ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™Insider Threat Matrix™
  • ID: AF028.001
  • Created: 06th October 2025
  • Updated: 08th October 2025
  • Contributor: The ITM Team

Authorized Leave

The subject deliberately leverages formally approved leave, such as annual vacation, sick leave, or medically certified absence, to delay or frustrate investigative procedures. This tactic may be employed after becoming aware of organizational suspicion, active inquiry, or impending enforcement action. By taking sanctioned time off, the subject restricts opportunities for time-sensitive interviews, effectively obstructing the pace of investigation without violating leave policy.

Prevention

ID Name Description
PV071Conditional Contact During Leave

Establish policy and procedural authority to contact subjects under formal investigation during periods of authorized or unauthorized leave. This mechanism ensures that investigative continuity, containment actions, and required interviews can proceed despite absence from duty.

 

Prevention Measures

  • Amend internal HR and Acceptable Use Policies (AUPs) to include a clause permitting investigative contact with aliased subjects during leave, where the subject is materially involved in an active investigation.
  • Require that all leave requests undergo a check against the Alias Register prior to approval, with flagged cases routed to Legal and the Insider Threat Investigation Team for review.
  • Define conditions for permissible contact, such as limiting outreach to official communication channels and ensuring legal oversight for medical or protected leave scenarios.
  • Include escalation pathways for unreachable or non-compliant subjects, particularly in AWOL scenarios or when delays introduce operational risk.
  • Formalize the policy via the Acceptable Use Policy Advisory Panel (AUPAP) to ensure defensibility and alignment with employment law and organizational governance.