{"data":{"id":"PM-16","name":"Threat Awareness Program","family":"PM","family_name":"Program Management","withdrawn":false,"description":"Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.","supplemental_guidance":"Because of the constantly changing and increasing sophistication of adversaries, especially the advanced persistent threat (APT), it may be more likely that adversaries can successfully breach or compromise organizational systems. One of the best techniques to address this concern is for organizations to share threat information, including threat events (i.e., tactics, techniques, and procedures) that organizations have experienced, mitigations that organizations have found are effective against certain types of threats, and threat intelligence (i.e., indications and warnings about threats). Threat information sharing may be bilateral or multilateral. Bilateral threat sharing includes government-to-commercial and government-to-government cooperatives. Multilateral threat sharing includes organizations taking part in threat-sharing consortia. Threat information may require special agreements and protection, or it may be freely shared.","enhancements":[{"id":"PM-16(01)","name":"Automated Means for Sharing Threat Intelligence","statement":"Employ automated mechanisms to maximize the effectiveness of sharing threat intelligence information.","baselines":[]}],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"nist_800_53":{"rev5":{"id":"PM-16","name":"Threat Awareness Program","description":"Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.","discussion":"Because of the constantly changing and increasing sophistication of adversaries, especially the advanced persistent threat (APT), it may be more likely that adversaries can successfully breach or compromise organizational systems. One of the best techniques to address this concern is for organizations to share threat information, including threat events (i.e., tactics, techniques, and procedures) that organizations have experienced, mitigations that organizations have found are effective against certain types of threats, and threat intelligence (i.e., indications and warnings about threats). Threat information sharing may be bilateral or multilateral. Bilateral threat sharing includes government-to-commercial and government-to-government cooperatives. Multilateral threat sharing includes organizations taking part in threat-sharing consortia. Threat information may require special agreements and protection, or it may be freely shared.","related_controls":["IR-04","PM-12"],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"Cross-organization information-sharing capability added. Discussion expanded for APT awareness."}},"compliance_mappings":{"iso_27001_2022":["7.2","A.5.6","A.5.7"],"iso_27002_2022":["5.6","5.7"],"cobit_2019":[],"pci_dss_v4":[],"nist_csf_2":["DE.AE-03","DE.AE-06","DE.AE-07","GV.RM-05","ID.RA-02","ID.RA-03","ID.RA-05","RS.CO-03"],"cis_controls_v8":[],"soc2_tsc":[],"finos_ccc":[],"iso_42001_2023":[],"iec_62443":[],"asd_e8":[],"nis2":["Art. 29"],"apra_cps_234":[],"mas_trm":["12"],"pra_op_resilience":[],"bsi_grundschutz":[],"anssi":[],"osfi_b13":[],"finma_circular":[],"gdpr":[],"dora":["Art.13(1)","Art.45(1)"],"bio2":["5.6","5.7"],"rbi_csf":["Annex1.13"],"fisc":[],"lgpd_bcb":[],"hkma_tme1":["TME1.7.4","TME1.7.5"],"mlps_2":["8.1.7.2"],"dnb_good_practice":["DNB.3.1"],"cra":["CRA.II.5"],"swift_cscf":["SWIFT.7.4A"],"cbb_tm":["TM-3","TM-11","TM-12","TM-13"],"cbuae":["CR-3"],"nca_ecc":["1-10","2-13"],"sama_csf":["3.6"],"bog_cisd":["CISD-VII"],"bom_ctrm":["2.1","4.1","5.3"],"cbe_csf":["CD-1","CTO-9"],"cbn_csf":["Part3.5","Part4"],"sa_js2":["JS2-7.3","JS2-7.6"],"bcbs_239":["Principle 14"],"bot_cyber":["Ch3.1","Ch4.1","Ch7.1","Ch8.1"],"cpmi_pfmi":["CG.DE","CG.SA","CG.TE"],"ecb_croe":["CROE.2.4","CROE.2.6.2","CROE.2.7.1","CROE.2.7.2","CROE.2.8.2"],"ffiec_is":["I.C","II.A","II.A.1","III.A"],"iosco_cyber":["DET-3","ID-3","LE-3","RR-5","SA-1","SA-2"],"nydfs_500":["500.9","500.10"],"sebi_cscrf":["DE.DP","ID.RA","RS.CO","SOC"],"nerc_cip":[],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":["THREAT"],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":[],"fips_140":[],"cbest":["CBEST.2"],"tiber_eu":["TIBER.GTL","TIBER.TTI"],"pci_hsm":[],"common_criteria":[],"isae_3402":[],"fca_sysc_13":[],"fda_21_cfr_11":[],"fda_cyber":["MON-1","MON-3","TM-1"],"hitrust_csf":[],"iso_27799":[],"lloyds_ms":["CRM.2"],"naic_ds":["4A"],"nhs_dspt":["NDG-6.3","NDG-9.8"],"pra_ss1_23":[],"solvency_ii":[],"owasp_masvs_v2":[],"csa_ccm_v4":["GRC-08"],"csa_aicm":["GRC-08","GRC-15"],"ccss_v9":[],"mica":[],"basel_sco60":["SCO60.73","SCO60.84"],"bssc":[],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[],"metadata":{"last_reviewed":"2026-10-03","review_notes":"Generated from NIST SP 800-53 Rev 5 with compliance mappings extracted from framework-coverage data 2026-10-03: nist_csf_2 DE.AE-03, DE.AE-06, ID.RA-05 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-031","SP-035","SP-038","SP-046","SP-048","SP-049"]}}