A subject deliberately redirects organizational resources toward an unauthorized purpose, activity, beneficiary, or destination. Affected resources may include personnel time, computing capacity, equipment, facilities, inventory, financial resources, software, or other organizational assets.

The infringement occurs where the diversion produces identifiable harm, such as financial cost, reduced availability, lost productivity, delayed work, asset depletion, service degradation, or an unauthorized benefit to another party.

Organizational Resource Diversion should be distinguished from minor personal use permitted by the organization’s Acceptable Use Policy. Classification requires deliberate, materially unauthorized use that consumes, displaces, transfers, or denies organizational value.

Subsections (5)

ID	Name	Description
IF043.002	Computing Resource Diversion	A subject uses organizational computing resources for an unauthorized purpose. This may include servers, cloud infrastructure, storage, processing capacity, network bandwidth, development environments, or software subscriptions.
IF043.003	Equipment or Facility Diversion	A subject redirects organizational equipment, vehicles, facilities, laboratories, production capability, or other physical assets toward an unauthorized use. Harm may include reduced availability, damage, operating cost, or disruption to legitimate activity.
IF043.004	Inventory Diversion	A subject redirects organizational stock, materials, products, components, or consumable assets to an unauthorized recipient, destination, or purpose. Harm may include financial loss, stock discrepancies, supply shortages, or production delays.
IF043.001	Personnel Diversion	A subject directs organizational personnel to perform work for an unauthorized purpose, beneficiary, or activity. Harm may include lost working time, delayed tasks, increased labour cost, or reduced operational capacity.
IF043.005	Working-Time Diversion	A subject deliberately uses substantial paid working time for sustained activity unrelated to their organizational responsibilities. This should exclude minor personal use permitted under the Acceptable Use Policy.

Preventions (1)

Detections (4)