Scope Enterprise Active

Threat Intelligence & Threat Management

To proactively identify, assess, and manage threats to the organization.

Domain ID
DOM-019
Domain Code
THR
Business Owner
Threat Intelligence Team

Domain Overview

THR · Full Domain Profile
Short Overview

Establishes the processes for collecting, analyzing, and using threat intelligence to understand and manage security threats.

Description

Focuses on understanding the threat landscape, including threat intelligence, threat hunting, and red team exercises, to proactively defend against sophisticated adversaries.

Why This Domain Matters

Organizations struggle to collect and process threat intelligence at scale, turning data into actionable insights, and measuring the business value of intelligence investments.

Business Objectives

    Business Risks

      Common Challenges

        Key Capabilities

        Stakeholders, Industries & Technologies

        THR · Operating Context

        Typical Stakeholders

        Applicable Industries

        Applicable Technologies

        Keywords & Tags

        Associated Controls Catalog

        4 Active Controls in Domain
        Control ID Control Name Category & Type Criticality Status Requirements Action
        THR-001 Threat Intelligence Management Establishes threat intelligence manageme...
        Operational
        Detective
        		 Critical Active 📋 10 Reqs View →
        THR-002 Attack Surface Management Establishes attack surface management in...
        Operational
        Detective
        		 Critical Active 📋 10 Reqs View →
        THR-003 Insider Threat Management Establishes insider threat management in...
        Operational
        Corrective
        		 High Active 📋 10 Reqs View →
        THR-004 Adversary Simulation & Security Validation Establishes adversary simulation includi...
        Operational
        Detective
        		 High Active 📋 10 Reqs View →

        Compliance Requirements & Audit Crosswalk

        40 Specific Audit Clauses

        The following requirements dictate specific audit evidence criteria and testing steps mapped directly under the controls of this domain.

        REQUIREMENT ID REQUIREMENT TITLE & DETAILS MAPPED CONTROL TYPICAL OWNER ACTION
        THR-001-R001 Threat Intelligence Framework The organization shall establish a threa... THR-001 Threat Intelligence Management CISO / Threat Intelligence Team View ↗
        THR-001-R002 Intelligence Source Management The organization shall manage threat int... THR-001 Threat Intelligence Management CISO / Threat Intelligence Team View ↗
        THR-001-R003 Intelligence Collection The organization shall collect threat in... THR-001 Threat Intelligence Management CISO / Threat Intelligence Team View ↗
        THR-001-R004 Intelligence Analysis The organization shall analyze threat in... THR-001 Threat Intelligence Management CISO / Threat Intelligence Team View ↗
        THR-001-R005 Intelligence Validation The organization shall validate threat i... THR-001 Threat Intelligence Management CISO / Threat Intelligence Team View ↗
        THR-001-R006 Intelligence Dissemination The organization shall disseminate threa... THR-001 Threat Intelligence Management CISO / Threat Intelligence Team View ↗
        THR-001-R007 Intelligence Integration The organization shall integrate threat... THR-001 Threat Intelligence Management CISO / Threat Intelligence Team View ↗
        THR-001-R008 Intelligence Reporting The organization shall report on threat... THR-001 Threat Intelligence Management CISO / Threat Intelligence Team View ↗
        THR-001-R009 Intelligence Review The organization shall conduct periodic... THR-001 Threat Intelligence Management CISO / Threat Intelligence Team View ↗
        THR-001-R010 Continuous Improvement The organization shall establish a conti... THR-001 Threat Intelligence Management CISO / Threat Intelligence Team View ↗
        THR-002-R001 ASM Framework The organization shall establish an Atta... THR-002 Attack Surface Management Threat Intelligence Team / SOC View ↗
        THR-002-R002 Asset Discovery The organization shall discover assets t... THR-002 Attack Surface Management Threat Intelligence Team / SOC View ↗
        THR-002-R003 External Attack Surface Discovery The organization shall discover and map... THR-002 Attack Surface Management Threat Intelligence Team / SOC View ↗
        THR-002-R004 Internal Attack Surface Discovery The organization shall discover and map... THR-002 Attack Surface Management Threat Intelligence Team / SOC View ↗
        THR-002-R005 Exposure Assessment The organization shall conduct exposure... THR-002 Attack Surface Management Threat Intelligence Team / SOC View ↗
        THR-002-R006 Exposure Prioritization The organization shall prioritize exposu... THR-002 Attack Surface Management Threat Intelligence Team / SOC View ↗
        THR-002-R007 Continuous Monitoring The organization shall continuously moni... THR-002 Attack Surface Management Threat Intelligence Team / SOC View ↗
        THR-002-R008 Exposure Reporting The organization shall report on attack... THR-002 Attack Surface Management Threat Intelligence Team / SOC View ↗
        THR-002-R009 Exposure Review The organization shall conduct periodic... THR-002 Attack Surface Management Threat Intelligence Team / SOC View ↗
        THR-002-R010 Continuous Improvement The organization shall establish a conti... THR-002 Attack Surface Management Threat Intelligence Team / SOC View ↗
        THR-003-R001 Insider Threat Framework The organization shall establish an insi... THR-003 Insider Threat Management Threat Intelligence Analysts View ↗
        THR-003-R002 Insider Risk Identification The organization shall identify insider... THR-003 Insider Threat Management Threat Intelligence Analysts View ↗
        THR-003-R003 User Activity Monitoring The organization shall monitor user acti... THR-003 Insider Threat Management Threat Intelligence Analysts View ↗
        THR-003-R004 Insider Investigation The organization shall investigate poten... THR-003 Insider Threat Management Threat Intelligence Analysts View ↗
        THR-003-R005 Insider Response The organization shall respond to confir... THR-003 Insider Threat Management Threat Intelligence Analysts View ↗
        THR-003-R006 HR Coordination The organization shall coordinate inside... THR-003 Insider Threat Management Threat Intelligence Analysts View ↗
        THR-003-R007 Insider Reporting The organization shall report on insider... THR-003 Insider Threat Management Threat Intelligence Analysts View ↗
        THR-003-R008 Insider Review The organization shall conduct periodic... THR-003 Insider Threat Management Threat Intelligence Analysts View ↗
        THR-003-R009 Insider Awareness The organization shall promote awareness... THR-003 Insider Threat Management Threat Intelligence Analysts View ↗
        THR-003-R010 Continuous Improvement The organization shall establish a conti... THR-003 Insider Threat Management Threat Intelligence Analysts View ↗
        THR-004-R001 Security Validation Framework The organization shall establish a secur... THR-004 Adversary Simulation & Securit... Threat Intelligence Team / SOC View ↗
        THR-004-R002 Penetration Testing The organization shall conduct penetrati... THR-004 Adversary Simulation & Securit... Threat Intelligence Team / SOC View ↗
        THR-004-R003 Red Team Exercises The organization shall conduct Red Team... THR-004 Adversary Simulation & Securit... Threat Intelligence Team / SOC View ↗
        THR-004-R004 Purple Team Exercises The organization shall conduct Purple Te... THR-004 Adversary Simulation & Securit... Threat Intelligence Team / SOC View ↗
        THR-004-R005 Adversary Emulation The organization shall conduct adversary... THR-004 Adversary Simulation & Securit... Threat Intelligence Team / SOC View ↗
        THR-004-R006 Security Control Validation The organization shall validate the effe... THR-004 Adversary Simulation & Securit... Threat Intelligence Team / SOC View ↗
        THR-004-R007 Validation Reporting The organization shall report on securit... THR-004 Adversary Simulation & Securit... Threat Intelligence Team / SOC View ↗
        THR-004-R008 Remediation Tracking The organization shall track remediation... THR-004 Adversary Simulation & Securit... Threat Intelligence Team / SOC View ↗
        THR-004-R009 Validation Review The organization shall conduct periodic... THR-004 Adversary Simulation & Securit... Threat Intelligence Team / SOC View ↗
        THR-004-R010 Continuous Improvement The organization shall establish a conti... THR-004 Adversary Simulation & Securit... Threat Intelligence Team / SOC View ↗

        Cross-Mapped Regulatory Frameworks

        Harmonized Control Mappings
        Framework Code Framework Name & Description Family / Category Version Action
        MAPPED MITRE ATT&CK Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        NIST-CSF NIST CSF (ID.RA-1) The NIST Cybersecurity Framework provide...
        NIST
        Framework
        		 v2 View →
        MAPPED ISAO Standards Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        MAPPED STIX/TAXII Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        MAPPED NIST SP 800-150 Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        MAPPED Cyber Threat Intelligence Framework Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —