How should a TA assess and manage insider risk?

• A. Increase access for insiders to maximize productivity.
• B. Only monitor external threats, not insiders.
• C. Ignore insider risk as it is unlikely.
• D. Implement access controls, monitoring, and separation of duties; foster culture of security and whistleblower channels.

Answer: (D)