Governance, legal, and risk
Intelligence Requirements (IRs)
Intelligence requirements are the questions an organisation needs its threat intelligence function to answer, stated in advance so that collection and analysis are directed at decisions rather than at whatever data is easiest to get.
Why start with questions
Without stated requirements, an intelligence team collects what its sources offer and reports what looks interesting. With them, it can say which sources to buy, which alerts to ignore and what a finished product should contain. Requirements are also how the team is judged: did it answer the questions it was asked?
The hierarchy
- Priority intelligence requirements: the small number of questions leadership most needs answered.
- Specific intelligence requirements: the narrower, factual questions analysts must answer to address a priority requirement.
- Collection requirements: the concrete data and sources needed to answer a specific requirement.
Examples for a brand-protection programme
- Which of our brands and products are being impersonated, on which channels, and is that changing?
- Which phishing kits and infrastructure providers recur across attacks on our customers?
- How quickly does new infrastructure targeting us appear after a public event, such as a product launch or a breach?
Related terms
Sources
- NIST CSRC glossary: cyber threat intelligence
- NIST SP 800-150: Guide to Cyber Threat Information Sharing
External guidance is general. Adapt it to your legal, regulatory and operational requirements.