Control A.5.7Threat intelligence
What it means in practice
Information relating to information security threats must be collected and analysed to produce threat intelligence.
New in the 2022 edition, and one of the eleven additions. The control asks for three levels: strategic — the changing threat landscape and the kinds of attacker interested in an organisation like yours; tactical — the methods, tools and technologies being used; and operational — the details of specific attacks, including indicators.
The word that carries the requirement is analysed. Collecting feeds is not threat intelligence; intelligence is what remains after the collection has been assessed for relevance to this organisation and turned into something a decision can be made from.
The common failure is a subscription with no consumer. Intelligence has to feed something — the risk assessment under clause 6.1.2, detection rules under A.8.16, vulnerability prioritisation under A.8.8, or supplier assessment. Where it feeds nothing, the control is implemented in form and the organisation is no better informed than it was.
How to put this in place
Knowing which threats are aimed at organisations like yours lets the ISMS tune its defences to real attacks. Without a routine, feeds pile up unread and the risk assessment stays a guess.
- Pick a few sources that suit your size, such as national authority alerts, vendor advisories and your security provider's reports, covering both broad trends and specific technical indicators.
- Name the person who reviews them and the cycle, for example weekly.
- Decide what counts as relevant and what happens next, for example a patch ticket or a new detection rule.
- Log what was reviewed and the action taken.
- Feed significant findings into the risk assessment and review the sources yearly.
Evidence an auditor usually looks for: the list of sources, a log or tickets showing intelligence reviewed and acted on, and risk assessment updates that cite threat information.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Word
Risk Assessment Methodology & Scoring Model
in Information Security Risk ManagementIts Framework References list this control. Supported by: Inputs: threat information used to rate likelihood. - Word
Risk Identification & Assessment Operating Procedure
in Information Security Risk ManagementIts Framework References list this control. Supported by: Stage 1: threat intelligence as a source. - Excel
Cyber Risk Scenario Library
in Information Security Risk ManagementIts Framework References list this control. Supported by: Threat List; Instructions step 7 (new threat intelligence becomes a scenario or a change of likelihood).