Coercion and Insider Threat: What ISO 27001 Expects of You

Access reviews ask a sensible question: does each person have the access their role needs, and no more? What they never ask is whether any of those people could be made to misuse it.

Tilt-shift miniature of an office at night, one figure at a lit desk and another in the doorway holding an envelope — A coerced insider passes every access review. The access is legitimate; it is the person who has been compromised.

That is a different risk, and it does not show up in a permissions report. A finance officer with gambling debts, a systems administrator with a secret someone has found, an executive assistant whose family overseas is being leaned on. Each of them has legitimate access. Each of them can be turned into someone else’s instrument without ever deciding to betray anyone.

Short answer

Coercion risk is the chance that someone with access can be pressured into misusing it. ISO 27001 already gives you most of the controls: proportionate screening, clear terms, awareness training, separation of duties and a reporting path. The control most organisations miss is the one that makes the rest work: making it safe for a person to say “someone has something on me” before it is used.

Kompromat: a Russian word for a well-practised trade

The Russians have a word for this. Kompromat is short for komprometiruyushchiy material: compromising material. The Soviet KGB made gathering it routine tradecraft, collecting embarrassing, illegal or simply private material on people of interest and holding it until it was useful. Russian intelligence and political operators have kept the practice going since.

Two documented cases show the two ways it is used.

The first is recruitment. In 1954 John Vassall, a junior clerk on the staff of the British naval attaché in Moscow, was invited to a party the KGB had arranged. He was encouraged to drink heavily and photographed in compromising situations. The photographs were used to blackmail him into passing secrets, first in Moscow and then back at the Admiralty in London, for eight years until his arrest in 1962. He was sentenced to 18 years.

The second is silencing. In 1999 Russia’s Prosecutor-General, Yury Skuratov, was pursuing high-level corruption investigations when state television broadcast a video of a man resembling him with two women. He was suspended and later removed from office.

The lesson from Vassall matters most for business. He was not senior. He was a clerk. But he had access, and access made him worth the effort.

Now scale that up. If a junior clerk’s access was worth a staged party and eight years of patience, imagine the value of leverage over someone senior: a minister, a general, a chief executive, or even a president; anyone whose decisions move markets or countries. That is why intelligence services invest so heavily in cultivating senior targets, and why your own executives and board members could be on someone’s list too.

Russia gave the practice its name and turned it into a craft, but it is not the only practitioner. Other state services use the same approach, and criminal groups now run it at scale, through sextortion, data harvested from breaches and fake profiles on professional networking sites. The common thread is that every version of it targets your people, not your firewall.

What leverage looks like now

The traditional sources of leverage have not changed much:

Money: debt, gambling, a failing business on the side.
Secrets: an affair, an undisclosed relationship, a past conviction, a health or addiction issue someone is hiding.
Family: pressure on relatives overseas, particularly in countries where the state can reach them.
Compromising material: images, messages or recordings, obtained by entrapment or theft.

What has changed is how easy the raw material is to get. Personal data from breaches is traded openly. Data brokers sell addresses, relatives and associations. Deepfakes mean the compromising material does not even have to be real to be frightening. And the approach often starts on a professional networking site: ASIO’s Think Before You Link campaign warns current and former clearance holders that fake recruiter and consultant profiles are used to identify and cultivate targets.

Who gets targeted

Not usually the person with the grandest title. The people worth compromising are the ones whose access does the damage:

system and cloud administrators holding privileged credentials;
finance staff who can create payees or release payments;
executive assistants who see the board papers and manage the diaries;
engineers and contractors with access to operational technology;
anyone who can approve their own changes.

If you have run an access review, you already have the list. It is the same list.

Why access reviews cannot catch it

A coerced insider passes every access review, because nothing about their access is wrong. The account is theirs, the permissions match the role, the logins come from the usual place at the usual time. The compromise is in the person, so the control has to sit with the person and with the process around them, not with the permission.

What ISO 27001 already asks for

The people controls in Annex A of ISO 27001:2022 cover most of this, if you read them with coercion in mind:

6.1 Screening. Background checks proportionate to the role and the risk, and repeated where the role justifies it. A privileged administrator warrants more than a casual receptionist.
6.2 Terms and conditions of employment and 6.6 Confidentiality agreements. Spell out obligations, including the obligation to report attempts to obtain information.
6.3 Awareness, education and training. Teach people what an approach looks like: the flattering recruiter, the too-good consulting offer, the stranger who knows a little too much.
6.8 Information security event reporting. A reporting path that works for “I am being pressured”, not only “I clicked a link”.
5.3 Segregation of duties, 5.18 Access rights and 8.2 Privileged access rights. Design processes so one compromised person cannot finish the job alone: two people to create a payee, peer review for privileged changes.

Segregation of duties is the quiet hero here. You cannot see who is being leaned on, but you can make sure that leaning on one person is not enough. Our guide to the ISO 27001 controls covers each of them in more detail.

What vetting actually asks

Anyone who has been through government security vetting knows the question is not “have you ever done anything wrong?” It is “could someone use this against you?” A debt you have disclosed is manageable. A debt you are hiding is leverage.

The Australian Government’s Protective Security Policy Framework builds on that idea. Commonwealth entities assess eligibility and suitability before granting access to classified information, keep assessing suitability for as long as the access continues, and expect clearance holders to report changes in their circumstances. In 2025 the framework added Direction 003-2025, requiring entities to stop personnel disclosing their clearances and access online, precisely because those disclosures help hostile services pick targets.

You do not need to run a clearance program to borrow the principles: assess the role, not just the person; keep assessing; and ask people to tell you when something changes.

The control nobody writes down: making it safe to report

Every coercion scheme depends on one thing: the target believing that disclosure would be worse than compliance. If owning up to a debt, an affair or an online mistake ends a career, nobody owns up, and the leverage stays live.

So the most effective control is cultural, and it rarely appears in a policy. Make it explicit that someone who reports an approach or a vulnerability early will be supported, not punished. Name a confidential contact. Point people to the employee assistance program. Treat the report as a security event under 6.8, handle it discreetly, and close it properly.

The organisations that get this right turn a hidden vulnerability into a managed one. The ones that do not find out when the payment has already gone.

What I would check this week

Privileged roles: when were the people holding them last screened, and is that proportionate to what they can do?
Two-person rules: can any single person create a payee, change bank details or approve their own privileged change?
Reporting wording: does your incident reporting guidance say, in plain words, that being pressured or approached is reportable?
Executive exposure: what can a stranger learn about your executives and administrators from breach data, data brokers and their professional profiles?
Awareness content: does your security awareness training cover approaches and coercion, or only phishing?

Insider threat and coercion: FAQs

What is kompromat?

A Russian term, short for “compromising material”: information gathered about a person so it can later be used to pressure, recruit or discredit them. The practice was refined by the Soviet KGB and is used by state services and criminal groups today.

Does ISO 27001 require background checks?

ISO 27001 control 6.1 requires screening of candidates before they join and on an ongoing basis, proportionate to business requirements, the classification of the information accessed and the risks. It does not prescribe a particular check; you decide what is proportionate for each role.

Can we rescreen existing staff in Australia?

Often, but carefully. Ongoing checks usually need a clear link to the inherent requirements of the role, the employee’s consent, and handling that complies with the Privacy Act. Build the requirement into employment terms for sensitive roles and get employment law advice before introducing it for existing staff.

What should someone do if they are approached or pressured?

Stop engaging, keep any messages, and report it through the organisation’s security or incident reporting path, or to a named confidential contact. Early reporting takes the leverage away. Clearance holders also have reporting obligations to their sponsoring agency.

Is this only a risk for government and defence suppliers?

No. Defence and government suppliers are attractive targets for state services, but criminal groups use the same methods against any business with money to move or data worth selling. Sextortion and payment fraud built on coerced insiders are criminal problems as much as espionage ones.

How Streamline can help

Streamline builds and audits ISO 27001 information security management systems for Australian organisations, and you deal directly with an experienced ISO Lead Auditor. An internal audit will test whether your screening, segregation of duties and reporting path would hold up against a coerced insider, not only against an outside attacker. If you would like a hand, get in touch.

This article is general information from an information security and auditing perspective. It is not legal advice; for screening and privacy obligations, seek advice specific to your organisation.

Sources

Published 13 October 2026 | Facts checked 16 October 2026 | Next review April 2027 | Jurisdiction: Australia (PSPF and Privacy Act noted) | Edition: ISO/IEC 27001:2022

General guidance only. This article is general information, not legal, financial, safety or compliance advice, and it does not take account of your specific circumstances. Streamline ISO Consultants are ISO management-system consultants, not lawyers or licensed advisers. Standards, laws and regulator guidance change, and details were correct only at the time of writing. Always seek professional advice before acting. See our full Disclaimer.