THR-08: Threat Analysis
Mechanisms exist to identify, assess, prioritize and document the potential impact(s) and likelihood(s) of applicable internal and external threats.
Renumbered: Formerly THR-10 in SCF 2025.4.
Code reused: In SCF 2025.4 and earlier, THR-08 was Tainting. That control is now THR-14.
Control Question: Does the organization identify, assess, prioritize and document the potential impact(s) and likelihood(s) of applicable internal and external threats?
General (15)
| Framework | Mapping Values |
|---|---|
| AICPA TSC 2017:2022 (used for SOC 2) (source) | A1.2-POF11 CC3.2-POF6 CC3.2-POF9 CC3.4-POF6 |
| COSO 2013 | 8.0 |
| CSA CCM 4.1.0 | TVM-10 |
| IEC TR 60601-4-5 2021 | 4.6.2 |
| IMO Maritime Cyber Risk Management | 3.5.2.3 |
| MPA Content Security Program 5.3.1 | OR-1.2 |
| NAIC Insurance Data Security Model Law (MDL-668) | 4.C(2) 4.C(3) 4.C(5) |
| NIST 800-39 | TASK 2-1 |
| NIST 800-171 R3 (source) | 03.14.03.b |
| NIST 800-171A R3 (source) | A.03.14.03.a |
| NIST CSF 2.0 (source) | ID.RA-04 ID.RA-05 DE DE.AE-07 |
| SWIFT CSF 2025 | 7.4A |
| UL 2900-1 2017 | 12.1(c) |
| UN R155 | 7.2.2.2(b) 7.2.2.2(g) |
| UN ECE WP.29 | 7.2.2.2(b) 7.2.2.2(g) |
US (7)
| Framework | Mapping Values |
|---|---|
| USA Federal C2M2 2.1 | THREAT-2c THREAT-2e THREAT-2g THREAT-2i |
| USA Federal FFIEC ITEH 2016 | II.A.1 II.B III.A |
| USA Federal HIPAA Security Rule NIST SP 800-66 R2 | § 164.306(b)(2)(iv) |
| USA Federal HIPAA Administrative Simplification 2013 | § 164.306(b)(2)(iv) |
| USA Federal SEC Cybersecurity Rule 2023 | 17 CFR 229.106(a) |
| USA Massachusetts 201 CMR 17.00 2008 | 17.03(2)(b) |
| USA New York DFS 23 NYCRR500 2023 Amd 2 | 500.9(b)(1) |
EMEA (7)
| Framework | Mapping Values |
|---|---|
| EMEA CHE FINMA Circular 2023/1 | IV.C.a-63 V-106 |
| EMEA Germany BAIT 2017 | 3.10 5.3 |
| EMEA Germany C5 2026 | OIS-05.02B SIM-06.03B |
| EMEA EU DORA RTS 2024 | Article 23.2(a)(ii) |
| EMEA Israel CDMO 2.0 | Appendix B |
| EMEA LUX CCSF 20/750 2020 | 3.4.6-42 3.4.6-48 |
| EMEA Saudi Arabia IoT CGIoT-1 2024 | 1-4-4 |
APAC (6)
| Framework | Mapping Values |
|---|---|
| APAC Australia ISM June 2026 | ISM-1203 |
| APAC Australia Prudential Standard CPS230 2023 | 16(d) |
| APAC India SEBI CSCRF 2024 | ID.RA.S4 |
| APAC Malaysia RMiT 2025 | 11.3(c) 11.3(i) 12.3(a) |
| APAC Singapore CCOP CII 2026 | 7.3.5 |
| APAC Singapore MAS TRM 2021 | 4.3.2 8.5.1 |
Americas (4)
| Framework | Mapping Values |
|---|---|
| Americas Argentina Reg 132 2018 | E.1.1-1 |
| Americas Canada ITSP-10-171 2025 | 03.14.03.B |
| Americas Canada OSFI B-13 2022 | 3.1 3.1.1 3.1.2 3.1.6 |
| Americas Canada OSFI Self-Assessment Guidance | 3.1.2 3.1.6 |
Capability Maturity Model
Level 0 — Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 — Performed Informally
Threat Management (THR) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with THR domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Threat management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
Level 2 — Planned & Tracked
Threat Management (THR) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Threat management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Threat management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 — Well Defined
Threat Management (THR) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with THR domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with THR domain capabilities are well-documented and kept current by process owners. ▪ A threat management team, or similar function, is appropriately staffed and supported to implement and maintain THR domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of threat management operations (e.g., threat intelligence solution and bug bounty solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with THR domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to identify, assess, prioritize and document the potential impact(s) and likelihood(s) of applicable internal and external threats.
Level 4 — Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 — Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Assessment Objectives
- THR-08_A01 on at least an annual basis, a threat assessment is performed to identify and assess applicable internal and external threats.
- THR-08_A02 a threat catalog captures applicable internal and external threats from the threat assessment.
- THR-08_A03 each item in the threat catalog is prioritized, based on the potential threat to the organization.
Evidence Requirements
- E-THR-07 Threat Analysis
-
Documented evidence of a completed threat analysis.
Threat Management
Technology Recommendations
Micro/Small
- Documented threat analysis
Small
- Documented threat analysis
Medium
- Documented threat analysis
Large
- Documented threat analysis
Enterprise
- Documented threat analysis