home/glossary/Tactics, Techniques, and Procedures

Tactics, Techniques, and Procedures

nounid 163396·updated Aug 30, 2026
verified

The behavior of an actor. A tactic is the highest-level description of the behavior; techniques provide a more detailed description of the behavior in the context of a tactic; and procedures provide a lower-level, highly detailed description of the behavior in the context of a technique. [14]

MWE

Source

document
NIST Special Publication 800 NIST SP 800-172r3 Enhanced Security Requirements for Protecting Controlled Unclassified Information
publisher
NIST
found in
Appendix A. Acronyms
discovery
AuthoritativeImport

Proposed during multiword review of this document in the CKI mapping queue.

Attested in

No recorded attestations. They are written when an MWE tagging stage is completed, stamped with the pack version and the document’s digest.

Classifications

Entity Type

Threat85%llm-generatedllm:claude-haiku-4-5

Sensitivity

Internal70%llm-generatedllm:claude-haiku-4-5

Information Class

unclassified

Variants

acronym
TTP

Framework definitions

NIST SP 800-172r31 senseview framework →
§1 · glossary
The behavior of an actor. A tactic is the highest-level description of the behavior; techniques provide a more detailed description of the behavior in the context of a tactic; and procedures provide a lower-level, highly detailed description of the behavior in the context of a technique. [14]
Attribution from the CKI glossary mapping stage (acronym list + glossary)

Outgoing relationships

No outgoing triples
This term is not the subject of any RDF-style relationship yet.

Incoming relationships

No incoming triples
No other term currently asserts a relationship to this one.