TINT — Threat Intelligence Assessment and Decision Record

Appendix A – Operational Intake & Control Framework

1. Assessment (Security Analysis)

To be completed by the security analyst to determine relevance, exposure, and potential impact.

Assessment Field	Details & Findings
Intelligence ID & Advisory Title	-
Intelligence Type
Summary	Also include Decision & Rationale / Action Required
Relevance	Select items:
Asset Exposure Type (Vulnerability)	Internet-Facing Systems (IFS) Non-Internet-Facing Systems (NIFS) Internet-Interfacing Applications (IIA) Non-Internet-Interfacing Applications (NIIA)
Exploitability (Vulnerability)	Externally (without initial access) Internally (with initial access)
Proof-of-Concept (POC) Available	Yes No Unknown
Exploited in the Wild	Yes No Unknown
Requires Authentication (Vulnerability)	Yes No N/A
CVE ID(s) (Vulnerability)
Vulnerability Type(s)	Select items:
Patch / Fix Status (Vulnerability)	Full patch available Hotfix / interim mitigation only No fix available
Source Type & Date
Reference(s)
Affected Assets / Areas	Select items:
Exposure	Known Potential Not Exposed Unknown
Threat Level	Critical High Medium Low
Existing Controls	Select items:
Control Gap	Select items:
Business Impact	Select items:

To be completed by the CISO or Security Governance Lead to establish organizational posture.

Governance Field	Decision Details
Recommended Response	No Action Monitor Communicate Remediate Control Policy
Priority	Critical High Medium Low
Decision & Rationale	Select items: Select items: Select items: Select items: Select items: Select items:

To be completed by operational owners for task tracking, execution, and validation.

Operational Field	Action Tracking Details
Action Required	Select items:
Owner
Target Date
Communication Recipient	Select items:
Communication Type	Select items:
Regulatory / Compliance Deadline	If applicable — e.g., a CISA KEV remediation due date or other externally mandated deadline, as distinct from the internally-set Target Date above.
Status	Open In Progress Complete Accepted Risk

v1.17 — Version Display & Documentation

v1.16 — Changelog

v1.15 — Share / Resume Work

Generate a shareable link containing the entire current form state, so a second analyst can resume the same record — no backend, entirely encoded in the URL fragment.
Optional soft expiry (1 hour to 30 days, or none) enforced by the tool on load.
Optional AES-256-GCM passphrase encryption (PBKDF2-derived key) for sensitive handoffs.
Loading a link preserves the exact same Intel ID, confirms before overwriting the current form, and never touches any server.

v1.14 — Auto-Summary Generator

"Generate Summary" button builds a draft Summary from whatever's already filled in — fully offline, no AI/API calls.
Four templates tailored to Intelligence Type (General, Vulnerability, Malware/Indicator, Policy/Directive).
Gated on required fields (Title, Exposure, Threat Level) with a clear message if missing.
Optional toggle to also include Decision & Rationale / Action Required.
Output format: a short narrative lead-in followed by compact bullets.
Threat Level, Exposure, and Exploitation values render bold and color-coded in the exported DOCX (falls back to plain text automatically if the summary is hand-edited after generating).

v1.12–1.13 — Field Overhaul

Asset Exposure Type relabeled (IFS / NIFS / IIA / NIIA); Exploitability split out POC Available and Exploited in the Wild as separate fields.
New Vulnerability Type(s) checklist (CSRF, XSS, RCE, etc.), shown only for Vulnerability items.
Source & Date renamed to Source Type & Date, with a new Source Type dropdown.
New repeatable Reference(s) field — exports as real clickable hyperlinks in the DOCX.
Recommended Response converted from single-select to multi-select, with each selected response showing its own Decision & Rationale panel simultaneously.
Summary and Relevance moved up to sit right after Intelligence Type, ahead of technical detail fields.

v1.10–1.11 — Compliance Mapping & Urgency Colors

Existing Controls and Control Gap items tagged with NIST CSF 2.0 and SP 800-53 references; AI/GenAI-specific items tagged with NIST AI RMF instead.
Reference codes render smaller and de-emphasized wherever item text appears.
Exposure, Threat Level, and Priority show a live color-coded badge (red/orange/amber/green) in the form and the export.

v1.7–1.9 — New Fields, Accessibility, Responsive Layout

Owner converted to a dropdown of standard teams (with "Other" override); Communication split into Recipient and Type.
Affected Assets/Areas and Relevance converted to checklist fields.
Intel ID auto-generated as TINT{YY}-{MMDD}{HH}{MM}-{SS}, read-only, with a manual regenerate option; merged into a single "Intelligence ID & Advisory Title" row.
Full accessibility pass: labels on every field, ARIA roles on radio/checkbox groups.
Responsive layout for narrow/mobile viewports.
All example/placeholder content removed — every field starts genuinely empty with hint text.

v1.5–1.6 — Native DOCX Engine & Branding

Renamed to TINT (Threat Intelligence Assessment and Decision Record).
Replaced the HTML-wrapper DOCX export with the docx library for genuine OOXML output — real headers/footers, page numbers, and correct rendering in Word, LibreOffice, and Google Docs alike.
Configurable header (logo, confidentiality notice, classification label) and footer (title, date, DocID, page X of Y), with logo upload and an auto-load option for hosted deployments.
Document Title and Author metadata set automatically on export.

v1.1–1.4 — Customization & Persistence

"Manage Checklist Items" panel to add/remove/reset items in any checklist category, no code editing required.
Config auto-saves to the browser and can be exported/imported as a portable JSON file.
Fixed a checkbox-clearing bug affecting Existing Controls, Control Gap, Business Impact, and Action Required.
Expanded and reworded checklist catalogs across all categories.

v1.0 — Initial Generator

Three-section intake form (Assessment, Decision Record, Action Record) with checklist-driven fields, DOCX export, and print/PDF support.