Insider Investigation Rejected as the Fly Prepared for Take-off

Decisions 4 today

The business responds

• When the fly wanted more information on “Budget cut imposed by Finance: Finance has unilaterally cut the security line item”, Finance dug in its heels. Their opinion of the fly took a real knock.

  “We cut the line item, and your response is to request more information. Please send a costed containment option, funding source, owner, and decision time.”

  Finance Pushed back trust -7

  Next, they want: “By 3 p.m., provide a one-page option sheet with minimum containment cost, deferred-risk cost, funding source, accountable owner, and a firm decision deadline.” They have already asked for a slot in the fly's diary.

• International Communications heard that the fly wanted more information on “Company-wide phishing simulation programme” and refused, loudly enough to be heard two floors down. Their opinion of the fly took a real knock.

  “We have turned a phishing simulation into a consultation exercise with a fruit fly cleaning its eyes. Please approve the pilot and the employee wording.”

  International Communications Pushed back trust -6

  Next, they want: “Approve a low-drama pilot, with an owner, employee messaging, and a date for reviewing the results.” Expect an email.

• IT / Infrastructure heard that the fly threw out “Insider threat: investigation” and refused, loudly enough to be heard two floors down. Their opinion of the fly took a real knock.

  “Rejecting the investigation is wonderfully low-friction, right up until the insider remains employed and the evidence develops a vacation schedule.”

  IT / Infrastructure Pushed back trust -4

  Next, they want: “Authorize the pending 30-minute review with HR, Legal and Operations to document scope, preserve continuity and define temporary access safeguards.” Expect an email.

• Legal / Compliance heard that the fly threw out “Insider threat: investigation” and refused, loudly enough to be heard two floors down. Their opinion of the fly took a real knock.

  “Rejected is not an investigation disposition, particularly when the stated rationale is an escape circuit. Please send the actual decision record before this becomes Exhibit A.”

  Legal / Compliance Pushed back trust -7

  Next, they want: “A counsel-reviewed written assessment naming the regulator, deadlines, risk owner, preservation status, investigation status, and basis for rejecting escalation.” Expect an email.

• HR heard that the fly threw out “Insider threat: investigation” and refused, loudly enough to be heard two floors down. Their opinion of the fly took a real knock.

  “Rejecting suspicion is sensible. Explaining it with an escape reflex is less helpful when managers are about to ask employees very personal questions.”

  HR Pushed back trust -5

  Next, they want: “Send HR today the plain-language insider-suspicion protocol: contact rules, confidentiality, manager guidance, employee support, reporting route, and a named decision owner.” Expect an email.

Diary

• Executive Board: “Submit the costed 24/7 model, interim coverage, named response owner, residual risk, counsel’s view, and board decision time within the hour.” One-to-one · went ahead

  Back on day 33, Executive Board booked a one-to-one with the fly about “Submit the costed 24/7 model, interim coverage, named response owner, residual risk, counsel’s view, and board decision time within the hour”, and it survived the calendar.

  How it went: Held. Two people attended and one of them was the fly.

• OT / Grid Operations: “A written disclosure review plan today, with the specific missing information, named reviewers, a dated decision deadline, and no-production-change confirmation.” One-to-one · dropped

  Back on day 34, OT / Grid Operations asked for a one-to-one with the fly about “A written disclosure review plan today, with the specific missing information, named reviewers, a dated decision deadline, and no-production-change confirmation”. It was postponed once, and today it quietly vanished from the calendar. Nobody has asked where it went.

• OT/SCADA zero-day disclosure: incident war-room War room · dropped

  Back on day 37, OT / Grid Operations, IT / Infrastructure and Legal / Compliance asked for an incident war-room. It was postponed once, and today it quietly vanished from the calendar. Nobody has asked where it went.

• Finance: “A one-page options sheet today: minimum containment cost, deferred-risk cost, funding source, accountable owner, and decision deadline.” Meeting · postponed

  Back on day 37, Finance asked for a meeting with the fly about “A one-page options sheet today: minimum containment cost, deferred-risk cost, funding source, accountable owner, and decision deadline”. It was due today, and got pushed back over a diary clash nobody will explain.

• OT / Grid Operations: “Send the written disclosure review plan today, with missing information, reviewers, decision deadline, and the no-production-change requirement.” One-to-one · postponed

  Back on day 38, OT / Grid Operations asked for a one-to-one with the fly about “Send the written disclosure review plan today, with missing information, reviewers, decision deadline, and the no-production-change requirement”. It was due today, and got pushed back over a diary clash nobody will explain.

• International Communications: “Please provide a provisional holding statement, spokesperson, and notification posture within two hours.” One-to-one · postponed

  Back on day 39, International Communications asked for a one-to-one with the fly about “Please provide a provisional holding statement, spokesperson, and notification posture within two hours”. It was due today, and got pushed back over a diary clash nobody will explain.

• Insider threat: incident war-room War room · postponed

  Only yesterday, HR, Legal / Compliance and IT / Infrastructure asked for an incident war-room. It was due today, and got pushed back over a diary clash nobody will explain.

What each department thinks of the fly