The always-on layer beneath the PIRs: baseline topics collected continuously because the landscape demands it, even when no priority requirement is active.
| GIR | Standing requirement | Primary feed/surface |
|---|---|---|
| GIR-1 | Malaysian threat landscape baseline — all sectors, all sources | MISP-MY · Threat Watch |
| GIR-2 | Regional (ASEAN/SEA) activity with spillover potential into MY | MISP-MY |
| GIR-3 | Global ICS/OT threat developments | MISP-ICS-OT · OT Watch |
| GIR-4 | Ransomware ecosystem changes — groups, affiliates, tooling, leak-site churn | Ransomware Tracker |
| GIR-5 | Malaysian community & capability developments — events, regulation (CSA 2024, PDPA), education | Events · Resources |
PIR vs GIR in one line: PIRs answer “what matters most right now”; GIRs answer “what we never stop watching.”