ASD Essentials IT.IDE-04.1 Feed Continuously Reviewed Threat Intelligence and Weaknesses into Risk Assessments
What it says
Identify relevant weaknesses, malicious actor techniques and cyber threat behaviours when undertaking risk assessments and review these inputs on a continuous basis.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishFactors the weak spots, attacker methods and behaviours relevant to the organisation into every risk assessment, and reviews them continually.
Each risk assessment should name the real threats the organisation faces. That means the weaknesses in its systems, the methods attackers use against its sector, and how attackers behave. To meet this, each threat is linked to the systems it could hit, and shapes how the risk is rated and handled. Threats are reviewed all the time, so assessments keep up. For example, a new attack on the remote access system raises that system's risk.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?Visibility and response: a capability domain, which ASD applies across all phases from the start.
Why it matters
Assessments based on generic or old threat information understate the danger, so a known attack on a key system can go unhandled. Leaders set priorities on a false picture, and intrusions are more likely to succeed and be found late.
How to implement
The risk management lead should change the assessment method and template so each assessment lists the weaknesses, attacker methods and threat behaviours considered, with sources.
Send back any with missing or generic entries.
The threat intelligence lead should gather inputs from ASD alerts and advisories, sector threat-sharing groups and vendor security notices.
Add findings from internal scans, tests and incidents, keeping what is relevant to the sector and assets.
Security architects and system owners should link each relevant weakness, attacker method and behaviour to the assets it could affect.
Use a public catalogue of attacker methods, such as MITRE ATT&CK, and record where monitoring would miss it.
Risk owners should use these linked inputs to rate likelihood and choose treatments, and record which inputs shaped each decision.
For example, reassess likelihood when a working attack exists for an unfixed weakness.
The threat intelligence lead should review the threat inputs continuously, at a frequency set by risk, and log each change with its date and reason.
Pass important changes to the affected system or risk owner to reassess.
Keep it running
The threat intelligence team (who track current threats) or security operations follows new weaknesses, active attacks and attacker behaviour in the sector. They alert system and risk owners as soon as a change affects an assessment. Note whether monitoring would catch each attack method, and record gaps as risks. This action applies organisation-wide, in every priority phase, so widen the assets and threat sources as more systems come into scope.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for recent risk assessments from different systems and business areas.
Look at
Whether each names specific weaknesses, attacker methods and behaviours, or only generic threats or none.
Good evidence
Each assessment cites the weaknesses, sector attacker methods and threat behaviours that apply, with sources.
- Check 2 of 5What an auditor asks for
Ask for
Ask how threat information is gathered and brought into risk assessments.
Look at
Whether a set process names sources and owners, and recent assessments actually followed it.
Good evidence
A written process brings current, relevant threat information into every assessment.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the record linking threats to assets, such as a table of methods by system.
Look at
Whether inputs are only listed in general terms, or linked to specific assets and monitoring gaps.
Good evidence
Relevant inputs are linked to the assets they affect, and monitoring gaps are recorded.
- Check 4 of 5What an auditor asks for
Ask for
Ask for risk register entries and treatment decisions, with the threat inputs each relied on.
Look at
Whether ratings and treatments trace to specific inputs, or gathered threat information went unused.
Good evidence
Each risk rating and treatment reflects the threat inputs that apply to the asset.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the change log of threat inputs and recent requests to reassess.
Look at
Whether inputs go unreviewed, are reviewed only now and then, or updates never reach affected assessments.
Good evidence
Inputs are reviewed continuously, and changes reach the affected assessments in time.
ASD indicators of good practice (9)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(3)
- NE-1Risk assessments do not reference relevant weaknesses, malicious actor techniques and cyber threat behaviours.
- NE-2No process exists to incorporate threat information into risk assessment activities.
- NE-3Current weaknesses, malicious actor techniques and cyber threat behaviours that are relevant to the organisation are not reviewed or updated.
Partially effective(3)
- PE-1Risk assessments reference threat intelligence but coverage is limited to well-known or generic threats.
- PE-2Threat information is considered but not systematically mapped to organisational assets or detection gaps.
- PE-3Current weaknesses, malicious actor techniques and cyber threat behaviours that are relevant to the organisation are reviewed or updated, but are not used to inform risk assessments or are reviewed only on an ad hoc basis.
Fully effective(3)
- FE-1Risk assessments incorporate and reference relevant weaknesses, malicious actor techniques relevant to the sector, and cyber threat behaviours.
- FE-2Relevant weaknesses, malicious actor techniques and cyber threat behaviours are systematically related to applicable assets and used to inform risk treatment decisions.
- FE-3Current weaknesses, malicious actor techniques and cyber threat behaviours relevant to the organisation are reviewed or updated on a continuous basis at a frequency that enables noted changes to inform risk assessments.
Mappings
Closest match in ISO/IEC 27001: A.5.7, Threat Intelligence Collection and Analysis, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.7.
IT.IDE-04.1 requires relevant weaknesses, malicious actor techniques and cyber threat behaviours to be identified as inputs to risk assessments and reviewed on a continuous basis. Identifying actor techniques and threat behaviours relies on the same collection and analysis of threat information that ISO/IEC 27001 Annex A 5.7 requires to produce threat intelligence. IT.IDE-04.1 is directed specifically at risk assessment and also covers weaknesses, while Annex A 5.7 addresses producing threat intelligence for any purpose.
This control partially overlaps A.8.8.
IT.IDE-04.1 requires relevant weaknesses, malicious actor techniques and cyber threat behaviours to be identified when undertaking risk assessments and reviewed on a continuous basis. Its identification of weaknesses overlaps with ISO/IEC 27001 Annex A 8.8, which requires information about technical vulnerabilities to be obtained and the organisation's exposure to them evaluated. Annex A 8.8 also requires appropriate measures to be taken against identified vulnerabilities, while IT.IDE-04.1 additionally considers threat actor behaviour as a risk assessment input.
ASD Information Security Manual: 4 mappings
This control partially overlaps ISM-1203.
IT.IDE-04.1 requires risk assessments to consider relevant weaknesses, malicious actor techniques and threat behaviours, reviewed continuously; ISM-1203 requires the assessment those inputs feed, with system owners conducting a threat and risk assessment for each system.
- ISM-1526System Owners Continuously Monitor Security and Manage Threats, Risks and ControlsPartially overlaps
This control partially overlaps ISM-1526.
IT.IDE-04.1 requires risk assessments to consider relevant weaknesses, malicious actor techniques and threat behaviours, reviewed continuously; ISM-1526 overlaps on ongoing review, with system owners continuously monitoring each system's security and managing its cyber threats and risks.
This control partially overlaps ISM-1921.
IT.IDE-04.1 requires risk assessments to consider relevant weaknesses, malicious actor techniques and threat behaviours, reviewed continuously; ISM-1921 is a narrower case, frequently assessing the likelihood of compromise where working exploits exist for unmitigated vulnerabilities.
This control partially overlaps ISM-2116.
IT.IDE-04.1 requires risk assessments to draw on relevant weaknesses, malicious actor techniques and threat behaviours; ISM-2116 puts cyber threat intelligence services to a different use, supporting detection of cyber security events and identification of incidents.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.