ISO 27001 A.5.7 - Threat Intelligence

Requirement

“Information relating to information security threats shall be collected and analysed to produce threat intelligence.”

Plain-language meaning

The organization must collect threat information, analyze it in context, and turn it into usable intelligence for decisions.

Raw threat feeds are not enough. News headlines are not enough. Threat intelligence exists when information is assessed, contextualized, and used to improve risk decisions, controls, monitoring, incident response, or management awareness.

Why this matters

Risk assessment based only on internal history is weak. If an organization has not yet experienced ransomware, supply-chain compromise, credential stuffing, or cloud misconfiguration abuse, that does not mean the risk is low.

Threat intelligence helps the ISMS answer:

• What threats are relevant to us?
• Which threat actors, techniques, sectors, regions, or technologies matter?
• What changed recently?
• What controls need attention?
• What risks should be reassessed?
• What should management know now?

Implementation guidance

1. Define threat intelligence scope

Threat intelligence should match the organization’s context.

Relevant dimensions:

This links directly to Information Security Management System, Risk Assessment, and Field of Application, Usage, and Compliance.

2. Select sources

Sources can include:

• national CERT/CSIRT alerts;
• vendor advisories;
• sector ISACs or specialist groups;
• vulnerability databases;
• security researchers;
• managed security providers;
• incident reports;
• peer communities;
• commercial threat intelligence services;
• internal monitoring and incident data.

Do not blindly trust one source. Threat intelligence varies in accuracy.

3. Analyze and contextualize

The key question is: “What does this mean for us?”

4. Connect intelligence to ISMS decisions

Threat intelligence should feed:

• Risk Assessment;
• risk treatment decisions;
• Statement of Applicability review;
• control tuning;
• incident response playbooks;
• awareness training;
• vulnerability management priorities;
• supplier reviews;
• management briefings;
• Management Review.

If threat intelligence does not change decisions or confirm that no change is needed, it is probably just reading material.

5. Protect the research process

Threat research can leak information.

Personnel should be trained not to disclose sensitive organizational details in:

• public forums;
• search queries;
• AI tools;
• malware analysis environments;
• vendor portals;
• social media;
• community chat groups.

Threat intelligence work should comply with legal, regulatory, and contractual requirements. Staff should not perform risky investigation techniques without authorization and safe tooling.

6. Keep intelligence current

Threat intelligence is time-sensitive.

Define:

• review frequency;
• source owners;
• triage criteria;
• confidence levels;
• severity or relevance ratings;
• escalation paths;
• records of decisions and actions.

Audit guidance

Auditors should verify that the organization has a repeatable process for collecting, analyzing, validating, and using threat information.

Interview people responsible for risk decisions and control selection. The test is whether external threat information influences the ISMS in a traceable way.

Good audit questions:

• What threat sources do you use?
• How do you decide whether a threat is relevant?
• How do you validate intelligence quality?
• How does intelligence feed risk assessment?
• When did threat intelligence last change a control, risk rating, or management briefing?
• How do you protect sensitive information during research?
• Who receives threat intelligence outputs?

Evidence examples

Strong evidence

• Threat intelligence process defines sources, triage, analysis, validation, ownership, and escalation.
• Intelligence is mapped to assets, risks, controls, and business context.
• Recent intelligence led to documented decisions or control changes.
• Management receives concise threat briefings relevant to the organization.
• Threat research guidance warns staff about information leakage and legal limits.
• Confidence and relevance are assessed before action.
• Threat intelligence feeds risk assessment and the Statement of Applicability review.

Weak evidence

• A threat feed is subscribed to but not reviewed.
• Security newsletters are forwarded without analysis.
• Intelligence is not linked to assets, risks, or controls.
• No one can explain how threats affect risk treatment.
• No process exists to validate threat information.
• Staff use public searches or AI tools with sensitive internal details.
• Management receives either no threat intelligence or raw technical noise.

Common failures

Exam traps

• Threat information is not the same as threat intelligence. Intelligence requires analysis and context.
• A paid feed alone does not satisfy the control.
• Threat intelligence must support risk and control decisions, not just awareness.
• Internal incident history is not enough. External threat information matters.
• AI/search usage can leak sensitive details; research must be controlled.
• Threat intelligence can be strategic, tactical, or operational, but the exam usually tests whether it is collected, analyzed, contextualized, and used.

Related controls and concepts

• A.5.5 Contact with Authorities
• A.5.6 Contact with Special Interest Groups
• Risk Assessment
• Statement of Applicability
• Control Attributes and Risk Treatment Effects
• Management Review
• Internal Audit
• Information Security Management System

KB-ready summary

A.5.7 requires the organization to collect and analyze threat information to produce threat intelligence. The practical test is whether threat information is contextualized for the organization and used to support risk assessment, control selection, control tuning, incident readiness, vulnerability prioritization, and management decision-making.

Templates and checklists

• Threat Intelligence Register
• Risk and Control Mapping Table
• A.5.7 Audit Checklist
• Management Review Input Checklist