Reducing data exfiltration by malicious insiders - Appendix A

Baseline assessment of exfiltration techniques

This table can be completed by organisations to prepare a baseline assessment of their critical assets, adding additional lines if necessary (and ignoring those that are not relevant). This process should be seen as part of the organisation’s overall security risk management process. Once completed, organisations should review relevant policies in case of necessary updates.

Columns 2 and 3 should normally be completed by technical leads to inform a subsequent conversation with business leads and risk owners (who would normally complete columns 4 and 5).