01
Some positions hold privileges, access paths, or decision power that create outsized impact if compromised or misused.
Roles
Critical Roles
Understand the human and organizational roles that become high-value targets when they shape control, recovery, and mission continuity.
02
High Value Target Roles cover internal and external actors with pre-authorized access to systems, data, processes, or third parties.
03
The RFC is designed to help quantify and mitigate role-based resilience risk before it amplifies an incident.
High Value Target Roles - Public Request for Comments
Why the Concept of High Value Target Roles
Defining High Value Target Roles is essential for cyber resilience because certain positions hold privileges, access paths, or decision power that can create outsized impact if misused or compromised. By identifying these roles, organizations can quantify and mitigate the magnitude of damage a threat actor—external or insider—could cause, ensuring that resilience controls, monitoring, and response capabilities are prioritised where failure would matter most.
Understanding these roles is essential to the discipline of cyber resilience, as they represent focal points where human, procedural, and technical domains intersect. The misuse or compromise of an HVT role can amplify the impact of an incident, accelerate lateral movement, or enable strategic disruption. The table below represents the essence of this framework, summarizing the primary High Value Target role types.
The Request For Comments (RFC) is open.
Definition
A High Value Target role is the function of an internal or external actor with pre-authorised access who wittingly or unwittingly may significantly impair the cyber resilience posture of an organisation through the application of their abilities and knowledge. High Value Target roles may have pre-authorised access to either High Value Target systems, data, processes or third parties which may contain sensitive information or provide attributes which may serve further exploitation, compromise, unauthorised disclosure or tampering resulting in partial or complete mission degradation or impairment.
Attributes of High Value Target Roles
References
Definition of roles and actors, TOGAF
https://pubs.opengroup.org/architecture/togaf9-doc/arch/chap03.html
"TOGAF 3.2 Actor A person, organization, or system that has one or more roles that initiates or interacts with activities; for example, a sales representative who travels to visit customers. Actors may be internal or external to an organization.
3.63 Role The usual or expected function of an actor, or the part somebody or something plays in a particular action or event. An actor may have a number of roles. The part an individual plays in an organization and the contribution they make through the application of their skills, knowledge, experience, and abilities."
Definition of insider threat, White House
https://obamawhitehouse.archives.gov/the-press-office/2011/10/07/executive-order-13587-structural-reforms-improve-security-classified-net
"Deterring, detecting, and mitigating insider threats, including the safeguarding of classified information from exploitation, compromise, or other unauthorized disclosure, taking into account risk levels, as well as the distinct needs, missions, and systems of individual agencies"
Additional resources with potential to be leveraged
https://www.dni.gov/files/NCSC/documents/nittf/National_Insider_Threat_Policy.pdf
https://www.cisa.gov/defining-insider-threats
https://csrc.nist.gov/glossary/term/insider_threat
https://insights.sei.cmu.edu/blog/cert-definition-of-insider-threat-updated/
https://www.cisa.gov/resources-tools/resources/insider-threat-mitigation-guide
Key Contributors
Francesco Chiarini - author, CEO at High Value Target
Karol Bieniek - co-author, Cyber Resilience Threat Analyst at High Value Target
Resources
Resources
RFC Document
High Value Target Roles — Request for Comments
Download the full RFC document outlining the High Value Target Roles framework.
Access resource
Job Description
Cyber Resilience Officer Job Description
View the role definition and key responsibilities for a Cyber Resilience Officer.
Access resource