An insider, who has access to organization’s information, can misuse it in a manner that can affect confidentiality of information or can result in loss of business. Such insider often displays certain Non-standard Behaviour (NSB). There are several existing data points related to insider that can be utilized to detect NSB. However, these data points which often reside in silos with different departments needs to be pulled together under a single framework with the help of available tool and techniques to effectively track NSB indicators. Non-standard Behaviour(NSB) framework development process involves finding answer to several question such as, who are insiders, why and how do they steal information, how to detect such cases and how to identify insider.