ISO27001-A.5.7 Threat Intelligence

Control Purpose

The organization must collect threat information, analyze it in context, and turn it into usable intelligence for decisions.

Use A.5.7 Threat Intelligence for the detailed requirement, implementation guidance, audit checks, evidence expectations, and related ISO 27005 context.

Risk Logic

Related Risks

No published risk scenario is linked to this control yet. Create or link a risk note under the risk knowledge base before treating this control as fully mapped.

Implementation Activities

• Subscribe to trusted threat intelligence sources.
• Review vendor advisories and vulnerability alerts.
• Track indicators of compromise.
• Translate relevant intelligence into detection rules.
• Record monthly threat intelligence reviews.

Evidence Required

• Monthly threat intelligence review notes.
• IOC update records.
• SIEM rule updates.
• Vendor advisory review records.

Audit Questions

• AQ-ISO27001-A.5.7 Audit Question
• How does the organization collect and review threat intelligence?
• How does threat intelligence influence security monitoring?
• Show an example where threat intelligence led to an action.

ISO 27005 Link

This control supports risk identification, risk analysis, risk monitoring, and risk treatment by improving awareness of relevant threats.

ISO 27002 Link

Use ISO/IEC 27002 as implementation guidance for interpreting what effective threat intelligence practices look like.

Source Notes

• A.5.7 Threat Intelligence
• ISO 27002 Annex A Control Interpretation Map
• ISO 27005 Risk Process Notes

Software Architecture Mapping

Relevant objects:

• control
• threat
• risk
• evidence
• audit_question
• review