--- title: "NAICS AI Industry Classification" slug: "naics-ai-industry-classification" description: "This article describes NAICS AI industry classification, which applies Tags representing NAICS sectors to CAL ATL Reports and objects imported by the ThreatConnect Doc Analysis Playbook App and provides NAICS-specific IR keyword suggestions." tags: ["Analytical Tools"] updated: 2025-07-10T21:27:28Z published: 2025-07-10T21:27:28Z --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # NAICS AI Industry Classification ## Overview The NAICS AI industry classification functionality in ThreatConnect®, powered by the [CAL™ Doc Analysis Service](https://knowledge.threatconnect.com/docs/cal-doc-analysis-service), uses natural language processing (NLP) to identify relevant industries from text and classify the input according to the U.S. Census Bureau’s 2022 (most recent) [North American Industry Classification System (NAICS)](https://www.census.gov/naics/) codes. The industry classifications are captured in [standard Tags](https://knowledge.threatconnect.com/docs/en/applying-tags) representing identified NAICS sectors and subsectors (“NAICS Tags”). NAICS AI industry classification can be leveraged in the [**CAL Automated Threat Library** Source](https://knowledge.threatconnect.com/docs/cal-automated-threat-library-atl), [Intelligence Requirements](https://knowledge.threatconnect.com/docs/intelligence-requirements) (IRs), and the [**ThreatConnect Doc Analysis** Playbook App](https://threatconnect.readme.io/docs/threatconnect-doc-analysis-playbook). ## Before You Start ### User Roles - To view and pivot on NAICS Tags, your user account can have any [Organization role](https://knowledge.threatconnect.com/docs/organization-roles). - To view CAL ATL Reports, your user account can have any Organization role. - To view IRs and IR results, your user account can have any Organization role. - To add NAICS Tags to objects, your user account must have an Organization role of Standard User, Sharing User, App Developer, or Organization Administrator. - To apply suggested NAICS-specific keywords when creating or editing an IR, your user account must have an Organization role of Standard User, Sharing User, App Developer, or Organization Administrator. - To configure and execute Playbooks, your user account must have an Organization role of Standard User, Sharing User, App Developer, or Organization Administrator. ### Prerequisites - Turn on the **CAL Automated Threat Library** feed on the **Feeds** tab of the **TC Exchange™ Settings** screen (must be a System Administrator to perform this action). - To have access to Playbooks on your ThreatConnect instance, turn on the **playbooksEnabled** system setting (must be a System Administrator to perform this action). - To have access to Playbooks in your Organization, turn on the **Enable Playbooks** permission on the **Permissions** tab of the **Organization Information** window when editing your Organization on the **Organizations** tab of the **Account Settings** screen (must be a System Administrator, Operations Administrator, or Accounts Administrator to perform this action). - To allow the **ThreatConnect Doc Analysis** Playbook App to identify and output NAICS codes, verify that your ThreatConnect instance can receive data from CAL (if using an On Premises instance) by ensuring that the **CALHost** system setting has a value of `cal.threatconnect.com` (must be a System Administrator to perform this action). ## NAICS Codes The ThreatConnect NAICS AI industry classification feature recognizes 120 two- and three-digit NAICS codes and their corresponding industry sectors and subsectors, respectively (Table 1). | NAICS Sector | NAICS Subsector | | --- | --- | | NAICS: 11 - Agriculture, Forestry, Fishing and Hunting | - NAICS: 111 - Crop Production - NAICS: 112 - Animal Production and Aquaculture - NAICS: 113 - Forestry and Logging - NAICS: 114 - Fishing, Hunting and Trapping - NAICS: 115 - Support Activities for Agriculture and Forestry | | NAICS: 21 - Mining, Quarrying, Oil and Gas Extraction | - NAICS: 211 - Oil and Gas Extraction - NAICS: 212 - Mining (except Oil and Gas) - NAICS: 213 - Support Activities for Mining | | NAICS: 22 - Utilities | NAICS: 221 - Utilities | | NAICS: 23 - Construction | - NAICS: 236 - Construction of Buildings - NAICS: 237 - Heavy and Civil Engineering Construction - NAICS: 238 - Specialty Trade Contractors | | NAICS: 31 - Manufacturing - Food and Textile | - NAICS: 311 - Food Manufacturing - NAICS: 312 - Beverage and Tobacco Product Manufacturing - NAICS: 313 - Textile Mills - NAICS: 314 - Textile Product Mills - NAICS: 315 - Apparel Manufacturing - NAICS: 316 - Leather and Allied Product Manufacturing | | NAICS: 32 - Manufacturing - Wood and Plastics | - NAICS: 321 - Wood Product Manufacturing - NAICS: 322 - Paper Manufacturing - NAICS: 323 - Printing and Related Support Activities - NAICS: 324 - Petroleum and Coal Products Manufacturing - NAICS: 325 - Chemical Manufacturing - NAICS: 326 - Plastics and Rubber Products Manufacturing - NAICS: 327 - Nonmetallic Mineral Product Manufacturing | | NAICS: 33 - Manufacturing - Metal, Electronics and Other | - NAICS: 331 - Primary Metal Manufacturing - NAICS: 332 - Fabricated Metal Product Manufacturing - NAICS: 333 - Machinery Manufacturing - NAICS: 334 - Computer and Electronic Product Manufacturing - NAICS: 335 - Electrical Equipment, Appliance, Component Manufacturing - NAICS: 336 - Transportation Equipment Manufacturing - NAICS: 337 - Furniture and Related Product Manufacturing - NAICS: 339 - Miscellaneous Manufacturing | | NAICS: 42 - Wholesale Trade | - NAICS: 423 - Merchant Wholesalers, Durable Goods - NAICS: 424 - Merchant Wholesalers, Nondurable Goods - NAICS: 425 - Wholesale Trade Agents and Brokers | | NAICS: 44 - Retail Trade - Auto, Food, Home | - NAICS: 441 - Motor Vehicle and Parts Dealers - NAICS: 444 - Building Material and Garden Equipment and Supplies Dealers - NAICS: 445 - Food and Beverage Retailers - NAICS: 449 - Furniture, Home Furnishings, Electronics, Appliance Retailers | | NAICS: 45 - Retail Trade - Fuel, Other | - NAICS: 455 - General Merchandise Retailers - NAICS: 456 - Health and Personal Care Retailers - NAICS: 457 - Gasoline Stations and Fuel Dealers - NAICS: 458 - Clothing, Clothing Accessories, Shoe, Jewelry Retailers - NAICS: 459 - Sporting Goods, Hobby, Musical Instrument, Book, Miscellaneous Retailers | | NAICS: 48 - Transportation | - NAICS: 481 - Air Transportation - NAICS: 482 - Rail Transportation - NAICS: 483 - Water Transportation - NAICS: 484 - Truck Transportation - NAICS: 485 - Transit and Ground Passenger Transportation - NAICS: 486 - Pipeline Transportation - NAICS: 487 - Scenic and Sightseeing Transportation - NAICS: 488 - Support Activities for Transportation | | NAICS: 49 - Couriers and Warehousing | - NAICS: 491 - Postal Service - NAICS: 492 - Couriers and Messengers - NAICS: 493 - Warehousing and Storage | | NAICS: 51 - Information | - NAICS: 512 - Motion Picture and Sound Recording Industries - NAICS: 513 - Publishing Industries - NAICS: 516 - Broadcasting and Content Providers - NAICS: 517 – Telecommunications - NAICS: 518 - Computing Infrastructure Providers, Data Processing, Web Hosting, Related Services - NAICS: 519 - Web Search Portals, Libraries, Archives, Other Information Services | | NAICS: 52 - Finance and Insurance | - NAICS: 521 - Monetary Authorities-Central Bank - NAICS: 522 - Credit Intermediation and Related Activities - NAICS: 523 - Securities, Commodity Contracts, Other Financial Investments and Related Activities - NAICS: 524 - Insurance Carriers and Related Activities - NAICS: 525 - Funds, Trusts, Other Financial Vehicles | | NAICS: 53 - Real Estate and Rental and Leasing | - NAICS: 531 - Real Estate - NAICS: 532 - Rental and Leasing Services - NAICS: 533 - Lessors of Nonfinancial Intangible Assets (except Copyrighted Works) | | NAICS: 54 - Professional, Scientific, Technical Services | NAICS: 541 - Professional, Scientific, Technical Services | | NAICS: 55 - Management of Companies and Enterprises | NAICS: 551 - Management of Companies and Enterprises | | NAICS: 56 - Administrative and Support and Waste Management and Remediation Services | - NAICS: 561 - Administrative and Support Services - NAICS: 562 - Waste Management and Remediation Services | | NAICS: 61 - Educational Services | NAICS: 611 - Educational Services | | NAICS: 62 - Health Care and Social Assistance | - NAICS: 621 - Ambulatory Health Care Services - NAICS: 622 – Hospitals - NAICS: 623 - Nursing and Residential Care Facilities - NAICS: 624 - Social Assistance | | NAICS: 71 - Arts, Entertainment, Recreation | - NAICS: 711 - Performing Arts, Spectator Sports, Related Industries - NAICS: 712 - Museums, Historical Sites, Similar Institutions - NAICS: 713 - Amusement, Gambling, Recreation Industries | | NAICS: 72 - Accommodation and Food Services | - NAICS: 721 – Accommodation - NAICS: 722 - Food Services and Drinking Places | | NAICS: 81 - Other Services (except Public Administration) | - NAICS: 811 - Repair and Maintenance - NAICS: 812 - Personal and Laundry Services - NAICS: 813 - Religious, Grantmaking, Civic, Professional, Similar Organizations - NAICS: 814 - Private Households | | NAICS: 92 - Public Administration | - NAICS: 921 - Executive, Legislative, Other General Government Support - NAICS: 922 - Justice, Public Order, Safety Activities - NAICS: 923 - Administration of Human Resource Programs - NAICS: 924 - Administration of Environmental Quality Programs - NAICS: 925 - Administration of Housing Programs, Urban Planning, Community Development - NAICS: 926 - Administration of Economic Programs - NAICS: 927 - Space Research and Technology - NAICS: 928 - National Security and International Affairs | ## NAICS Tags The NAICS AI industry classification feature leverages a set of standard [Tags](https://knowledge.threatconnect.com/docs/applying-tags) that represent the available [NAICS codes](/v1/docs/cal-atl-industry-classification#naics-codes) and their corresponding industry sectors and subsectors, respectively. These NAICS Tags are owned by the [**CAL Automated Threat Library** Source](https://knowledge.threatconnect.com/docs/cal-automated-threat-library-atl) and are formatted as `NAICS: <sector or subsector number> - <sector or subsector name>`, as in the following examples: - NAICS: 52 - Finance And Insurance - NAICS: 524 - Insurance Carriers and Related Activities You can see all available NAICS Tags by filtering the **Search: Tags** screen by the “naics” keyword (Figure 1). HintOther users on your ThreatConnect instance may have added NAICS or NAICS-like Tags to other ThreatConnect owners. Filter the selected owners on the **Search: Tags** screen to only the **CAL Automated Threat Library** Source to see the definitive list of NAICS Tags used by the NAICS AI industry classification feature. ![Figure 1_NAICS AI Industry Classification_7.9.2](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_NAICS%20AI%20Industry%20Classification_7.9.2.png) ## CAL Automated Threat Library The [CAL Automated Threat Library (ATL)](https://knowledge.threatconnect.com/docs/cal-automated-threat-library-atl) is designed to help you streamline your cybersecurity intelligence efforts by processing and organizing essential open-source intelligence (OSINT) information into machine-readable components that can be leveraged throughout ThreatConnect. Because the sheer volume of data available can be overwhelming and difficult to sift through, ThreatConnect uses NAICS AI industry classification to automatically add [NAICS Tags](/v1/docs/cal-atl-industry-classification#naics-tags) to Report Groups in the **CAL Automated Threat Library** Source (“CAL ATL Reports”), based on industry information identified in the Name/Summary and Description of each Group. You can leverage NAICS Tags to help you make quick decisions when selecting and excluding resources, allowing you to work more efficiently. You can also use NAICS Tags as avenues for related or further research by pivoting to blogs and reports covering the same industry. For example, if you’re looking at a CAL ATL Report on spam attacks targeting online music platforms and want to see what other information exists on threats to the music industry, you can go to the **Details** screen for the **NAICS: 512 – Motion Picture and Sound Recording Industries** Tag applied to that Report and check out all other CAL ATL Reports with that Tag listed in the **Associated Groups** section of the **Associations** card. You can also view and pivot on these associations in [Threat Graph](https://knowledge.threatconnect.com/docs/threat-graph). HintYou can manually apply NAICS Tags to other ThreatConnect objects.NoteTags for two-digit NAICS codes, representing industry sectors, have a wider range of associated CAL ATL Reports than Tags for three-digit NAICS codes, which represent industry subsectors. ## Intelligence Requirements [Intelligence Requirements](https://knowledge.threatconnect.com/docs/intelligence-requirements) (IRs) leverage NAICS AI industry classification by providing NAICS-specific keyword suggestions based on [the text entered in the **Requirement**field for an IR](https://knowledge.threatconnect.com/docs/creating-intelligence-requirements) (Figure 2). You can include or exclude these suggestions to focus the results returned by the IR. ![Figure 2_NAICS AI Industry Classification_7.9.2](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_NAICS%20AI%20Industry%20Classification_7.9.2.png) After you save your IR, you can add NAICS Tags corresponding to the included NAICS-specific keywords to the IR itself. To do so, view the selected NAICS-specific keywords in the [**Keyword Tracking**](https://knowledge.threatconnect.com/docs/viewing-intelligence-requirement-details#keyword-tracking) section of the **Keyword Tracking & Results** card on the [IR's **Details** screen](https://knowledge.threatconnect.com/docs/viewing-intelligence-requirement-details) and add the corresponding NAICS Tags in the **Tags** section of the [**Details** card](https://knowledge.threatconnect.com/docs/viewing-intelligence-requirement-details#details) (Figure 3). ![Figure 3_NAICS AI Industry Classification_7.9.2](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%203_NAICS%20AI%20Industry%20Classification_7.9.2.gif) The IR’s global results set will include CAL ATL Reports that are broadly associated with the industries in the included NAICS-specific keywords, providing you with related material for further investigation. These results will be included even if your user account does not have access to the **CAL Automated Threat Library** Source. If your user account does have access to the **CAL Automated Threat Library** Source, the IR’s global results set will also include CAL ATL Reports that CAL has labeled as relevant to the included NAICS-specific and related keywords. NoteIf another user has changed or removed a NAICS Tag from a CAL ATL Report, the Report will still be provided as a global result for an IR that includes the NAICS keyword suggestion corresponding to the changed or removed Tag. ## ThreatConnect Doc Analysis Playbook App When using the [**ThreatConnect Doc Analysis** Playbook App](https://threatconnect.readme.io/docs/threatconnect-doc-analysis-playbook) to import data into ThreatConnect, you can select the **AI NAICS Industry Classification** feature (Figure 4) to analyze the text input passed to the App and output an array of identified NAICS codes (**tc.naics.codes**) that may be passed to downstream Apps for further analysis and enrichment. ![Figure 4_NAICS AI Industry Classification_7.9.2](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%204_NAICS%20AI%20Industry%20Classification_7.9.2.png) --- *ThreatConnect® is a registered trademark, and CAL™ and TC Exchange™ are trademarks, of ThreatConnect, Inc.* 20163-01 v.02.A ## Related - [CAL Automated Threat Library (ATL) Supported Blogs](/cal-automated-threat-library-atl-supported-blogs.md) - [CAL Automated Threat Library (ATL)](/cal-automated-threat-library-atl.md)