Intelligence Requirements PIRs, EEIs, and SIRs — The Cascade That Drives Collection
Intelligence requirements are the structured translation of stakeholder decision needs into formal documents that drive collection planning, tasking, and analytic production. The IC cascade is well established — PIRs (Priority Intelligence Requirements), EEIs (Essential Elements of Information), and SIRs (Specific Information Requirements) — and operationally consequential. Without disciplined requirements, collection chases what is collectable rather than what is needed, and analytic production drifts away from consumer decisions. This is the entry-tier course in the Collection-band of The Analyst Stack at $299.
This course covers intelligence requirements construction applied to cyber intelligence — building PIRs from stakeholder decisions, deriving EEIs that operationalize each PIR, structuring SIRs that drive specific collection tasking, and integrating the requirements cascade with Stakeholder Analysis (upstream) and Collection Management (downstream). Foundational reading for any analyst whose work depends on knowing what to collect and why.
What You'll Learn
Intelligence requirements construction for cyber intelligence
- Priority Intelligence Requirements (PIRs) — top-level questions decision-makers need answered to make specific decisions. How to build PIRs that are scoped, time-bound, and aligned to consumer decisions rather than topics. The structural conventions that distinguish operational PIRs from generic "things we should know."
- Essential Elements of Information (EEIs) — the sub-questions that each PIR decomposes into. Operational tradecraft for EEI construction: scope, specificity, mutual exclusivity, and collective exhaustiveness. The level at which collection planning starts to engage.
- Specific Information Requirements (SIRs) — concrete information needs that drive specific collection tasking. The granularity level at which collectors operate. How to write SIRs that produce collected information actually answering the parent EEI and PIR.
- The Cascade Integrity Discipline — maintaining the PIR → EEI → SIR cascade so collected information feeds back up to answer the original consumer decision question. The discipline that prevents requirements drift, scope creep, and the broken-cascade pattern that produces collected information nobody knows what to do with.
- Cyber-Domain Requirements Construction — building requirements for cyber intelligence specifically: adversary capability questions, infrastructure tracking, campaign attribution, threat-landscape forecasts, and incident-driven dynamic requirements that differ structurally from steady-state strategic requirements.
- Requirements Workflow Integration — how requirements integrate with Stakeholder Analysis upstream (where decisions come from) and Collection Management downstream (where requirements drive tasking). The closing-the-loop discipline for requirements review and refresh.
Course Content
The Structured Translation of Decisions into Collection-Drivable Form
The intelligence requirements cascade is one of the cleanest pieces of IC tradecraft: a decision generates a PIR, which decomposes into EEIs, which decompose into SIRs that collection can task against. Collected information satisfies SIRs, which roll up to answer EEIs, which roll up to answer PIRs, which support consumer decisions. When the cascade works, intelligence production is end-to-end aligned to consumer reality. When it breaks — and in practice it breaks frequently in cyber intelligence functions that have not invested in requirements discipline — the result is collected information disconnected from decisions, analytic products disconnected from consumers, and operational drift toward whatever is easy rather than what is needed.
This course operationalizes the IC requirements cascade for cyber intelligence work. PIR construction calibrated to the cyber-domain decisions that security executives, CISOs, fraud and risk leaders, and operational consumers actually make. EEI decomposition tradecraft for the specific cyber-intelligence problem types. SIR construction at the granularity collectors can act on. Cascade-integrity discipline that maintains end-to-end alignment as requirements evolve. At $299 this is the entry-tier course in the Collection band — accessible as standalone introduction or as on-ramp to the broader collection-discipline curriculum and The Analyst Stack as a whole.
Entry-Tier Component of the Collection Band in The Analyst Stack
This Intelligence Requirements course is the entry-tier component of The Analyst Stack ($6,999) collection-discipline band — at $299 it is the most accessible entry into the band. Pairs operationally with Stakeholder Analysis ($399) upstream, Collection Management ($399) downstream, and Source Evaluation ($399) for validation. Together with the analytic-method band, the strategic-assessment band, the CCIA flagship, and additional Analyst Stack components: comprehensive day-one analyst capability at substantial bundle savings.
Common Questions
Intelligence Requirements — FAQ
Cyber threat intelligence analysts building or maintaining requirements documents, CTI program leads structuring requirements processes for their teams, security operations leaders translating internal decisions into formal intelligence requirements, IC analysts entering or transitioning into cyber portfolios, MSSP / consulting analysts managing client requirements, and analytic methodology trainees building the upstream collection discipline.
Priority Intelligence Requirements (PIRs) are top-level decision-driven questions. Essential Elements of Information (EEIs) are the sub-questions each PIR decomposes into. Specific Information Requirements (SIRs) are concrete information needs at the granularity collectors can task against. The cascade structures the translation from consumer decisions to operational collection tasking, with feedback going the other direction as collected information rolls up to satisfy SIRs, EEIs, and ultimately PIRs.
At $299 this course is the entry-tier of the Collection band. The pricing reflects the focused scope — it covers the requirements-cascade discipline itself rather than the broader stakeholder, collection, or source-evaluation tradecraft. The other Collection-band components ($399 each) expand the discipline laterally. Most learners benefit from the full collection-band combination, with this Intelligence Requirements course as the natural starting point.
None formal. Most learners benefit from the full collection-discipline band: Stakeholder Analysis ($399), Collection Management ($399), and Source Evaluation ($399). The four components are operationally interconnected.
Yes. This course is one of 10 components of The Analyst Stack ($6,999) — the entry-tier component of the collection-discipline band. Contributes to the CCIA (Certified Cyber Intelligence Analyst) certification track, which references intelligence requirements tradecraft throughout its curriculum.
Treadstone 71 has built and refined intelligence requirements processes for cyber intelligence programs continuously for two decades — PIR construction tied to executive and operational decisions, EEI decomposition disciplined for cyber-domain problem types, SIR tradecraft at the granularity collectors can act on. The course reflects operational experience designing requirements processes across financial services, defense industrial base, federal civilian agencies, MSSP and consulting practices, and critical infrastructure operators. Veteran-owned, woman-led, NICCS-listed, IAFIE-aligned, operational since 2002.
Translate Decisions into Collection-Drivable Form
Self-paced. Intermediate-level. PIR → EEI → SIR cascade applied to cyber intelligence requirements construction. Entry-tier of the Collection band. Scroll up to enroll, or consider The Analyst Stack to combine this with the full collection-discipline band and the broader analyst methodology curriculum.
$299 USD Self-paced · Intermediate · Lifetime access · CPE credits