ISO 27001:2022 Annex A 5.7 Threat Intelligence Explained

In this guide you will learn how to implement ISO 27001 Annex A 5.7 Threat Intelligence and pass your audit from ISO 27001 Lead Auditor Stuart Barker – author of the ultimate ISO 27001 Toolkit.

ISO 27001 Annex A 5.7 is an ISO 27001 control that requires an organisation to collect and analyse information relating to information security threats and use that information take mitigation action.

Key Takeaways

• Sources of threat intelligence information are readily available and many are free
• Management of threats is done by risk management
• You can do it yourself with How To Create an ISO 27001 Threat Intelligence Process and Report

Purpose & Definition

ISO 27001 Annex A 5.7 is preventive, detective and corrective control that ensure you provide awareness of the organisations threat environment so that the appropriate mitigation actions can be taken.

The ISO 27001 standard defines ISO 27001 Threat Intelligence: Annex A 5.7 as:

Information relating to information security threats should be collected and analysed to produce threat intelligence.

ISO 27001:2022 Annex A 5.7 Threat Intelligence

FREE ISO 27001 Annex A 5.7 Training Video

In this free training video you will learn How to do ISO 27001 Annex A 5.7 (Threat Intelligence) and Pass Your Audit

ISO 27001 Annex A 5.7 Requirements and Guidance

Threat intelligence is used to prevent, detect or respond to threats. You can produce your own threat intelligence but as a rule you will make use of threat intelligence produced by others. It is often provided by independent providers and advisors which can include government sources and more than likely products and services will spring up around this new control to offer you it as a service, at a cost of course.

Threat Intelligence is a new control is ISO 27001:2022 and is about understanding and managing the threats to your information security. Threats to the confidentiality, integrity and availability of data.

It can be confusing when you first come to this control but I will show you what is required and some simple, practical steps you can take to implement it.

ISO 27001 Threat Intelligence is the identification and management of information security threats.

In ISO 27001 this is known as ISO27001:2022 Annex A 5.7 Threat Intelligence .

Why is it important?

The purpose of this control is to provide awareness of the organisation’s threat environment so that the appropriate mitigation actions can be taken.

Taking collective knowledge of threats can lead to a collective response and that response can be based on collective best practice. If we share information we reduce the risk and impact of the emerging threats that are only ever going to increase. We cannot protect against what we do not know. As we start to know more we can increase our protection making for a safer, more secure working environment and protecting vital customer and employee data.

Implementing threat intelligence

When implementing threat intelligence you are analysing and using information and including it in your risk management process. You are using it as input to inform how you implement and configure technical controls. You are adapting information security tests and techniques based on it.

Threat intelligence is used to inform decisions and actions to precent these threats causing harm to the organisation and reduce the impact of such threats. The graphic below outlines the process from objectives to improvement.

You are going to have to ensure that

• objectives for threat intelligence production are established
• internal and external sources of information are identified, selected and vetted where necessary and appropriate
• information is collected from selected sources
• information is then prepared for analysis for example by formatting or translating it
• information is analysed to understand how it relates to you
• communication and sharing of information is done to relevant in people in a way they will understand it

ISO 27001 Threat Intelligence Template

The threat intelligence process and report are a key requirement of complying with this control.

The 3 layers of threat intelligence

There are 3 layers to threat intelligence.

1. Strategic Threat Intelligence

High level information about the threat landscape.

Focus: High-level trends, financial impact, and global risk landscape.

Audience: Senior Management, the Board, and Policy Makers.

ISO 27001 Link: Feeds into Clause 4 (Context of the Organisation) and Clause 6.1 (Risk Assessment) to help leadership make budget and resource decisions.

2. Tactical Threat Intelligence

Intelligence on tools, techniques and attack methodologies

Focus: The “How.” It covers TTPs (Tactics, Techniques, and Procedures) used by attackers.

Audience: IT Managers, System Administrators, and Security Architects.

ISO 27001 Link: Feeds into Annex A 8.8 (Vulnerability Management) and Annex A 5.15 (Access Control) to configure defences against specific attack methods.

3. Operational Threat Intelligence

Intelligence on specific attacks and indicators.

Focus: The “Now.” It covers specific technical details like IOCs (Indicators of Compromise), malicious IP addresses, file hashes, and phishing domains.

Audience: SOC Analysts, Firewalls, and Spam Filters.

ISO 27001 Link: Feeds into Annex A 8.7 (Malware) and Annex A 8.23 (Web Filtering) for immediate blocking.

Identifying Existing and Emerging Threats

Through the use of internal and external data sources existing and emerging threats will be identified. In addition, the use of audit processes such as internal audit, external audit and penetration testing will be used.

Integrating Threat Intelligence into Risk Assessment

Threats will be analysed for relevance to the organisation. Where a relevant threat is identified it will be added to the risk register and managed via the risk management process.

Communicating Threat Intelligence to Stakeholders

Threat Intelligence will be shared with the Management Review Team as part of the regular structured agenda.

Using Threat Intelligence for Continual Improvement

Threat Intelligence that identifies emerging and existing threats will be managed via the Risk Management Process and any changes or improvements will be managed via the Continual Improvement Process.

Free Threat Intelligence Sources

There are free sources of threat intelligence information that you can use. These can be internal or external so let us take a look at examples of threat intelligence sources you can use:

Internal Sources of Threat Intelligence

• Anti-Virus and Malware Protection Reports
• Information Security Incident Reports
• Phishing Reports
• Internal Audit Reports
• Helpdesk Tickets
• Log Files

External Sources of Threat Intelligence

• UK National Cyber Security Centre
• CISA.gov – Official website of the U.S. Department of Homeland Security
• SANS™ Internet Storm Center
• Vendor feeds
• Government alerts
• News sites

The threat intelligence reporting process

• A Threat Intelligence Report is created.
• The Threat Intelligence Report is shared with The Management Review Team.
• The Threat Intelligence Report is shared at least at the Management Review Team Meeting and if a significant threat is identified.
• Threat Intelligence Reports are kept for at least 12 months.
• Progress of Threat Mitigation is reported via the Risk Management Process and Continual Improvement Process as relevant.

The contents of the threat intelligence report

• Threat Summary: A summary in simple of terms of the threat that can be understood by someone with no technical knowledge.
• Source: The source of the threat. Either a link or a description in words of how the threat was identified.
• Threat Level: Using a simple, easy to understand rating of High / Medium and Low the initial rating is a subjective rating on the potential risk and impact to the organisation. The objective rating will be derived as part of the risk management process.

How to Implement ISO 27001 Annex A 5.7

1. Define Threat Intelligence Objectives and Scope

• Establish the primary goals for the threat intelligence process, such as reducing incident response times or identifying industry-specific attackers.
• Document the scope of intelligence gathering, ensuring it covers tactical, operational, and strategic levels.
• Identify key stakeholders who require intelligence updates, including the IT team, senior management, and the Incident Response Team.

2. Identify and Categorise Information Assets

• Update your Asset Register to include all critical hardware, software, and data repositories that require protection.
• Classify assets based on their value and sensitivity to help prioritise threat monitoring efforts.
• Map dependencies between assets to understand how a threat to one component could impact the wider infrastructure.

3. Select and Validate Intelligence Sources

• Identify a mix of internal sources, such as SIEM logs and incident reports, and external sources, such as commercial feeds or government alerts.
• Evaluate the reliability and relevance of each source to ensure the data provided is accurate and timely.
• Formalise agreements with external providers where necessary, ensuring they meet your organisation’s data privacy standards.

4. Provision Collection and Processing Infrastructure

• Deploy technical tools, such as automated threat intelligence platforms or RSS aggregators, to centralise data collection.
• Configure IAM roles to ensure only authorised personnel can access or modify the threat intelligence feeds.
• Implement data sanitisation processes to remove noise and false positives from the raw data collected.

5. Formalise Analysis and Triage Procedures

• Define the methodology for analysing raw data to identify Trends, Techniques, and Procedures (TTPs) used by threat actors.
• Establish a triage system to categorise threats based on their potential impact and likelihood of occurrence.
• Document the criteria for escalating high-priority threats to the executive level or the security operations centre.

6. Integrate Intelligence with Incident Management

• Update incident response playbooks to include steps for incorporating real-time threat intelligence during an active breach.
• Link Indicators of Compromise (IoCs), such as malicious IP addresses or file hashes, directly into your security monitoring tools.
• Ensure the Incident Response Team has the necessary permissions to act upon intelligence-driven alerts immediately.

7. Implement Technical Safeguards and Mitigations

• Apply proactive controls, such as updating firewall rules or enhancing MFA requirements, based on identified emerging threats.
• Conduct vulnerability scans focused on the specific TTPs identified through your intelligence gathering.
• Ensure that patches for exploited-in-the-wild vulnerabilities are prioritised in the patch management cycle.

8. Distribute Actionable Intelligence Reports

• Create tailored communication templates for different audiences, ensuring technical teams receive tactical data while executives receive strategic overviews.
• Establish secure communication channels for distributing sensitive intelligence, avoiding plaintext emails for high-risk alerts.
• Define the frequency of reporting, ensuring that urgent threats are communicated via out-of-band methods if necessary.

9. Audit and Review Intelligence Effectiveness

• Monitor Key Performance Indicators (KPIs), such as the percentage of threats identified before they caused an incident.
• Conduct periodic audits of the threat intelligence process to ensure compliance with the ISO 27001 Annex A 5.7 control.
• Review the Rules of Engagement (ROE) documents to ensure intelligence gathering activities remain within legal and ethical boundaries.

10. Conduct Management Review and Continual Improvement

• Present a summary of the threat landscape and intelligence performance to the ISMS steering committee.
• Identify opportunities for improving the process, such as investing in better automation or expanding the scope of sources.
• Update the threat intelligence policy and procedures based on feedback and changes in the organisational risk profile.

How to comply

• Establish and document objectives for threat intelligence production
• Identify, vet, list and document internal and external sources of information
• Collect the information
• Prepare the information for analysis for example by formatting or translating it
• Analyse information to understand how it relates to you
• Communicate and share information to relevant people in a way they will understand it

How to audit ISO 27001 Annex A 5.7

Auditing threat intelligence requires a methodical review of how your organisation identifies, processes, and utilises information regarding external and internal threats. This 10 step audit process ensures that your implementation of Annex A 5.7 is robust, compliant, and integrated into your wider Information Security Management System (ISMS).

1. Review the Threat Intelligence Policy and Objectives

• Verify the existence of a documented policy that defines the objectives for threat intelligence gathering.
• Confirm that the scope is clearly defined: covering tactical, operational, and strategic intelligence requirements.
• Check for evidence of management approval and regular review cycles to ensure the policy remains aligned with the business risk appetite.

2. Inspect Information Source Reliability and Diversity

• Analyse the list of internal and external sources, such as SIEM logs, commercial feeds, and industry sharing groups.
• Evaluate the criteria used to validate the reliability and relevance of these sources to prevent data fatigue or false positives.
• Verify that the organisation does not rely on a single point of failure by ensuring a diverse range of intelligence inputs.

3. Audit Asset Register Synchronisation

• Examine the Asset Register to ensure all critical hardware and software assets are identified for threat monitoring.
• Verify that threat intelligence is mapped against specific assets, allowing for prioritised risk mitigation based on asset value.
• Check for documented dependencies between assets that could be affected by a single threat vector.

4. Examine IAM Roles and Access Permissions

• Inspect the Identity and Access Management (IAM) configurations for the threat intelligence platform.
• Verify that the principle of least privilege is applied: ensuring only authorised analysts can modify intelligence feeds or triage alerts.
• Audit the joiner, mover, and leaver process to ensure access is revoked immediately when roles change or employment terminates.

5. Verify Rules of Engagement (ROE) and Legal Compliance

• Review the Rules of Engagement (ROE) documents to ensure all intelligence collection activities are legal and ethical.
• Confirm that data privacy requirements, such as GDPR or local legislation, are adhered to during the collection of external threat data.
• Check for formal agreements with third-party intelligence providers that outline data ownership and confidentiality.

6. Analyse Threat Triage and Classification Procedures

• Review the methodology for identifying and categorising Trends, Techniques, and Procedures (TTPs) used by threat actors.
• Verify that a formal triage system is in place to prioritise threats based on their potential impact and likelihood.
• Check for documented escalation paths for high-priority threats that require immediate executive or technical intervention.

7. Evaluate Incident Management and IoC Integration

• Sample recent security incidents to confirm if threat intelligence was utilised effectively during the identification and containment phases.
• Verify that Indicators of Compromise (IoCs): such as malicious IPs and file hashes, are integrated into active monitoring and blocking tools.
• Confirm that the Incident Response Team has documented procedures for updating intelligence feeds following a successful mitigation.

8. Audit Technical Safeguards and MFA Implementation

• Verify that Multi-Factor Authentication (MFA) is strictly enforced for all administrative access to threat intelligence systems.
• Inspect the security configuration of the tools used to process intelligence, ensuring they are patched and hardened against attack.
• Review vulnerability scan results for the infrastructure supporting the threat intelligence function.

9. Inspect Intelligence Reporting and Communication Channels

• Review a sample of threat intelligence reports to ensure they are tailored to the appropriate audience: technical, operational, or strategic.
• Verify that secure communication channels are used for distributing sensitive intelligence to prevent interception by threat actors.
• Confirm that reporting frequencies meet the requirements defined in the initial objectives and policy.

10. Confirm Evidence of Continual Improvement and Review

• Examine minutes from management review meetings where threat intelligence performance and the threat landscape were discussed.
• Verify that Key Performance Indicators (KPIs) are tracked, such as the speed of detection or the reduction in successful attacks.
• Check for evidence that the threat intelligence process has been updated based on previous audit findings or changing organisational needs.

How to pass the ISO 27001 Annex A 5.7 audit

1. That you are gathering threat intelligence and analysing it

What this means is that you need to show that you have a list of sources of threat intelligence information, have records of collecting and show reports where you have shared and communicated it.

2. That you have taken action as a result of threat intelligence

The process may be straightforward. You may have updated a system, changed a configuration, introduced or removed a tool, had an incident that was managed via the incident management process. What ever the course of action you will have records of action taken and audit trails.

3. That threat intelligence forms part of risk management and operations

Your risk management process will factor in and evidence threat intelligence. Your risk register may take account of threat intelligence and emerging or realised risks.

Top 3 Mistakes Implementing Threat Intelligence

• 1. You are not collecting or using threat intelligence: This is a new control so one that is easy to overlook. Make sure to follow the control requirements and be able to evidence its operation.
• 2. You rely only on internal threat intelligence: Internal threat intelligence is easy to collect but does not provide for the wider picture. Be sure to include external sources of threat intelligence data.
• 3. Your document and version control is wrong: Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

ISO 27001 Annex A 5.7 FAQ

Further Reading

• How to Implement ISO 27001:2022 Annex A 5.7: Turning Information into Defence
• How to Audit ISO 27001:2022 Annex A 5.7: Threat Intelligence
• ISO 27001:2022 Annex A 5.7 for Small Business: Security Smarts on a Budget
• ISO 27001:2022 Annex A 5.7 for AI Companies: Knowing Your Enemy
• ISO 27001:2022 Annex A 5.7 for Tech Startups: Smart Defense, Not Just Data

ISO 27001 Controls and Attribute Values

Control type	Information security properties	Cybersecurity concepts	Operational capabilities	Security domains
Preventive	Confidentiality	Identify	Threat and vulnerability management	Defence
Corrective	Integrity	Detect		Resilience
Detective	Availability	Respond

About the author