Threat Intelligence Requirements (PIR) Template (Free DOCX).

A PIR is a standing question that your threat intelligence work must answer, tied to a decision someone will make. “Which of our staff accounts appear in stolen login sets this week?” is a PIR. “Monitor the dark web” is not, because nobody can say what they will do with the result.

This matches how NIST describes the goal. NIST SP 800-61 Rev. 3 defines cyber threat intelligence as threat information that has been analyzed or enriched to give the context needed for decision-making. NIST SP 800-150 tells organizations to set goals that support business processes and security policy (section 3.1) before they pick sources (section 3.2).

NIST CSF 2.0 names two outcomes in its Identify function that PIRs serve: ID.RA-02 (cyber threat intelligence is received from information sharing forums and sources) and ID.RA-03 (internal and external threats are identified and recorded). A PIR set is a simple way to show you do both on purpose.

If you are new to the topic, start with Threat Intelligence 101 and Threat Intelligence Platforms 101. Strategic, operational and tactical intelligence are three levels of the same job: leaders need strategic answers, the security operations team needs operational and tactical ones. A good PIR set has some of each.

Fill in eight fields for each PIR. Keep each answer to a line or two. The right-hand column shows an example for a PIR about leaked credentials.

Six steps to write one PIR

1. Name the decision. Start from a choice someone really makes, such as patch order, a takedown request or a supplier call.
2. Write the question so that a yes, a no or a short list answers it.
3. List the people who will act on the answer. If you cannot name one, stop.
4. List the sources. Include one source you already have and one you would need to add.
5. Write the collection plan: who looks, how often, and where the result goes.
6. Set the owner and the review date. Then ask the consumer to confirm in writing.

Blank PIR card

Copy this card for each new PIR.

Ten PIRs are enough for a team of five. With more than that, the weekly work is unlikely to get done. Replace any row that does not fit your business, but keep a spread: some about threats outside your network, some about your own exposure, some for leaders.

PIR-01 to PIR-06 look outside the company: leaked credentials, lookalike domains, brand abuse, leak-site mentions, supplier exposure and access for sale. The roles in the last column are placeholders. Swap in real names.

The “why it matters” field is the harm if the decision is made blind. Add a line to each row when you copy it into your own sheet. The sources and collection plan for each row are in the next section.

Intelligence work is usually described as a loop: direction, collection, processing, analysis, dissemination and feedback. This six-step wording is common in intelligence practice, not a NIST list. The PIR set is the direction step. Outside signals enter at collection, and your consumers’ feedback decides which PIRs stay.

The table gives a starting source and collection plan for each PIR. Where an ATT&CK technique id helps you tag results, it is listed (ids checked on MITRE ATT&CK). “Not mapped” means we did not map that row. Items in [brackets] are for you to fill in.

For leaked credentials and lookalike domains, see the use cases Leaked credential monitoring and Phishing and lookalike domains. For suppliers, see Supply chain and vendor risk. When a PIR fires and becomes an incident, move to the incident response plan template; for PIR-04 use the ransomware response playbook; for PIR-05 use the vendor cyber risk questionnaire; for PIR-08 build scenarios with the tabletop exercise injects.

If you are still deciding how to collect, read Feeds, Platform or Managed Service and test any provider with the Threat Intelligence Evaluation Checklist.

PIRs come from the people who act on them. Talk to five to eight people for 30 minutes each: the security leader, the security operations lead, IT operations, identity, legal or brand, vendor risk and one business owner. Use the same questions every time and write the answers down.

After the interviews

1. Turn each decision you heard into a draft PIR using the blank card.
2. Merge duplicates. If two people want the same answer, it is one PIR with two consumers.
3. Rank the drafts by the harm of deciding blind. Keep the top 10.
4. Send the list back. Ask each consumer to confirm the PIRs that affect them.
5. File the interview sheets. You will repeat three of them at the quarterly review.

Few teams have a full-time analyst. Give each role a small part of the work and keep the rhythm fixed. The hours are yours to set. The roles below are a starting point, not a rule.

A simple rhythm

1. Daily: a 10-minute check of the alerts for PIR-01, PIR-04 and PIR-06.
2. Weekly: a 30-minute meeting. For each PIR that fired, record the decision and who acts.
3. Monthly: check unknown assets (PIR-09) and the metrics table.
4. Quarterly: run the review checklist and send the updated PIR set to consumers.

Collecting these external signals by hand takes time. Teams often use a platform for it. Brandefense Cyber Threat Intelligence and Dark Web Monitoring cover leaked credentials, leak-site mentions and access listings, and Third-Party Risk Management covers supplier exposure.

Count decisions, not reports. A busy team that sends many updates nobody uses is not doing well. Leave the targets empty until you have one quarter of data. To present the results to leaders, use the ROI Framing and Board Report Template.

Set aside two hours once a quarter. Work through the list and tick each line.

Keep a short change log at the end of your PIR sheet: version, date, what changed. The ENISA threat landscape work is described in the ENISA Cybersecurity Threat Landscape Methodology, which is useful background for PIR-08 and PIR-10.

Sources: NIST SP 800-150, NIST CSF 2.0, NIST SP 800-61 Rev. 3, ENISA and MITRE ATT&CK.