Assess Insider Risk
The greater the access, the higher the risk. Determine what information and systems are confidential and critical to your organization (Customer data, employee PII, employee PHI, trade secrets, plans and strategy, etc.) and group employees based on their access to that information.
Less access = lower risk employees
More access = higher risk employees