Governance, legal, and risk
Specific Intelligence Requirements (SIRs)
Specific intelligence requirements (SIRs) are the detailed, factual questions analysts must answer in order to address a priority intelligence requirement, and they are the level at which collection is actually planned.
From priority to specific
A priority requirement asks whether the brand is being used in phishing against customers in a new market. The specific requirements beneath it are concrete: which lookalike domains have been registered in the market's country-code top-level domains in the last 90 days; which of them serve content; which hosting providers and registrars recur; which phishing kits are in use. Each can be assigned, sourced and closed.
Characteristics
- Answerable from identifiable sources, such as registration data, certificate logs or passive DNS.
- Bounded in time and scope.
- Owned by a named analyst or a named tool.
- Traceable upward to the priority requirement it serves, so that work with no parent is questioned.
Common failure
Specific requirements written without a parent become a standing list of things to collect, and the intelligence function drifts back to reporting what it sees rather than what was asked. The fix is periodic review: every specific requirement either serves a current priority or is retired.
Related terms
Sources
- NIST CSRC glossary: cyber threat intelligence
- NIST SP 800-150: Guide to Cyber Threat Information Sharing
External guidance is general. Adapt it to your legal, regulatory and operational requirements.