Governance, legal, and risk
Priority Intelligence Requirements (PIRs)
Priority intelligence requirements (PIRs) are the few questions that matter most to an organisation's leadership, chosen to focus limited intelligence collection and analysis on the decisions that carry the most risk.
What makes a good PIR
A PIR is a question, not a topic. It is tied to a decision someone will make, it can be answered with evidence, and it has an owner. There should be few of them, because their purpose is to force a choice about where effort goes. A list of twenty is a list of topics.
Writing them
- Start from the decisions: what would leadership do differently if it knew the answer?
- State the question so that a specific finding can answer it.
- Attach a time frame and a review date; threats and priorities change.
- Break each one into specific intelligence requirements that analysts can actually work.
Example
For a payments company: is our brand being used in phishing against our customers in the markets we are entering, and who is behind it? That single question drives what to monitor, which languages and top-level domains to cover, and what a monthly report should contain.
Related terms
Sources
- NIST CSRC glossary: cyber threat intelligence
- NIST SP 800-150: Guide to Cyber Threat Information Sharing
External guidance is general. Adapt it to your legal, regulatory and operational requirements.