Threat Intel Policy & Governance Pack

Six governance documents you can adopt, edit and sign, covering the part of a threat intelligence programme that regulators ask about and practitioners rarely write down.

Information marking and handling policy — TLP 2.0 and PAP, the two marking systems that govern what you may do with intelligence you received and what your machines may do with it.

The handling matrix — eight coherent marking combinations and exactly what each one permits. This is the document that turns "TLP:AMBER" from a colour into an instruction.

Bilateral sharing agreement template — for the arrangements that sit outside a formal community.

Retention and disposal policy, including personal-data handling, because intelligence about a breach frequently contains personal data and the retention clock is not the same one your logs run on.

Community membership register — and this is the one that earns the price. Both DORA Article 45 and NIS2 Article 29 make joining and leaving an information-sharing arrangement separately notifiable to your competent authority. The register is the evidence that you notified, and it is the artifact an examiner asks for that nobody has prepared.

AI and agent access policy for the platform — governing machine access to a repository full of adversary-authored text. An agent with retrieval over your threat intelligence platform is reading content an attacker wrote, with tools attached. Nobody else is selling a policy for that, and the exposure is real rather than theoretical.

PAP is the marking almost nobody writes down, and automated systems breach it without anyone deciding to — an enrichment pipeline that resolves a domain has just told the adversary you are looking. The pack makes that a policy decision rather than an accident.

Mapped to DORA, NIS2 and ISO 27001 so the documents can be cited in an audit rather than merely existing.

Ships as a print-ready PDF and an editable Word master — these are meant to be adopted under your own letterhead.