ID.RA-02: Threat Intelligence

Control Details

Control ID

ID.RA-02

Title

Threat Intelligence

Function

Identify (ID)

Category

Risk Assessment

Framework

NIST CSF 2.0

Cyber threat intelligence is received from information sharing forums and sources.

Cyber threat intelligence is received from information sharing forums and sources. The organization uses threat intelligence to understand the tactics and techniques used by adversaries targeting its industry and technology stack.

Why This Matters

Reactive security that ignores threat intelligence leaves organizations surprised by attacks that were foreseeable. Threat intelligence enables proactive defense and informed risk prioritization.

Implementation Checklist

Use this checklist to verify your organization meets the requirements of ID.RA-02.

• Subscribe to industry-specific threat intelligence feeds
• Participate in information sharing organizations such as ISACs
• Integrate threat intelligence into vulnerability prioritization workflows
• Brief leadership on emerging threats relevant to the organization quarterly
• Correlate threat intelligence with internal telemetry and log data

Evidence an Auditor Expects

Prepare the following documentation and artifacts to demonstrate compliance with ID.RA-02 during an audit.

• Threat intelligence feed subscription documentation
• ISAC membership records or participation logs
• Threat briefing presentations and meeting minutes
• Examples of threat intelligence integrated into detection rules or vulnerability priorities

Common Gaps We Find

Based on our penetration testing and risk assessment engagements, these are the gaps organizations most frequently have with ID.RA-02.

• Threat intelligence is consumed but never operationalized into detection or prevention
• No participation in industry information sharing groups
• Threat briefings to leadership do not occur on a regular schedule

FAQ