Threat Awareness Program
LOW MODERATE HIGHRequirements NIST SOURCE
Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.
Discussion (NIST Supplemental Guidance)
Because of the constantly changing and increasing sophistication of adversaries, especially the advanced persistent threat (APT), it may be more likely that adversaries can successfully breach or compromise organizational systems. One of the best techniques to address this concern is for organizations to share threat information, including threat events (i.e., tactics, techniques, and procedures) that organizations have experienced, mitigations that organizations have found are effective against certain types of threats, and threat intelligence (i.e., indications and warnings about threats). Threat information sharing may be bilateral or multilateral. Bilateral threat sharing includes government-to-commercial and government-to-government cooperatives. Multilateral threat sharing includes organizations taking part in threat-sharing consortia. Threat information may require special agreements and protection, or it may be freely shared.
Enhancements NIST SOURCE
PM-16(1) Automated Means for Sharing Threat Intelligence LOW MODERATE HIGH
Employ automated mechanisms to maximize the effectiveness of sharing threat intelligence information.
Discussion
To maximize the effectiveness of monitoring, it is important to know what threat observables and indicators the sensors need to be searching for. By using well-established frameworks, services, and automated tools, organizations improve their ability to rapidly share and feed the relevant threat detection signatures into monitoring tools.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for PM-16 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence is implemented.
Examine
[SELECT FROM: Information security program plan; privacy program plan; threat awareness program policy; threat awareness program procedures; risk assessment results relevant to threat awareness; documentation about the cross-organization information-sharing capability; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with information security and privacy program planning and plan implementation responsibilities; organizational personnel responsible for the threat awareness program; organizational personnel responsible for the cross-organization information-sharing capability; organizational personnel with information security and privacy responsibilities; external personnel with whom threat awareness information is shared by the organization].
Test
[SELECT FROM: Organizational processes for implementing the threat awareness program; organizational processes for implementing the cross-organization information-sharing capability; mechanisms supporting and/or implementing the threat awareness program; mechanisms supporting and/or implementing the cross-organization information-sharing capability].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for PM-16. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- Information security program plan
- privacy program plan
- threat awareness program policy
- threat awareness program procedures
Testing
- Organizational processes for implementing the threat awareness program
- organizational processes for implementing the cross-organization information-sharing capability
- mechanisms supporting and/or implementing the threat awareness program
- mechanisms supporting and/or implementing the cross-organization information-sharing capability
Other Records
- risk assessment results relevant to threat awareness
- documentation about the cross-organization information-sharing capability
- other relevant documents or records