API 1164 ID.RA-2: ID.RA-2 Threat intelligence catalogued, classified and protected; external forums used at higher profiles

The plan must require that all threat intelligence received is catalogued whatever its source, that the disclosure and modification risk to the catalogue is identified, that the catalogue is classified by that risk, keeps the classification label the source assigned and is protected according to its classification and the source's requirements. At the Extended Profile risk management processes must draw on external threat intelligence sharing forums and sources and share intelligence received from outside with defined personnel.