← Cyber Intelligence Foundations
Module 1: Start With the Decision
From Security Data to Intelligence Write an Intelligence Requirement
Module 2: Build an Evidence Base
Collect Evidence With a Plan Evaluate Sources and Claims
Module 3: Analyze, Report, and Improve
Describe Adversary Behavior Without Overclaiming Indicators of Compromise and Their Types Use Indicators With Context Write and Review a Decision-Ready Assessment
Module 4: Turn Intelligence Into Better Defense
Build a Bounded Defensive Hunt Keep Intelligence Useful Over Time
Module 5: Apply Intelligence to Common Security Problems
Build Vulnerability Intelligence That Prioritizes Action Analyze Identity and Social-Engineering Threats Analyze Malware and Ransomware Activity
Module 6: Operate Intelligence as a Capability
Work With Stakeholders and Decision-Makers Govern Intelligence and Handle Information Responsibly Share Structured Intelligence and Automate Safely
Module 6: Operate Intelligence as a Capability

Govern Intelligence and Handle Information Responsibly

Apply classification, access, retention, provenance, and privacy principles to intelligence work.

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.

In this lesson, you will learn to:

  • Apply proportionate classification, access, retention, provenance, and privacy controls to intelligence products and working evidence.

Govern Intelligence and Handle Information Responsibly

This lesson covers the controls that make intelligence trustworthy and safe to operate. You will decide who needs access, how long material should be retained, how source handling affects sharing, and how to protect personal or sensitive information.

Classify for a Real Handling Decision

A label is useful only when it changes behavior. Before sharing intelligence, identify whether it contains personal data, confidential business information, restricted source details, or operationally sensitive observations. Then define who may access it, which channel is approved, whether forwarding is permitted, and when the material should be reviewed or deleted.

Keep provenance with the product. Record where a claim came from, what handling conditions apply, when it was collected, and whether it can be redistributed. A public advisory and a confidential partner report may describe similar activity but have different sharing rules. Do not copy sensitive source content into a broad report simply because it makes the narrative stronger.

Apply minimization. Include the personal or technical detail necessary for the decision and remove unrelated identifiers. Access should follow the requirement, not curiosity. These habits protect people and sources while making the intelligence more defensible when someone asks how a conclusion was reached.

Information handling decision pathA decision path checks sensitivity, purpose, audience, channel, retention, and review before sharing intelligence. INFORMATION GOVERNANCEMake handling part of the productSENSITIVITYwhat is included?PURPOSEwhy is it needed?AUDIENCEwho may access?LIFECYCLEchannel + expirySHARE ONLY WHAT THE DECISION REQUIRES
Information handling decision path — A handling path checks sensitivity, purpose, audience, channel, retention, and review before intelligence is shared.

Preserve Provenance and Review Retention

Provenance is the chain connecting a judgment to the material that supports it. Keep enough information for an authorized reviewer to understand the source, collection time, transformation, analyst, and confidence. If a report contains derived values, explain how they were calculated. If a source cannot be disclosed, describe the limitation and avoid implying a level of independent verification that did not occur.

Retention should serve a purpose. Keep working evidence long enough to support review, incident response, audit, or a legitimate learning need, then follow the organization’s deletion schedule. Do not retain personal data or sensitive source material indefinitely just because storage is cheap. Mark products for review when their assumptions, sources, or operational relevance may have changed.

The course exercise is to create a handling card for the capstone assessment. Include sensitivity, authorized audience, approved channel, source constraints, retention period, owner, and review trigger. A careful analyst treats governance as part of quality, not paperwork added after the analysis is finished.

Provenance chain from source to judgmentA chain connects source, collection, transformation, analysis, and judgment with review and handling notes. PROVENANCEMake the reasoning traceableSOURCEorigin + limitsCOLLECTtime + methodTRANSFORMnormalize + deriveANALYZEreason + qualifyJUDGMENTpublish + handleHandling notes travel with the evidence chain.
Provenance chain from source to judgment — A provenance chain connects source material, collection, transformation, analysis, and the published judgment for authorized review.
← Previous: Work With Stakeholders and Decision-Makers Next: Share Structured Intelligence and Automate Safely →