Threat Intelligence Requirements

What it means

Threat intelligence requirements translate stakeholder decisions and uncertainties into specific questions that collection and analysis can answer.

Why it matters

Without clear requirements, intelligence teams accumulate indicators and reports without knowing which decisions the work should improve.

Practical focus

• Identify the decision owner and decision deadline
• Write answerable questions rather than broad topic interests
• Prioritize requirements by risk and operational value
• Review requirements when the threat or business context changes

Common mistakes

• Starting with available feeds instead of stakeholder needs
• Writing requirements that cannot be observed or measured
• Treating every request as equal priority
• Failing to close the loop with the requester

Certification relevance

This subject appears in or supports the following certification bodies of knowledge:

Authoritative sources

• NIST SP 800-150 — Guide to Cyber Threat Information Sharing
• MITRE ATT&CK