The ultimate audit guide to ISO 27001 Annex A 5.6 Contact with special interest groups
Table of contents
- 1. Special Interest Group Inventory Formalised
- 2. Group Relevance Mapping to ISMS Objectives Verified
- 3. Liaison Personnel Accountability Confirmed
- 4. Active Membership Validity and Subscription Records Verified
- 5. Internal Knowledge Transfer Mechanism Evidence Identified
- 6. Threat Intelligence Integration into Risk Assessment Validated
- 7. Meeting Attendance and Forum Participation Logs Present
- 8. Professional Development and Continuing Education Records Verified
- 9. Review of Group Effectiveness and Suitability Conducted
- 10. Collaborative Best Practice Implementation Evidenced
1. Special Interest Group Inventory Formalised
Verification Criteria: A documented register exists that identifies all professional associations, security forums, and industry groups relevant to the organisation’s information security requirements.
Required Evidence: A current “Special Interest Group Register” or “External Liaison List” within the ISMS documentation suite.
Pass/Fail Test: If the organisation cannot produce a list of specific groups (e.g. ISACA, (ISC)², OWASP, or sector-specific CISOs forums) relevant to their operations, mark as Non-Compliant.
2. Group Relevance Mapping to ISMS Objectives Verified
Verification Criteria: Each listed group has a defined purpose that aligns with specific security objectives, threat intelligence needs, or professional development goals.
Required Evidence: A “Relevance Statement” or “Justification” column within the group register mapping memberships to Annex A control improvements or risk mitigation.
Pass/Fail Test: If memberships are held in general industry bodies that lack a specific information security focus or benefit, mark as Non-Compliant.
3. Liaison Personnel Accountability Confirmed
Verification Criteria: Specific individuals or roles (e.g. CISO, Lead Auditor, SOC Manager) are formally assigned as the primary contact points for each identified group.
Required Evidence: Responsibility Assignment Matrix (RACI) or updated Job Descriptions specifying “External Liaison” accountabilities.
Pass/Fail Test: If a group is listed but no specific internal personnel are accountable for monitoring or participating in that group’s activities, mark as Non-Compliant.
4. Active Membership Validity and Subscription Records Verified
Verification Criteria: Organisational or individual memberships are current, with valid certifications or subscription statuses maintained.
Required Evidence: Membership certificates, digital badges, or recent invoice receipts for professional body dues.
Pass/Fail Test: If the primary membership relied upon for security updates has expired or the subscription has lapsed, mark as Non-Compliant.
5. Internal Knowledge Transfer Mechanism Evidence Identified
Verification Criteria: Information, threat alerts, or best practices obtained from special interest groups are systematically shared with the relevant internal stakeholders.
Required Evidence: Internal newsletters, Slack/Teams channel logs dedicated to “Security Trends”, or “Lunch and Learn” presentation slides.
Pass/Fail Test: If knowledge remains siloed with one individual and there is no record of information sharing with the wider security team, mark as Non-Compliant.
6. Threat Intelligence Integration into Risk Assessment Validated
Verification Criteria: Advice or alerts from special interest groups (e.g. CiSP, CERT-UK) are used to inform the organisation’s risk landscape and threat profile.
Required Evidence: Risk Register entries or Security Incident logs that explicitly cite external group advisories as a source for mitigation actions.
Pass/Fail Test: If the Risk Register shows no updates or reviews based on external threat trends provided by these groups, mark as Non-Compliant.
7. Meeting Attendance and Forum Participation Logs Present
Verification Criteria: The organisation provides evidence of active participation in meetings, webinars, or discussion forums hosted by the special interest groups.
Required Evidence: Calendar invitations, event registration confirmations, or minutes from industry-specific working groups.
Pass/Fail Test: If the organisation claims membership but cannot provide evidence of attending a single event or participating in a forum during the audit period, mark as Non-Compliant.
8. Professional Development and Continuing Education Records Verified
Verification Criteria: Staff utilise special interest group resources to maintain professional certifications and stay updated on the latest security standards.
Required Evidence: Continuing Professional Education (CPE) logs or certificates of attendance for webinars and training sessions provided by the groups.
Pass/Fail Test: If security staff certifications have lapsed due to a lack of CPE/CPD activity despite having access to these groups, mark as Non-Compliant.
9. Review of Group Effectiveness and Suitability Conducted
Verification Criteria: The list of special interest groups is reviewed at planned intervals to ensure the groups remain relevant to the current technical and threat landscape.
Required Evidence: Management Review Meeting (MRM) minutes or an “Annual Membership Review” sign-off document.
Pass/Fail Test: If the group list has not been reviewed or updated in over 12 months despite significant changes to the organisation’s tech stack, mark as Non-Compliant.
10. Collaborative Best Practice Implementation Evidenced
Verification Criteria: The organisation has adopted or benchmarked its controls against specific best practices or frameworks recommended by the special interest groups.
Required Evidence: Gap analysis reports or policy updates that explicitly reference standards or whitepapers published by the liaison groups.
Pass/Fail Test: If there is no tangible evidence that external liaison has influenced internal security controls or policy improvements, mark as Non-Compliant.
About the author
