id: "PM-16" title: "Threat Awareness Program" family: "PM" family_name: "Program Management" sort_id: "pm-16" priority: "P1" implementation_level: "organization" enhancements: - pm-16.1
Statement
Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.
Guidance
Because of the constantly changing and increasing sophistication of adversaries, especially the advanced persistent threat (APT), it may be more likely that adversaries can successfully breach or compromise organizational systems. One of the best techniques to address this concern is for organizations to share threat information, including threat events (i.e., tactics, techniques, and procedures) that organizations have experienced, mitigations that organizations have found are effective against certain types of threats, and threat intelligence (i.e., indications and warnings about threats). Threat information sharing may be bilateral or multilateral. Bilateral threat sharing includes government-to-commercial and government-to-government cooperatives. Multilateral threat sharing includes organizations taking part in threat-sharing consortia. Threat information may require special agreements and protection, or it may be freely shared.
Assessment Objective
a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence is implemented.
Information security program plan
privacy program plan
threat awareness program policy
threat awareness program procedures
risk assessment results relevant to threat awareness
documentation about the cross-organization information-sharing capability
other relevant documents or records
Organizational personnel with information security and privacy program planning and plan implementation responsibilities
organizational personnel responsible for the threat awareness program
organizational personnel responsible for the cross-organization information-sharing capability
organizational personnel with information security and privacy responsibilities
external personnel with whom threat awareness information is shared by the organization
Organizational processes for implementing the threat awareness program
organizational processes for implementing the cross-organization information-sharing capability
mechanisms supporting and/or implementing the threat awareness program
mechanisms supporting and/or implementing the cross-organization information-sharing capability