ID.RA-02 says cyber threat intelligence is received from information sharing forums and sources. You do not need a threat intelligence team. You need a small number of reliable inputs, a person who reads them, and a way to turn relevant items into action.
CSF is voluntary guidance and there is no CSF certification.
What good looks like
You subscribe to advisories from reputable third parties about current threat actors and their techniques. Your detection or response tools can ingest relevant feeds. Someone is named as the reader, and items that affect your technology become tickets.
How to implement it
- Choose sources: your national cybersecurity agency advisories, the vendor security bulletins for products you run, and an industry sharing group for your sector if one exists.
- Route them to a shared mailbox or channel and name an owner.
- Hold a weekly fifteen minute review: does anything here touch our stack?
- Where tools support it, ingest indicator feeds into detection tooling securely, and remove stale indicators.
- Watch for vulnerabilities in emerging technologies you are adopting, such as new frameworks or AI tooling.
- Log each relevant item and what you did.
Evidence to collect
- The list of sources and the subscription records.
- Weekly review notes or a ticket history.
- Configuration showing a feed ingested into a tool.
- Examples where intelligence led to a patch, a rule or a block.
Common gaps
- Feeds arrive in one person's inbox and stop when they go on vacation.
- Everything is collected and nothing is filtered for relevance.
- No link between intelligence and the asset inventory, so you cannot tell what applies.
Quick check
Is paid intelligence required?
No. Government advisories, vendor bulletins and sector sharing groups are enough for many small and mid size companies. Add paid sources only if you can act on what they provide.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
