Unauthorized Access to Sensitive Organizational Data

A subject accesses, views, searches, queries, or retrieves sensitive organizational data without a legitimate business purpose or authorization to do so. The subject may possess valid technical access to the relevant system, repository, or dataset but uses that access outside the requirements of their role, assigned responsibilities, project involvement, or other approved activity.

Sensitive organizational data may include intellectual property, financial information, strategic plans, merger and acquisition material, legal information, internal investigations, security documentation, detection logic, source code, research data, executive communications, or other information whose confidentiality is important to the organization.