SOP-14: Insider Threat Detection & Response

Analyst playbook for insider risk — Purview IRM and DLP signals, USB / personal cloud / email exfiltration, evidence preservation, litigation hold, and Legal/HR-coordinated containment.