What it covers. NIST guidance on establishing and participating in cyber threat information sharing relationships. It covers the benefits and challenges of sharing, setting goals and scope, handling sensitive information and using shared information effectively.
In practice. Organisations define what they want from sharing, join relevant communities such as sector groups or national CSIRT networks, and agree handling rules, for example the Traffic Light Protocol. Received indicators are integrated into detection and shared information is sanitised. Evidence includes sharing agreements, handling procedures and records of how shared intelligence was used.
Common gaps. Typical gaps are consuming feeds without the capacity to act on them, never contributing back and no rules for handling sensitive shared information. Some organisations also hesitate to share for fear of reputational or legal consequences.