ISO 27001 Control A.5.7: Threat Intelligence

Threat intelligence sounds like something for governments and banks, with analysts in dark rooms and expensive subscription feeds. In ISO 27001 it is much more down to earth. A.5.7 asks a plain question: do you know what is likely to attack you, and do you let that knowledge shape your decisions? It is the seventh of 37 organizational controls in Annex A, and one of the new controls introduced in the 2022 revision.

You do not need a threat research team to meet it. You need a few good sources, someone who reads them with your own business in mind, and a way to turn what they find into action. A raw feed of indicators that nobody looks at is not intelligence. A short monthly note saying “these three threats matter to us, and this is what we are doing about them” is.

What the control requires

Annex A control 5.7 of ISO 27001:2022 states that information relating to information security threats shall be collected and analysed to produce threat intelligence.

The key elements:

• Information relating to threats - data about attackers, their methods, the vulnerabilities they exploit and the targets they choose
• Collected - gathered from sources that are relevant, reliable and affordable
• Analysed - interpreted in the context of your organization, so that it becomes something you can use
• To produce threat intelligence - the output is a judgement and a recommendation, not a pile of data

A.5.7 is a preventive, detective and corrective control in ISO/IEC 27002:2022, because intelligence can help you stop an attack, spot one in progress and respond better afterwards. Annex A states the control; ISO 27002 gives guidance, including that threat intelligence can be considered at three layers: strategic (the changing threat landscape, such as types of attackers), tactical (attacker methods, tools and technologies) and operational (details of specific attacks, including technical indicators). Good intelligence is relevant, insightful, contextual and actionable.

How to implement threat intelligence

Define what you need to know

Begin with your own situation. Which assets matter most? Who might want them? What have similar organizations suffered recently? A software company holding customer data, a clinic with patient records and a manufacturer with industrial control systems face different threats, and your intelligence should reflect that. Write two or three questions down, for example: “Which ransomware groups target companies like ours?”, “Which vulnerabilities in our key platforms are being exploited right now?” and “Which phishing themes are being used in our region?” These questions steer your collection and keep it manageable. They also link to your information security risk assessment, which should be informed by the threats you identify.

Collect from a few good sources

Sources fall into familiar groups:

• Public and government sources - national cyber security centres, CERT advisories and law enforcement alerts, introduced in contact with authorities
• Community sources - sector information sharing groups and the forums described in contact with special interest groups
• Vendor sources - security bulletins from the suppliers of your operating systems, cloud platforms and key applications
• Commercial feeds - paid services, useful for larger organizations but rarely essential for small ones
• Internal sources - your own logs, blocked phishing attempts, incident records and near misses, often the most relevant data you have

Start with free, high-quality sources and add paid ones only when you can show a gap. Record the sources you use, why you chose them and who reads them.

Analyse and make it actionable

This is the step that turns information into intelligence. For each item ask: does it affect us, how likely and how serious would it be, and what should we do? The answer might be to prioritize a patch, tighten an email filter, brief staff on a new scam, review a supplier or simply note that the threat is not relevant. Keep a short log of items reviewed and decisions taken, with an owner and date. A spreadsheet works.

Match the output to the audience. Management wants a concise strategic view that informs budget and priorities, with a few lines each quarter. Technical staff want tactical and operational detail they can apply to configuration and monitoring. If everyone receives the same long feed, nobody reads it.

Feed it into the rest of the ISMS

Intelligence is only valuable when it changes something. Make the connections explicit:

• Update the risk register when a new threat materially changes likelihood or impact, in line with clause 6.1, Actions to address risks and opportunities
• Adjust awareness material so staff see current examples, supporting information security awareness, education and training
• Prioritize vulnerability management, monitoring and filtering based on what attackers are actually doing
• Brief the team that handles incidents, so response plans reflect likely scenarios
• Report notable findings to top management as input to the management review

Physical threats count too. Intelligence about local crime, severe weather or infrastructure risk informs how you apply protecting against physical and environmental threats.

Handle the information responsibly

Threat information is sometimes shared under restrictions, and some of it is sensitive. Respect any handling markings that communities apply, store intelligence with appropriate access, and avoid passing on details that could identify victims. If you contribute your own observations to a community, remove anything confidential first.

Start small and grow

If this all feels like a lot, begin with a thirty-minute monthly slot. One person reads the national cyber security advisories, the bulletins from your three most important vendors and the digest from one community, then writes five lines: what happened, whether it affects us, what we will do, who owns it, and by when. Over a year that is twelve short records, a visible pattern of decisions and a surprisingly credible answer to an auditor. As your organization grows you can add sources, split strategic and technical reporting, or buy a feed. The habit comes first, the tooling second.

Related controls and clauses

A.5.5 connection. Contact with authorities provides official advisories and alerts.

A.5.6 connection. Contact with special interest groups supplies the peer knowledge that makes intelligence relevant.

A.6.3 connection. Information security awareness, education and training turns current threats into training that people remember.

A.7.5 connection. Protecting against physical and environmental threats is where physical threat information is applied.

Clause 6.1 connection. Actions to address risks and opportunities is where intelligence changes risk decisions.

Clause 9.1 connection. Monitoring, measurement, analysis and evaluation can include checking that your intelligence process produces decisions.

Forward reference. Management of technical vulnerabilities, monitoring activities and web filtering, covered later in the Annex A series, are among the places where threat intelligence turns into technical action.

What auditors check

A defined process. Auditors ask how threat information is collected and analysed, and by whom. A short procedure or a clear section in a wider document is enough.

Sources and relevance. They look at the sources you use and whether they match your technology and sector.

Evidence of analysis. A log of items reviewed, with conclusions and decisions, shows that information is turned into intelligence and not just forwarded.

Actions taken. The strongest evidence is a concrete change: a patch brought forward, a rule added, a risk updated or a staff briefing delivered because of a specific threat.

Reporting to management. Auditors may ask what leadership has been told and whether it influenced decisions.

Proportionality. For a small organization they expect a modest, working routine, not an analyst team.

Common mistakes to avoid

Subscribing to everything. Too many feeds produce noise, and noise produces neglect.

Collecting without analysing. Forwarding advisories to a mailbox is not intelligence. Someone must decide what each one means for you.

No link to action. If a threat review never changes a patch schedule, risk entry or training topic, the process is decoration.

Buying a tool first. A paid platform will not fix the absence of an owner, questions and a routine.

Ignoring internal data. Your own incidents and blocked attacks tell you what is aimed at you right now.

Treating it as a once-a-year exercise. Threats move quickly. A short, regular rhythm beats an annual report.

How 27kay can help

We help organizations build a threat intelligence routine that fits their size: a handful of well-chosen sources, a simple review log, and clear connections to risk, patching and training. As part of ISO 27001 implementation, we set this up so it is light enough to keep going and solid enough to show an auditor. For the full picture, see our ISO 27001 knowledge hub.

If you had to name the three threats most likely to hit your organization this year, could you? Get in touch - we will help you work them out and decide what to do about them.