, recordkeeping — that make a reporting channel functional rather than nominal.

Two different obligations, often confused

Research security offices frequently talk about “our insider threat program” as if it were a single, uniformly defined requirement. In practice, an institution’s federal research-security obligations touch insider threat at two distinct levels, with different triggers, different owners, and different legal bases:

The NSPM-33 research security program (RSP) training element. Institutions that receive more than $50 million per year in federal science and engineering support must operate a research security program covering four mandated elements under OSTP’s July 2024 “Research Security Programs Standard Requirement” guidance. As covered in our companion guide, NSPM-33 Research Security Program Requirements: The Four Mandated Elements, Element 3 (research security training) requires institution-wide training that addresses research security risks, insider-threat awareness, and reporting channels. This is a training-content and reporting-mechanism obligation — it does not, by itself, require a dedicated insider threat office, a named senior official, or continuous personnel monitoring.
The NISPOM Insider Threat Program. A university facility holding a Facility Clearance (FCL) under 32 CFR Part 117 (NISPOM) must go considerably further: it must designate an Insider Threat Program Senior Official (ITPSO), establish a formal program to detect, deter, and mitigate insider threats among cleared personnel, and meet reporting obligations aligned with Security Executive Agent Directive (SEAD) 3. This requirement traces back to Executive Order 13587 (October 2011), which established the National Insider Threat Task Force (NITTF) under joint leadership of the Attorney General and the Director of National Intelligence, and the resulting National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs, issued via presidential memorandum in November 2012. NISPOM incorporated a formal insider threat program requirement for cleared contractor facilities following a 2016 change and carried it through into the 32 CFR Part 117 codification.

The practical consequence: an institution that receives significant federal research funding but holds no facility clearance needs to satisfy the first obligation only — insider-threat content inside its research security training, plus a working reporting channel. An institution with a cleared facility (common at institutions doing classified DoD, DOE, or intelligence-community work) needs both: the RSP training element for its broader research-security population, and a full NISPOM Insider Threat Program, under an ITPSO, for personnel within the cleared facility. Conflating the two — assuming that NSPM-33 training compliance also satisfies a facility’s NISPOM insider threat obligation, or vice versa — is a common and consequential compliance gap, since the ITPSO role and the RSP’s Element 3 training owner are frequently not the same office.

What “operational” means for the insider-threat component

As with the other three NSPM-33 elements, OSTP’s guidance and an institution’s own certifying officials look for evidence that the insider-threat awareness and reporting-channel component is actually functioning, not just documented. Concretely, that means:

Training content that names real behavioral-indicator categories rather than a generic “report suspicious activity” slide, so the population being trained can actually recognize what to look for.
A reporting channel that is publicized, accessible, and distinct from (or clearly integrated with) other institutional hotlines, so a concerned colleague, supervisor, or PI knows where a report actually goes.
A documented intake-and-escalation process — who receives a report, how it is triaged, and which office (research security, counterintelligence liaison, general counsel, human resources) takes it from there.
Evidence of use: records of reports received, how they were triaged, and outcomes — even if the volume is low, since the evidence-of-use standard applies here as it does across the other three elements.

A program that has a well-written insider-threat training module and no functioning reporting channel behind it — or a reporting channel with no defined intake owner — is not operational in the sense OSTP’s guidance means, even though a slide deck exists.

Behavioral indicator categories a training program should cover

Federal insider-threat guidance, developed originally for cleared national-security populations through the NITTF and adapted across the research-security context, generally groups behavioral indicators into a small number of recurring categories rather than a single checklist. A research security training program’s insider-threat content is stronger when it names these categories concretely instead of relying on abstraction:

Undisclosed foreign talent-recruitment or compensation arrangements. Participation in a foreign talent program, undisclosed outside employment or compensation from a foreign entity, or resistance to disclosing foreign affiliations when asked — the behavioral counterpart to the disclosure obligations covered in the Malign Foreign Talent Recruitment Program (MFTRP) guidance and in Thousand Talents Program and Research Security.
Anomalous data handling. Accessing data or systems outside the scope of an individual’s project, unusual volumes of downloading or copying, attempts to move data outside institutionally approved systems, or requests for access beyond what a role requires.
Policy and access-control violations. Circumventing IT security controls, sharing credentials, or attempting to bypass export-control or technology-control-plan restrictions on controlled research.
Unexplained financial change or susceptibility to financial pressure. Indicators long recognized in federal personnel-security guidance as correlating with recruitment risk — not, on their own, evidence of wrongdoing, but a factor reporting channels are trained to route for review rather than dismiss.
Marked behavioral or attitudinal change. A sudden shift in disclosed international travel patterns, unexplained secrecy about research activity, or a pattern of disgruntlement following an adverse personnel action — consistent with the “concerning behaviors following a stressor” pattern that federal insider-threat frameworks (including the critical-pathway model NITTF guidance draws on) treat as a category worth training staff to recognize, not act on unilaterally.

Two cautions belong in any training built from this list. First, indicators are contextual and cumulative — a single data point (an employee under financial stress, or a researcher who traveled internationally) is not evidence of an insider threat, and training that frames it that way risks generating noise, false accusations, and chilling effects on legitimate international collaboration rather than useful reports. Second, an institution’s own diversity of legitimate research collaboration — international co-authors, visiting scholars, dual-affiliation researchers — means indicator training has to be calibrated carefully to avoid functioning as a proxy for scrutiny of a person’s national origin, which is both a civil-rights exposure and, separately, bad security practice, since it trains staff to watch the wrong signal.

Reporting channel mechanics

OSTP’s Element 3 language requires “reporting channels” as part of the training element, but does not prescribe their exact form — that operational design is left to the institution. A reporting channel that functions, rather than existing only on paper, generally needs:

More than one intake path. A direct line to the research security office or RSO, plus at least one channel that does not require going through a direct supervisor (since a supervisor may be the subject of a report, or a reporter may reasonably fear retaliation from that reporting line specifically). Many institutions route this through an existing compliance or ethics hotline rather than building a parallel system, provided insider-threat reports are recognizably triaged to the research security function once received.
Defined confidentiality, and where legally available, anonymity. Reporters need to know, before they report, what protection the channel actually offers — confidential handling within a defined circle of recipients is a different (and more commonly achievable) commitment than true anonymity, and a program should not promise the latter if the intake mechanism cannot actually deliver it.
A non-retaliation commitment, stated where the reporting channel is described, not only buried in a separate whistleblower policy — the two documents should be consistent, and staff should not have to find a second policy to learn they’re protected.
A defined intake-to-escalation path. Who receives the initial report, on what timeline it is triaged, and which downstream offices — research security, general counsel, human resources, export control, and for cleared facilities, the ITPSO and counterintelligence liaison — get involved and at what threshold. Ambiguity here is where reports stall.
Recordkeeping proportionate to volume. Even institutions with very few reports in a given year should be able to show what came in, how it was triaged, and the outcome — this is the “evidence of use” a certifying official or reviewer will look for, parallel to the standard already established for the other three NSPM-33 elements.

For institutions with a cleared facility, the NISPOM Insider Threat Program reporting obligations are more prescriptive: SEAD 3 defines specific categories of reportable information (certain foreign contacts, foreign travel, and adverse information) that cleared personnel must report on a defined basis, and the ITPSO is responsible for that program’s operation, coordination with the Defense Counterintelligence and Security Agency (DCSA), and, where indicated, referral to counterintelligence authorities. That reporting structure runs alongside — and is legally distinct from — the broader RSP reporting channel described above, which is why institutions with both obligations generally need the two offices coordinating on a shared intake process rather than operating two disconnected channels that a would-be reporter has to choose between.

Building the two obligations into one coherent program

Institutions rarely benefit from running the NSPM-33 training-and-reporting component and a NISPOM Insider Threat Program as fully separate silos, even though they answer to different regulatory bases. A workable structure typically:

Assigns clear ownership: the RSO (or research security office) owns Element 3 training content and the general-population reporting channel; the ITPSO, where one exists, owns the cleared-facility program and SEAD 3 reporting specifically.
Builds one shared intake mechanism where possible, with routing logic that sends cleared-facility-specific reports to the ITPSO and general research-security reports to the RSO, rather than asking a reporter to self-sort which office to contact.
Coordinates training content so cleared personnel receive both the institution-wide research-security training and any NISPOM-specific insider-threat briefing required for their clearance, without duplicating content unnecessarily.
Documents the two obligations separately in policy, even where operationally integrated, since a reviewer assessing NSPM-33 certification and a DCSA inspector assessing NISPOM compliance are checking against different standards and will expect to see each addressed on its own terms.

Frequently asked questions

Does NSPM-33 require every covered institution to have a formal Insider Threat Program?

No. NSPM-33’s research security program requirement, as implemented through OSTP’s four-element guidance, requires insider-threat awareness content and a reporting channel as part of the training element (Element 3). It does not require a standalone Insider Threat Program, a designated ITPSO, or personnel monitoring unless the institution separately holds a facility clearance under 32 CFR Part 117 (NISPOM), which carries its own, more prescriptive insider threat program requirement.

What is an Insider Threat Program Senior Official (ITPSO), and does a university need one?

The ITPSO is the senior management official NISPOM requires a cleared facility to designate to establish and lead that facility’s insider threat program. A university needs one only if one of its facilities holds a Facility Clearance (FCL) under NISPOM — typically because it performs classified contract work for the Department of Defense, Department of Energy, NASA, or the intelligence community. An institution with federal research funding but no classified-contract facility clearance does not need an ITPSO for NSPM-33 purposes.

Who should own insider-threat reporting intake if there is no ITPSO?

Most commonly the Research Security Officer or research security office, often routed through or coordinated with an existing institutional compliance/ethics hotline so reporters have a single, familiar entry point. What matters operationally is that the intake owner is clearly identified, the escalation path from that owner to relevant downstream offices (general counsel, human resources, export control) is defined in advance, and reports are actually triaged and tracked.

Can indicator-based training create legal or civil-rights risk if handled poorly?

Yes, and this is a genuine design consideration, not a minor caveat. Indicator lists built around foreign contacts or foreign travel, if trained or applied without care, risk functioning as a proxy for scrutiny based on national origin or ethnicity — both a civil-rights exposure and a security failure, since it directs attention to the wrong signal instead of the pattern of behavior (cumulative, contextual, verified) that actual federal insider-threat guidance is built around. Training should emphasize behavior patterns and documented risk factors, not demographic or affiliation proxies, and reporting channels should route reports to trained reviewers rather than allowing an unreviewed report to trigger action.

How does this relate to export control and CMMC obligations?

They are related but distinct compliance areas that often share the same underlying data or personnel. Export control (ITAR/EAR) governs controlled technology transfer, including to foreign nationals working in a lab; the Cybersecurity Maturity Model Certification (CMMC) governs safeguarding of controlled unclassified information under DoD contracts. Insider-threat reporting can surface issues relevant to either area — an anomalous data-access pattern might implicate both an insider-threat concern and an export-control deemed-export issue — which is one more reason an institution’s reporting intake process should route reports to whichever combination of offices the facts actually implicate, rather than treating insider threat as a fully separate silo. See CMMC Compliance for Universities and Export Control Reform and Research Security for how those obligations work in more depth.

Insider Threat Program Mechanics Under NSPM-33: Behavioral Indicators and Reporting Channels