Threat Intelligence Foundations and Requirements
The Foundations and Requirements domain tests whether you can run threat intelligence as a decision-support discipline. Questions cover the intelligence cycle, intelligence levels and consumers, and the requirement chain from Priority Intelligence Requirements (PIRs) to Specific Intelligence Requirements (SIRs) to Essential Elements of Information (EEIs).
Core rules
- Intelligence must answer a named decision. If no decision or action can change, the output is content, not intelligence.
- Direction starts with a PIR tied to a command or business decision. An SIR decomposes that PIR into a narrower question. An EEI is the observable, collectable fact that answers an SIR.
- Match the intelligence level to the consumer: strategic for policy and board risk, operational for campaign planning, tactical for defensive operations, and technical for detection engineering and IOCs. Label the level rather than mixing them silently.
- Separate data, information, and intelligence. Data is raw; information is organized; intelligence is evaluated, contextualized, and actionable.
- State confidence and sourcing. Distinguish fact, assumption, and judgment, and avoid presenting inference as certainty.
- Requirements are living. Review them after each decision cycle and when the threat landscape or business exposure changes.
Worked example
A CISO asks, 'Are we exposed to ransomware crews that buy access to insurance networks?' The PIR becomes: 'Which ransomware-affiliated intrusion sets are acquiring initial access to mid-size insurers, and what controls reduce our exposure?' SIRs cover actor targeting, the access-broker ecosystem, initial-access vectors, and extortion patterns. EEIs include broker advertisements naming insurance, VPN or RDP exploits observed in the sector, leak-site claims, and affiliate TTPs. Collection tasks follow: dark-web marketplace monitoring, ISAC reporting, ATT&CK mapping, and internal exposure telemetry. The answer supports a control decision, not a feed subscription.
Traps that cost marks
- Treating a threat feed as a program. Feeds supply data; requirements supply purpose.
- Writing PIRs so broadly ('cyber risk') that no collection task can follow.
- Confusing tactical IOCs with strategic risk. Both matter, but they answer different questions for different consumers.
- Omitting confidence, source, or the decision the intelligence is meant to support.