NIST SP 800-150, the Guide to Cyber Threat Information Sharing, helps an organisation decide what to share, with whom and under what rules. A small team can start by setting a goal, choosing a few sources, agreeing handling rules and turning incoming information into tickets with owners.
What the guide covers
NIST published the guide in October 2016. Its authors are Christopher Johnson, Mark Badger and David Waltermire of NIST, with Julie Snyder and Clem Skorupka of MITRE. It defines cyber threat information as any information that can help an organisation identify, assess, monitor and respond to threats. That includes indicators of compromise, tactics and techniques, suggested defensive actions and incident analysis findings.
It gives guidance on setting sharing goals, identifying sources, defining scope, creating rules for publishing and distributing, engaging with sharing communities and using the information in your wider program.
A starting plan in five steps
1. Set one goal. For example: learn faster about techniques used against companies like ours, and tell peers when we see something new.
2. Choose a few sources. Government advisories, your technology vendors' bulletins and a sector community. More than a handful will drown you.
3. Define scope. Decide what you can share. Indicators and technique descriptions are common. Customer data and internal hostnames are not.
4. Agree handling rules. Use a labelling scheme such as the Traffic Light Protocol so recipients know how far a message can travel. Write down who may approve outbound sharing.
5. Turn input into work. Each item you act on becomes a ticket with an owner, a due date and a result: detection added, control changed, or not applicable.
Make incoming information useful
Raw indicators age fast. Techniques and behaviours last longer. When you read an advisory, pull out three things: behaviours to detect, configuration to change and logs you need to have.
Make outbound sharing safe
- Remove personal data and anything that identifies a customer.
- Share what you saw and when, not what you guess about the source.
- Keep a record of what you shared and with whom.
- Ask legal to review your policy once, then reuse it.
Where it connects to the rest of NIST
The page lists incident response and system and information integrity among the related control families. Sharing is part of response, not a separate hobby.
A common mistake
Teams subscribe to ten feeds, read none of them, and call it a program. A smaller flow with action attached beats a bigger one nobody reads.
Quick check
Is threat information only indicators of compromise?
No. NIST's definition includes tactics and techniques, suggested defensive actions and incident analysis findings too.
Do we have to share outside the company to follow the guide?
The guide helps you decide your own scope. Receiving and using information well is a valid start.
Sources
Last reviewed: 19 October 2026.
