ID.RA-03 says internal and external threats to the organization are identified and recorded. In plain terms: write down who or what is likely to hurt you, and keep that list somewhere people can find it. A one page threat register that someone reviews on a schedule meets the spirit of the outcome.
What good looks like
You can answer three questions without a scramble. Which types of attackers are likely to target a company like ours? Which of our own people or contractors could cause harm, on purpose or by accident? What changed in the last quarter that adds or removes a threat?
NIST's implementation examples point at three habits: use cyber threat intelligence to understand the likely threat actors and their tactics, perform threat hunting for signs of those actors in your environment, and have a process for identifying internal threat actors.
How to implement it
- Start with a short list of external threat types that fit your business. Ransomware crews, credential thieves, supply chain compromise of a dependency, and fraud against your finance team cover most small companies.
- Add internal threats honestly. Departing employees with access, contractors with broad permissions, and well meaning staff who paste secrets into the wrong place all belong here.
- Pull in free intelligence. Government alerts, your cloud provider's advisories, and advisories for the languages and packages you ship are enough to start.
- Record each threat with an owner, the assets it touches, and a review date. A spreadsheet works.
- Run a light hunt each quarter. Search logs for impossible travel logins, new admin grants, and unexpected outbound traffic. Write down what you looked for, even if you found nothing.
- Feed the list into your risk register so threats connect to impacts (see ID.RA-04 and ID.RA-05).
A short example
A 40 person software company lists five external threats: credential stuffing against the customer login, ransomware through a phishing email, a compromised open source dependency, a payment redirection scam aimed at finance, and a misconfigured cloud storage bucket. It lists three internal ones: a departing engineer with repository access, a contractor with broad database rights, and accidental data sharing through a public link.
Each line has an owner and a review date. That is already more than most small companies have, and it takes about two hours to produce.
Evidence to collect
- The threat register with dates, owners, and last review
- Samples of intelligence sources you subscribe to and who reads them
- Notes or tickets from quarterly hunts, including negative results
- A written process for insider risk, such as offboarding checks and access review cadence
Common gaps
- The list was written once for an audit and never updated
- Only external threats appear, so insider and contractor risk goes unrecorded
- Intelligence is received but nobody decides what it means for the company
- Hunts happen informally and leave no record
Quick check
Is a threat list the same as a vulnerability list?
No. A threat is something that can cause harm, such as a criminal group or a careless contractor. A vulnerability is a weakness it could use. ID.RA-01 covers vulnerabilities and ID.RA-03 covers threats. The two meet in ID.RA-04 and ID.RA-05.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 2024), Appendix A, CSF Core: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST CSF 2.0 landing page: https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final
The CSF is voluntary guidance. There is no CSF certification, so nothing here makes a company "CSF certified". You describe your own practices against the outcomes.
