Control statement
Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.
Discussion
Because of the constantly changing and increasing sophistication of adversaries, especially the advanced persistent threat (APT), it may be more likely that adversaries can successfully breach or compromise organizational systems. One of the best techniques to address this concern is for organizations to share threat information, including threat events (i.e., tactics, techniques, and procedures) that organizations have experienced, mitigations that organizations have found are effective against certain types of threats, and threat intelligence (i.e., indications and warnings about threats). Threat information sharing may be bilateral or multilateral. Bilateral threat sharing includes government-to-commercial and government-to-government cooperatives. Multilateral threat sharing includes organizations taking part in threat-sharing consortia. Threat information may require special agreements and protection, or it may be freely shared.
From control text to operational evidence
Use Threat Awareness Program as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to enterprise program governance, accountability, resources, metrics, and organization-wide risk decisions.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- program charters and policies
- governance meeting records
- risk and performance metrics
- resource and responsibility assignments
Common failure patterns
- program metrics count activity instead of outcomes
- system-level risks never reach enterprise governance
- responsibilities assigned without authority or resources
- privacy and security managed in separate silos
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence is implemented.
Examine
- Information security program plan
- privacy program plan
- threat awareness program policy
- threat awareness program procedures
- risk assessment results relevant to threat awareness
- documentation about the cross-organization information-sharing capability
- other relevant documents or records
Interview
- Organizational personnel with information security and privacy program planning and plan implementation responsibilities
- organizational personnel responsible for the threat awareness program
- organizational personnel responsible for the cross-organization information-sharing capability
- organizational personnel with information security and privacy responsibilities
- external personnel with whom threat awareness information is shared by the organization
Test
- Organizational processes for implementing the threat awareness program
- organizational processes for implementing the cross-organization information-sharing capability
- mechanisms supporting and/or implementing the threat awareness program
- mechanisms supporting and/or implementing the cross-organization information-sharing capability
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
PM-16(1) — Automated Means for Sharing Threat Intelligence
Employ automated mechanisms to maximize the effectiveness of sharing threat intelligence information.
Official discussion
To maximize the effectiveness of monitoring, it is important to know what threat observables and indicators the sensors need to be searching for. By using well-established frameworks, services, and automated tools, organizations improve their ability to rapidly share and feed the relevant threat detection signatures into monitoring tools.
Assessment objectives and methods
automated mechanisms are employed to maximize the effectiveness of sharing threat intelligence information.
Examine
- Information security program plan
- privacy program plan
- threat awareness program policy
- threat awareness program procedures
- risk assessment results related to threat awareness
- documentation about the cross-organization information-sharing capability
- other relevant documents or records
Interview
- Organizational personnel with information security and privacy program planning and plan implementation responsibilities
- organizational personnel responsible for the threat awareness program
- organizational personnel responsible for the cross-organization information-sharing capability
- organizational personnel with information security and privacy responsibilities
- external personnel with whom threat awareness information is shared by the organization
Test
- Organizational processes for implementing the threat awareness program
- organizational processes for implementing the cross-organization information-sharing capability
- automated mechanisms supporting and/or implementing the threat awareness program
- automated mechanisms supporting and/or implementing the cross-organization information-sharing capability
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.