Although most of our resources and attention is focused on defending information and systems from external threats, many of the worst incidents involve those we work with. How do recent incidents inform how we should monitor and control risks from users, service providers and system administrators? This panel will look to legal and regulatory requirements and discuss possible ways to address insider risks.