Automated Means for Sharing Threat Intelligence
LOW MODERATE HIGHRequirements NIST SOURCE
Employ automated mechanisms to maximize the effectiveness of sharing threat intelligence information.
Discussion (NIST Supplemental Guidance)
To maximize the effectiveness of monitoring, it is important to know what threat observables and indicators the sensors need to be searching for. By using well-established frameworks, services, and automated tools, organizations improve their ability to rapidly share and feed the relevant threat detection signatures into monitoring tools.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for PM-16(1) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- automated mechanisms are employed to maximize the effectiveness of sharing threat intelligence information.
Examine
[SELECT FROM: Information security program plan; privacy program plan; threat awareness program policy; threat awareness program procedures; risk assessment results related to threat awareness; documentation about the cross-organization information-sharing capability; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with information security and privacy program planning and plan implementation responsibilities; organizational personnel responsible for the threat awareness program; organizational personnel responsible for the cross-organization information-sharing capability; organizational personnel with information security and privacy responsibilities; external personnel with whom threat awareness information is shared by the organization].
Test
[SELECT FROM: Organizational processes for implementing the threat awareness program; organizational processes for implementing the cross-organization information-sharing capability; automated mechanisms supporting and/or implementing the threat awareness program; automated mechanisms supporting and/or implementing the cross-organization information-sharing capability].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for PM-16(1). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- Information security program plan
- privacy program plan
- threat awareness program policy
- threat awareness program procedures
Testing
- Organizational processes for implementing the threat awareness program
- organizational processes for implementing the cross-organization information-sharing capability
- automated mechanisms supporting and/or implementing the threat awareness program
- automated mechanisms supporting and/or implementing the cross-organization information-sharing capability
Other Records
- risk assessment results related to threat awareness
- documentation about the cross-organization information-sharing capability
- other relevant documents or records