CTSP key terms

The prioritized questions that decision-makers need answered, stated precisely enough to guide collection and analysis. They define what is in scope, what is out of scope, and how much effort each question deserves.

The subset of intelligence requirements judged most critical to leadership decisions, addressed first with the best available sources. They usually tie to specific threats, actors, or business risks and are reviewed as conditions change.

The repeating sequence of planning and direction, collection, processing, analysis and production, and dissemination. Each phase feeds the next, and feedback from consumers restarts the loop with revised requirements.

The phase in which raw collected data is validated, integrated, evaluated, and turned into finished intelligence products that answer the stated requirements. It includes source reliability checks, reasoning, and judgment about confidence.

Delivering finished intelligence to the right consumers in a form and timeframe they can act on, with appropriate handling restrictions. Effective dissemination includes confirming receipt and gathering feedback that shapes future requirements.

A group of organizations that exchange threat data under agreed rules, often through a trusted platform or mailing list. Membership, handling caveats, and reciprocity expectations are typically defined in a sharing agreement.

A marking scheme using four colors to signal how far shared information may travel: red is recipient-only, amber is limited distribution, green is community-wide, and clear is public. Markings govern onward sharing, not classification level.

A formal arrangement defining what data parties will exchange, in what format, under which handling rules, and with what liability and termination terms. It sets expectations before sharing begins and supports legal and privacy compliance.

Long-horizon analysis aimed at senior leaders, addressing trends, actor intent, risk posture, and investment decisions rather than specific alerts. It typically spans months to years and informs policy, budget, and program design.

Analysis supporting campaigns and ongoing operations, such as tracking an actor's infrastructure, tooling, and targeting over weeks or months. It sits between long-range strategic assessment and immediate incident-level indicators.

Short-lived, actionable detail used to detect or block activity right now, such as file hashes, domains, or command patterns. It has a narrow window of usefulness and must be paired with context to avoid false positives.

Evidence-based knowledge about existing or emerging threats, including context about actors, capabilities, and intent, that supports decisions. It is distinguished from raw data by analysis, relevance, and fitness for a specific consumer.

A framework relating four core features of any intrusion: adversary, capability, infrastructure, and victim. Analysts pivot between vertices to test hypotheses and connect related events into a coherent campaign picture.

A curated knowledge base of adversary tactics and techniques observed in real intrusions, organized by platform. Defenders use it to map detections, compare actor behavior, and find coverage gaps in a structured way.

A phased model of an intrusion from reconnaissance through actions on objectives, used to describe where activity sits and where it can be interrupted. Defenders map controls and detections to each phase to find weak links.

Three levels of behavioral description: tactics are the adversary's goal, techniques are how the goal is achieved, and procedures are the specific implementation observed. Procedures are most specific and change fastest; tactics are most stable.

An individual or group conducting malicious activity, characterized by motivation, capability, resources, and typical targeting. Attribution to a named actor is a judgment with varying confidence and should be stated as such.

A well-resourced actor that conducts prolonged, stealthy campaigns against chosen targets, often with political or espionage goals. The label reflects sustained access and tradecraft, not merely use of sophisticated malware.

The analytic judgment assigning activity to a specific actor or sponsor, with an explicit confidence level and supporting evidence. It is probabilistic, can be wrong, and is often less important operationally than understanding capability and intent.

An actor driven by ideological or political messaging who uses disruptive or data-exposing attacks for publicity. Defacement, denial of service, and leaks are common; persistence and stealth are usually secondary to visibility.

A financially motivated actor, often organized in specialized roles such as access brokering, ransomware deployment, and money laundering. Groups may share tooling or affiliate with others, blurring clean attribution boundaries.

The network of developers, affiliates, access sellers, and negotiators that surrounds ransomware operations. Ransomware-as-a-service arrangements let affiliates rent code and infrastructure while core operators take a share of proceeds.

An actor who obtains and sells footholds in victim networks, such as valid credentials or remote-access sessions, to other operators. Their activity often precedes ransomware and can be detected earlier in the intrusion chain.

A ransomware tactic in which data is stolen before encryption so victims face both operational disruption and threatened public release. It shifts pressure onto reputational and regulatory risk, not just recovery from backups.

The overall picture of actors, campaigns, vulnerabilities, and trends relevant to an organization at a given time. It changes continuously, so assessments must be dated and revisited rather than treated as fixed truths.

Information gathered from publicly available sources such as vendor reports, news, social media, and government advisories. It is inexpensive and broad but requires verification because quality, bias, and freshness vary widely.

Information obtained from restricted channels such as paid feeds, private sharing communities, or commercial telemetry. It often adds timeliness or specificity but carries contractual handling limits and cost considerations.

A document that maps each intelligence requirement to specific sources, methods, schedules, and owners. It records gaps and shortfalls so collection effort can be redirected as priorities shift.

An assessment of how trustworthy a source has proven over time, independent of whether a particular report is true. It is usually rated separately from information credibility so the two judgments can be combined.

An evaluation of whether a specific piece of reporting is plausible, consistent with other data, and technically sound. It is judged per report, while source reliability describes the provider across many reports.

A stated expression of how strongly the evidence supports an analytic judgment, often using terms such as low, moderate, or high. It communicates uncertainty to decision-makers and should not be confused with probability of an event.

A structured technique that lists plausible explanations and evaluates evidence for how strongly it refutes each one, rather than confirming a favorite. It reduces confirmation bias and makes the reasoning auditable.

Formal methods that make reasoning explicit and challenge assumptions, such as key assumptions checks, devil's advocacy, and what-if analysis. They are used to counter bias and improve the rigor of judgments under uncertainty.

A systematic pattern of deviation from rational judgment, such as anchoring on the first indicator seen or favoring evidence that confirms an existing belief. Naming the bias and applying structured techniques helps limit its influence.

An observable artifact suggesting a system may have been breached, such as a malicious hash, domain, IP address, or registry key. Indicators are easy to share but are often short-lived and may be planted to mislead.

An observable focused on adversary behavior or intent during an intrusion, such as unusual process parentage or lateral movement patterns. These tend to survive minor tool changes better than static file or network artifacts.

The practice of assigning a lifetime to each indicator so stale or reassigned infrastructure is not blocked indefinitely. Expiry reduces false positives and prevents defenders from chasing infrastructure that has moved to new owners.

A proactive, hypothesis-driven search for adversary activity that existing detections have missed, rather than waiting for alerts. It uses behavioral data, threat intelligence context, and repeatable queries that can become future detections.

An alert or match that appears suspicious but is actually benign activity. High false positive rates erode analyst trust and waste effort, so detections are tuned and validated before broad deployment.

Software that ingests, normalizes, deduplicates, and correlates threat data from multiple sources, then supports enrichment and controlled sharing. It stores context and relationships so analysts can act on data rather than raw feeds.

A continuously delivered stream of threat data, such as indicators or reports, from a provider or community. Feeds vary in format, update rate, and quality, and require filtering before operational use.

Adding context to raw data, such as geolocation, reputation, WHOIS history, or related campaigns, so it can be interpreted. Enrichment turns isolated artifacts into information an analyst can prioritize and act on.

A standardized language for representing cyber threat information as typed objects and relationships, enabling automated exchange. It supports indicators, observed data, campaigns, and actors in a machine-readable, consistent form.

Identifying the consumers of intelligence and documenting their decisions, timeframes, and preferred formats. It guides what to produce, at which classification level, and how technical or strategic the language should be.

A written product that answers a requirement with findings, evidence, assessment, and confidence, written for a specific audience. Good reports separate facts from judgments and state what action or decision they support.

Practices that protect an organization's own activity and sources from adversary observation, including compartmentation and careful handling of sensitive indicators. Poor operational security can burn collection sources or reveal defensive gaps.

A restriction placed on intelligence stating who may see it, how it may be stored, and whether it can be redistributed. Caveats protect sources and legal obligations and must travel with the data when shared.

Data that can identify a specific person, directly or in combination with other data, and that is subject to privacy law. Threat data often contains it, so collection and sharing must be minimized and justified.