ISO 27001 controls
Control 5.7 asks you to know what is coming, and to show that knowing changed something.
Threat intelligence is one of the controls the 2022 edition added. It sounds like a job for a dedicated analyst team. For most companies it is smaller: a few chosen sources, a regular look at them, and a habit of turning what you read into a patch, a rule or a risk entry. The evidence is that trail.
Back to ISO 27001 services01 · What it asks
Collect, analyse, act
Reading alerts is not enough; acting on them is the control.
- 5.7Threat intelligenceGather information about threats relevant to you, make sense of it, and use it to protect the organization.
The guidance describes intelligence at more than one level. Put simply: strategic intelligence is the broad picture leadership needs, such as which kinds of attacker target your sector. Tactical intelligence is about methods, the techniques attackers use. Operational intelligence is specific and short-lived, such as a vulnerability being exploited this week or a list of malicious addresses.
A small company does not need all three in depth. It needs intelligence that is relevant to what it runs, gets looked at, and leads somewhere.
02 · Sources
Where useful intelligence comes from
Mostly free, and mostly already in your inbox.
- Government alerts
- National computer emergency teams publish advisories. In India that is CERT-In; others such as the US CISA publish lists of vulnerabilities known to be exploited.
- Vendor advisories
- Security notices from the makers of the software, cloud services and devices you use.
- Information-sharing communities
- Sector groups and industry forums where members share what they see, often under sharing rules.
- Your own telemetry
- Alerts, blocked attempts and incidents from your own systems are intelligence about who targets you.
- Commercial feeds
- Paid services that curate and enrich indicators. Useful at scale; not required.
Control 5.6, contact with special interest groups, sits next to 5.7. Joining a community can serve both.
03 · Source to action
From a source to an action
Every source should map to something you would do.
| Source | What it tells you | Typical action | Where the action is recorded |
|---|---|---|---|
| Government advisory on an exploited vulnerability | A flaw in software you may run is being used in attacks | Check inventory, patch or mitigate ahead of the normal cycle | Vulnerability tracker, change record |
| Vendor security notice | A product you use has a fix or a workaround | Apply the fix or record why not | Patch log, risk register if deferred |
| Sector community report | Attackers targeting companies like yours with a method | Tune detection, brief staff, review the related risk | Detection rule change, awareness note, risk register |
| Own incident or blocked attack | Someone is trying a route into your systems | Strengthen the control that was tested | Incident record, corrective action |
| Annual threat landscape report | How threats to your sector are shifting | Inform the risk assessment and management review | Risk assessment, management review minutes |
04 · Small team
A proportionate setup for a small team
Subscriptions, a review habit, and links to risk and patching.
- Choose a short list of sources that match your stack: the national alert service, the main vendors you run, and one community if your sector has one.
- Send them to a shared mailbox or channel, not to one person's inbox.
- Name an owner and set a review cadence in your procedure that fits your risk. // cadence: to be set by the reader
- At each review, note what was relevant and what you did, even if the answer is nothing.
- Route urgent items into the vulnerability process with a faster track.
- Bring a short summary of the threat picture to risk assessment and management review.
Small company
A curated inbox and a log
- Free government and vendor alerts
- A security lead reviews and logs relevant items
- Urgent items go straight to the patch queue
- A paragraph on threats in each risk review
Large company
A function with tooling
- Commercial feeds into a threat intelligence platform
- Indicators pushed automatically to detection tools
- Analysts write sector briefings for leadership
- Formal sharing agreements with industry peers
05 · Evidence
What shows the control works
The auditor wants a trail from alert to change.
- A defined approach. A procedure naming sources, owner, review cadence and how items are routed.
- Subscriptions in place. Proof you receive the sources you named.
- A review log. Dated entries showing items reviewed and the decision on each.
- Traced actions. At least one item followed through to a patch, rule change or risk update.
- Input to risk. Threat information visible in the risk assessment or management review.
- Subscribed, never read. Alerts piling up in an unread folder show collection without analysis.
- Everything is relevant. Logging every alert without a filter buries the few that matter.
- Intel cut off from risk. If the risk register never changes after an alert, the auditor will ask why.
- Buying a feed as the answer. A paid feed with no one acting on it does not meet 5.7.
Sources: ISO/IEC 27001:2022 Annex A control names 5.6 and 5.7; ISO/IEC 27002:2022 as background on the levels of intelligence (not quoted); NIST SP 800-150 on cyber threat information sharing; CERT-In and CISA public advisory services, named only. The table and steps are our own illustration.
Threat intelligence questions
Do we need to pay for a threat feed?
No. Free sources are often enough.
Government advisories, vendor notices and community groups cover what most small and mid-sized companies need. A paid feed makes sense once you have people and tooling to act on its volume.
How often should we review threat sources?
At a cadence your procedure sets and you keep.
The standard sets no frequency. Choose one that fits your risk and the speed of your sources, write it down, and keep the log that shows you followed it. Urgent alerts should not wait for the next scheduled review.
Is threat intelligence the same as vulnerability management?
No, but they meet often.
Vulnerability management finds and fixes weaknesses in your own systems. Threat intelligence tells you which weaknesses and methods attackers are using, which helps you choose what to fix first.
Can a managed security provider meet 5.7 for us?
It can do the work; you still own the decisions.
A provider can collect and filter intelligence. Keep its reports, record what you decided on each, and make sure the results reach your own risk assessment.
Turn alerts into decisions you can show.
An ISO 27001 gap analysis checks your approach to 5.7 and shows the smallest setup that meets it for your size.