; (2) monitor user activity on all classified networks in order to detect activity indicative of insider threat behavior; (3) build and maintain an insider threat analytic and response capability to review, assess, and respond to information obtained pursuant to paragraph (2)