Law / regulation
EU AI Act
The European Union's binding, risk-based law for AI systems and general-purpose AI models, with obligations that vary by risk level and by role.
Focus area · Threat intel
Threat Intelligence
Turning threat information into decisions: intelligence requirements, sources, analysis and sharing.
Threat intelligence is analysed information about adversaries, their capabilities and intentions, and the threats they pose, used to support decisions. Raw indicator feeds are data. Intelligence answers a question someone in the organisation needs answered.
Frameworks increasingly expect it. ISO/IEC 27001:2022 introduced a threat intelligence control in Annex A, and regulators expect organisations to understand the threat landscape in their risk assessments. The intelligence lifecycle of direction, collection, processing, analysis, dissemination and feedback keeps the work tied to real needs.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
What does this area cover?
- The intelligence lifecycle
- Starting from stakeholder requirements, not from feeds.
- Strategic, operational and tactical intelligence
- Board-level threat trends, campaign analysis and technical indicators each serve different audiences.
- Threat-led risk assessment
- Using credible threat scenarios to drive control priorities.
- Regulatory and incident context
- What major incidents and enforcement actions mean for your obligations.
Related frameworks
Where does Threat intel show up in the rules?
Certifiable standard
ISO/IEC 27001
The international, certifiable standard for building, running and continually improving an information security management system (ISMS).
Voluntary framework
NIST CSF 2.0
NIST's voluntary, outcome-based framework for understanding, assessing, prioritising and communicating cybersecurity risk, organised into six functions including the new Govern function.