Conduct cost/benefit analysis
Leadership conducts a cost/benefit analysis that generates a compelling need for information gathering which triggers a Key Intelligence Toptic (KIT) or Key Intelligence Question (KIQ). For example, an adversary compares the cost of cyber intrusions with the expected benefits from increased intelligence collection on cyber adversaries.  
Detectable by Common Defenses (Yes/No/Partial): No
Explanation: Normally, defender is unable to detect. Few agencies and commercial organizations may have unique insights.
Difficulty for the Adversary
Easy for the Adversary (Yes/No): Yes
Explanation: Normal aspect of adversary planning lifecycle. May not be done by all adversaries.
- Mark M. Lowenthal. (n.d.). Ch 4: The Intelligence Process--A Macro Look; Who Does What for Whome?, Intelligence: From Secrets to Policy. Retrieved March 2, 2017.
- Jan P. Herring. (1999). Key Intelligence Topics: A Process to Identify and Define Intelligence Needs. Retrieved May 19, 2017.