API 1164 ID.RA-3: ID.RA-3 Threat catalogue with consistent identification and categorisation by vector and actor

The plan must require a catalogue of the threats identified against IAC segregated environments with consistent criteria for identifying them and for assessing and categorising them (type, credibility); identification through assessment activities such as threat modelling, penetration tests, red and blue teams and internal audits; categorisation as current or emerging; assessment of the attack vector origin (internal, external, supply chain) and of the actions of people (inadvertent acts, inaction, deliberate acts); recording of each threat's identifier, assessment results and categorisation; identification of disclosure and modification risk to the catalogue, with classification and protection to match; and periodic refresh of the catalogue. At the Enhanced and Extended Profiles threat intelligence is assessed for relevance to environments of that profile.