# PM-16 Threat Awareness Program

NIST SP 800-53 control. Family: PM Program Management. Function: preventative. In no baseline. Mapping licence: CC BY-SA 4.0.

Statement: Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.
Guidance: Because of the constantly changing and increasing sophistication of adversaries, especially the advanced persistent threat (APT), it may be more likely that adversaries can successfully breach or compromise organizational systems. One of the best techniques to address this concern is for organizations to share threat information, including threat events (i.e., tactics, techniques, and procedures) that organizations have experienced, mitigations that organizations have found are effective against certain types of threats, and threat intelligence (i.e., indications and warnings about threats). Threat information sharing may be bilateral or multilateral. Bilateral threat sharing includes government-to-commercial and government-to-government cooperatives. Multilateral threat sharing includes organizations taking part in threat-sharing consortia. Threat information may require special agreements and protection, or it may be freely shared.

## Enhancements (1)
- PM-16(01) Automated Means for Sharing Threat Intelligence
Each enhancement's statement: /api/v1/controls/PM-16?fields=enhancements

## Patterns that use it (6)
- Critical (2): SP-035 Offensive Security Testing; SP-048 Offensive AI and Deepfake Defence (draft)
- Important (4): SP-031 Security Monitoring and Response; SP-038 Vulnerability Management and Patching; SP-046 External Attack Surface Management; SP-049 AI in Security Operations (draft)

## Clauses by framework (40 frameworks)
- iso_27001_2022: 7.2, A.5.6, A.5.7. OSA's own, not in NIST's crosswalk: 7.2, A.5.6
- iso_27002_2022: 5.6, 5.7
- nist_csf_2: DE.AE-03, DE.AE-06, DE.AE-07, GV.RM-05, ID.RA-02, ID.RA-03, ID.RA-05, RS.CO-03. OSA's own, not in NIST's crosswalk: GV.RM-05, RS.CO-03
- nis2: Art. 29
- mas_trm: 12
- dora: Art.13(1), Art.45(1)
- bio2: 5.6, 5.7
- rbi_csf: Annex1.13
- hkma_tme1: TME1.7.4, TME1.7.5
- mlps_2: 8.1.7.2
- dnb_good_practice: DNB.3.1
- cra: CRA.II.5
- swift_cscf: SWIFT.7.4A
- cbb_tm: TM-3, TM-11, TM-12, TM-13
- cbuae: CR-3
- nca_ecc: 1-10, 2-13
- sama_csf: 3.6
- bog_cisd: CISD-VII
- bom_ctrm: 2.1, 4.1, 5.3
- cbe_csf: CD-1, CTO-9
- cbn_csf: Part3.5, Part4
- sa_js2: JS2-7.3, JS2-7.6
- bcbs_239: Principle 14
- bot_cyber: Ch3.1, Ch4.1, Ch7.1, Ch8.1
- cpmi_pfmi: CG.DE, CG.SA, CG.TE
- ecb_croe: CROE.2.4, CROE.2.6.2, CROE.2.7.1, CROE.2.7.2, CROE.2.8.2
- ffiec_is: I.C, II.A, II.A.1, III.A
- iosco_cyber: DET-3, ID-3, LE-3, RR-5, SA-1, SA-2
- nydfs_500: 500.9, 500.10
- sebi_cscrf: DE.DP, ID.RA, RS.CO, SOC
- doe_c2m2: THREAT
- cbest: CBEST.2
- tiber_eu: TIBER.GTL, TIBER.TTI
- fda_cyber: MON-1, MON-3, TM-1
- lloyds_ms: CRM.2
- naic_ds: 4A
- nhs_dspt: NDG-6.3, NDG-9.8
- csa_ccm_v4: GRC-08
- csa_aicm: GRC-08, GRC-15
- basel_sco60: SCO60.73, SCO60.84
OSA's mapping for iso_27001_2022 and nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/PM-16
- Clauses only: /api/v1/controls/PM-16?fields=mappings
- Page for people: /controls/pm-16/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.