ISO 27001 Annex A 5.6 Contact with Special Interest Groups Explained

ISO 27001 Contact with Special Interest Groups

ISO 27001 Annex A 5.6 Contact With Special Interest Groups is an ISO 27001 control that requires an organisation to establish and maintain contact with security related professional associations, forums and interest groups.

Key Takeaways

ISO 27001 Annex A 5.6 requires organisations to establish and maintain contact with security-related professional associations, forums, and special interest groups. This control ensures that your organisation stays up-to-date with current best practices, emerging threats, and the latest security advisories. In an ever-evolving threat landscape, “external intelligence” is critical for maintaining an effective Information Security Management System (ISMS).

Purpose

The purpose of ISO 27001 Annex A 5.6 is to ensure the appropriate flow of information takes place with respect to information security.

Definition

The ISO 27001 standard defines Annex A 5.6 as:

The organisation should establish and maintain contact with special interest groups or other specialist security forums and professional associations.

ISO 27001:2022 Annex A 5.6 Contact With Special Interest Groups

Explanation

ISO 27001 Annex A 5.6 Contact with Special Interest Groups is a security control that requires organisations to maintain relationships with professional forums. The Primary Implementation Requirement involves establishing intelligence sharing channels, ensuring the Business Benefit of receiving early warnings on emerging threats and security best practices.

Requirement

• Identify Relevant Groups: You must determine which external groups are most relevant to your technology stack and industry. This includes vendor security forums (e.g., Microsoft or AWS security blogs), professional bodies (e.g., ISACA or ISC2), and industry-specific groups (e.g., FS-ISAC for Finance).
• Document Your Involvement: You must maintain a record of the groups you are involved with and how you interact with them. This can range from signing up for a newsletter to active participation in local security chapters.
• Stay Up-to-Date: The primary purpose of these contacts is to ensure you receive early warnings of alerts, advisories, and patches. This external flow of information helps you anticipate risks before they impact your organization.
• Demonstrate Engagement: It is not enough to just “tick a box” by registering. You must be able to explain how the information you receive from these groups is used to improve your security posture (e.g., “We received an advisory on this vulnerability and applied the patch immediately”).
• Proactive Networking: Consider joining government-backed communication schemes (like the NCSC in the UK or CISA in the US) to receive critical national threat alerts for free.

Audit Focus

1. The List: “Show me your documented list of special interest groups. Why did you choose these specific forums?”
2. Evidence of Engagement: “Can you show me a recent security advisory or newsletter you received from one of these groups and how it influenced your security actions?”
3. Staff Awareness: “Does your technical team know which forums they should be monitoring for patch notifications and threat intelligence?”

FREE Training Video

In this free training video you will learn How to implement ISO 27001 Contact With Special Interest Groups (Annex A 5.6) and Pass Your Audit.

Implementation Guide

You are going to have to ensure that you identify and document any professional associations, forums or interest groups you are involved with.

People often scratch their heads at this one but have a think about what technology you are involved with. Are you part of a security vendors newsletter, patch notification, or user group. Are you a developer that has access to beta and early release development tools or versions of software for testing and implementation? Worse case can you join a local security chapter, attend a local event, sign up to a government communication scheme on information security threats.

What you are showing is that you are involved in getting knowledge about best practice, you are up to date with current best practices, that you get early warnings of alerts, advisories and patches. It can show that you got specialist information security advice and share and exchange information. Sign up to the High Table newsletter and tick the box.

Example Group Types Matrix

Type	Example	Cost	Why join?	ISO 27001:2022 Control
Professional Body	ISACA / ISC2 / IAPP.	$$$	Career development & certifications.	Annex A 5.6
Govt / CERT	NCSC (UK) / CISA (US).	Free	Critical national threat alerts.	Annex A 5.5, 5.6
Vendor Forums	Microsoft Security Blog.	Free	Patch warnings for your specific software.	Annex A 5.6, 8.8
Industry Groups	FS-ISAC (Finance).	$$	Peer-sharing on sector-specific attacks.	Annex A 5.6, 5.7

How to implement it

As an ISO 27001 Lead Auditor, I ensure that Annex A 5.6 is more than a list of memberships, it must be a proactive intelligence stream. Implementing this control correctly involves establishing formal channels with professional bodies to stay ahead of the threat landscape, ensuring your security posture is informed by industry experts and peer-reviewed data.

1. Identify relevant professional associations and security forums

Conduct a gap analysis to determine which external groups provide the most value to your specific industry and technical environment. This ensures your networking efforts are targeted and resource-efficient.

• Review industry-specific bodies such as ISACA, IAPP, or sector-centred Information Sharing and Analysis Centres (ISACs).
• Evaluate technical forums related to your primary infrastructure, such as cloud provider security groups or specialist cryptography circles.
• Identify groups that provide early warning alerts for vulnerabilities relevant to your internal Asset Register.

2. Formalise the purpose and objectives for each membership

Define clear business justifications for joining each group to prevent the accumulation of “ghost” memberships that provide no value. This creates a clear audit trail for the necessity of the control.

• Document the specific benefits, such as access to specialist advice, threat intelligence feeds, or peer benchmarking.
• Align group objectives with your internal Risk Management Framework and Statement of Applicability.
• Determine the required frequency of engagement to remain an active participant.

3. Provision internal owners and liaison roles

Assign specific staff members as the primary points of contact for each special interest group. This ensures accountability and consistent communication between the organisation and external experts.

• Update job descriptions to include responsibility for monitoring and disseminating information from these groups.
• Appoint a “Special Interest Group Coordinator” to oversee the entire portfolio of memberships.
• Ensure owners have the technical competency to interpret and act upon the specialist advice received.

4. Secure external portal access with IAM and MFA

Implement strict access controls for any online platforms or databases provided by these groups. This mitigates the risk of unauthorised access to sensitive industry intelligence or community data.

• Apply Identity and Access Management (IAM) roles to ensure only authorised personnel can access membership portals.
• Enforce Multi-Factor Authentication (MFA) for all external accounts used to interact with security forums.
• Conduct quarterly access reviews to revoke credentials for staff who have changed roles or left the organisation.

5. Develop Rules of Engagement for information sharing

Formalise a Rules of Engagement (ROE) document to define what data can be shared with external groups. This protects your organisational intellectual property while allowing for collaborative security efforts.

• Establish clear guidelines on the classification of data permitted for external sharing, focusing on anonymised threat indicators.
• Include non-disclosure requirements within the ROE to prevent accidental leakage of sensitive internal configurations.
• Train all liaison officers on the Traffic Light Protocol (TLP) for categorising and sharing intelligence.

6. Integrate threat intelligence into the technical roadmap

Establish a workflow to ingest information from special interest groups into your internal security operations. This ensures that external advice leads to tangible technical improvements.

• Link vulnerability alerts directly to the relevant entries in your Asset Register for rapid patching.
• Use specialist advice to inform the configuration of firewalls, Intrusion Detection Systems (IDS), and Endpoint Detection and Response (EDR) tools.
• Refine your incident response playbooks based on the latest attack patterns shared by industry peers.

7. Catalog all memberships in a centralised register

Maintain a definitive list of all professional associations and interest groups within your ISMS. This register serves as the primary evidence for auditors during certification assessments.

• Include the name of the group, the internal owner, renewal dates, and the primary contact details for the external body.
• Record the login credentials (held securely) and the level of access granted to each internal staff member.
• Store this register within your ISO 27001 Toolkit for easy retrieval and version control.

8. Disseminate specialist advice to relevant internal stakeholders

Create a structured process for sharing the knowledge gained from external groups with the wider business. This prevents intelligence silos and improves the overall security culture.

• Schedule monthly security briefings to update the IT and DevOps teams on emerging threats identified by interest groups.
• Publish “lessons learned” from peer discussions on the internal company Wiki or security portal.
• Ensure the CISO is briefed on strategic shifts in the industry landscape that may affect long-term security planning.

9. Evaluate the effectiveness and ROI of memberships

Review the performance of each group annually to ensure they continue to meet the defined objectives. This allows you to reallocate resources to more effective information streams.

• Assess whether the group provided actionable intelligence that prevented or mitigated a security incident.
• Compare the cost of membership against the quality and timeliness of the specialist advice received.
• Identify any redundant groups that provide overlapping information and terminate those memberships.

10. Audit the engagement process for compliance

Perform a regular internal audit of the contact process to ensure it remains aligned with Annex A 5.6 requirements. This provides assurance that the control is functioning as intended before external audits.

• Verify that all memberships in the register are current and that internal owners are actively participating.
• Check that information sharing has remained within the boundaries defined by the Rules of Engagement.
• Review the evidence of participation, such as meeting minutes, conference attendance, or email correspondence.

Implementation Checklist

This ISO 27001 Annex A 5.6 implementation checklist provides a structured framework for establishing and maintaining formal contact with special interest groups. By following these 10 steps, organisations can ensure they receive timely threat intelligence and specialist security advice to maintain a robust compliance posture.

Step	Requirement	Implementation Example
1	Group Identification	Researching and selecting industry-specific bodies like ISACA or sector-specific ISACs.
2	Formal Objective Setting	Defining that membership in a group is specifically for “Early Warning of Zero-Day Vulnerabilities”.
3	Internal Role Assignment	Formally appointing the Lead Security Engineer as the primary liaison for technical forums.
4	Access Management	Enforcing MFA and RBAC for all staff accessing external security intelligence portals.
5	Rules of Engagement (ROE)	Creating a protocol that prohibits sharing internal IP addresses but allows sharing anonymised log data.
6	Intelligence Integration	Automatically feeding CVE alerts from specialist groups into the internal Asset Register.
7	Centralised Inventory	Maintaining a “Special Interest Group Register” detailing costs, owners, and renewal dates.
8	Internal Knowledge Transfer	Summarising monthly threat briefings from external groups for the IT operations team.
9	Efficiency Review	An annual audit to check if the group provided actionable advice during a recent security incident.
10	Compliance Documentation	Compiling meeting minutes and subscription receipts as evidence for the ISO 27001 external auditor.

How to comply

To comply with ISO 27001 Annex A 5.6 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to:

• List anything that you think is relevant no matter how tenuous the link
• List forums you are in, newsletters you sign up to, vendor communications you get on patching
• Consider joining or signing up to local security chapters or government communications
• Look at the technology you have and see if there are any special interest groups that apply to it that you can join

How to pass the audit

To pass an audit of ISO 27001 Annex A 5.6 Contact With Special Interest Groups you are going to make sure that you have followed the steps above in how to comply.

What the auditor will check

The audit is going to check a number of areas. Lets go through the main ones

1. That you are involved in a special interest group

They will check that you are part of a group. It is unlikely they will dig too deeply. Who ever you say is part of a group may be asked about it, their involvement and what they get from it.

How to audit it

As a Lead Auditor, I have developed this 10 step audit framework to ensure your organisation effectively manages Annex A 5.6. This process focuses on transforming passive memberships into active security intelligence assets, ensuring compliance with the ISO 27001 standard through robust evidence and technical integration.

1. Identify relevant professional associations and interest groups

Conduct a thorough review of the organisational risk profile and technical stack to determine which external bodies provide the most value. This step ensures that your networking efforts align with the specific security needs of your business environment.

• Cross-reference the primary Asset Register to identify vendors or technologies requiring specialist security oversight.
• Evaluate industry-specific bodies, such as ISACA, IAPP, or sector-specific CISP (Cyber Security Information Sharing Partnership) groups.
• Document the specific rationale for joining each group within your Information Security Management System (ISMS).

2. Formalise selection and approval criteria

Establish a clear set of requirements for joining special interest groups to prevent the accumulation of redundant or low-value memberships. This creates a structured approach to external engagement.

• Define the expected outcomes for each membership, such as early warning of vulnerabilities or access to specialist advice.
• Establish a formal approval workflow for new memberships involving the CISO or Information Security Lead.
• Ensure that the chosen groups have a verified reputation for maintaining confidentiality and high-quality security data.

3. Assign internal ownership and responsibilities

Provision specific roles within the organisation to manage the relationship with each external group. This ensures accountability and consistent information flow.

• Define Role-Based Access Control (RBAC) for staff members accessing external portals or sensitive mailing lists.
• Map responsibilities to job descriptions to ensure that “Contact with special interest groups” is a formalised task.
• Assign a primary and secondary contact for each high-priority group to maintain continuity during staff turnover.

4. Catalog memberships in a centralised register

Maintain a definitive list of all active memberships and professional associations to provide a single source of truth for auditors. This register acts as the primary evidence for Annex A 5.6 compliance.

• Include the name of the group, the internal owner, renewal dates, and the primary purpose of the contact.
• Store the register in a location accessible to the security team, such as the ISO 27001 Toolkit or a secure GRC repository.
• Ensure the register is updated in real-time as memberships are added or terminated.

5. Establish information sharing and Traffic Light Protocols

Define clear Rules of Engagement (ROE) for what information can be shared with external groups. This protects organisational intellectual property while allowing for collaborative security efforts.

• Implement a Traffic Light Protocol (TLP) framework to categorise information shared externally (e.g., TLP:RED for internal only, TLP:GREEN for community sharing).
• Train staff on the legal and regulatory implications of sharing data with special interest groups.
• Verify that non-disclosure agreements (NDAs) or terms of service are reviewed by legal counsel before joining.

6. Integrate external intelligence into the risk management process

Transform the information gathered from special interest groups into actionable internal security improvements. This ensures that the contact provides tangible defensive value.

• Review vulnerability alerts or threat intelligence reports received from groups against the internal Asset Register.
• Update the Risk Register if new threats identified by external groups impact the organisation’s risk posture.
• Use specialist advice from these forums to refine security controls and technical configurations.

7. Disseminate gathered intelligence to relevant stakeholders

Formalise the internal communication flow to ensure that technical alerts or security best practices reach the teams who need them. This bridges the gap between external networking and internal operations.

• Create a schedule for sharing summaries of special interest group activities with the IT and security teams.
• Incorporate high-priority alerts into the daily or weekly security operations briefings.
• Use internal newsletters or Wikis to document specialist advice that could benefit the wider business.

8. Document evidence of active participation

Collect and store tangible evidence that the organisation is actively engaging with the selected groups. Auditors will look for proof that these are not “ghost” memberships.

• Retain copies of meeting minutes, conference attendance certificates, or webinar logs.
• Archive emails or forum posts where the organisation has sought specialist advice or shared anonymised threat data.
• Maintain records of membership fee payments or formal subscription renewals.

9. Schedule periodic relevance and effectiveness reviews

Conduct an annual review of all special interest group contacts to ensure they remain relevant to the current threat landscape. This prevents the waste of resources on outdated or inactive forums.

• Evaluate whether the group provided actionable intelligence or support during the preceding twelve months.
• Determine if the technical focus of the group still aligns with the organisation’s current infrastructure and strategy.
• Update the membership register to reflect any decisions to cease contact or join new organisations.

10. Audit the contact register against compliance requirements

Perform a final internal audit check to ensure all aspects of Annex A 5.6 are fully documented and functional. This step prepares the organisation for formal certification or surveillance audits.

• Verify that the register is complete and that all listed contacts are currently active.
• Cross-reference participation evidence with the requirements stated in the Statement of Applicability (SoA).
• Confirm that the Management Review meeting minutes reflect the status and effectiveness of these external contacts.

Audit Checklist

This ISO 27001 Annex A 5.6 audit checklist provides a definitive framework for Lead Auditors to verify that an organisation is actively engaging with external security bodies. It ensures that memberships are not merely administrative, but provide actionable threat intelligence and specialist advice integrated into the internal risk management process.

Item	Audit Check (What to look for)	Evidence Examples	GRC Platform Check
1	Existence of a formal group register.	Centralised list of memberships and associations.	Is the Special Interest Group Register active in the GRC?
2	Relevance to organisational scope.	Justification documentation for each group selected.	Are groups linked to specific assets or business units?
3	Assignment of internal ownership.	Job descriptions or role-based access logs.	Is a primary owner assigned to each membership record?
4	Evidence of active participation.	Meeting minutes, conference tickets, or forum logs.	Are participation logs uploaded as evidence attachments?
5	Information sharing protocols.	Traffic Light Protocol (TLP) or NDA records.	Is the “Rules of Engagement” document stored and approved?
6	Intelligence integration.	Risk register updates based on external alerts.	Are threat intel feeds mapped to internal risk entries?
7	Communication effectiveness.	Internal briefings or vulnerability newsletters.	Are internal task notifications sent upon receipt of alerts?
8	Review of confidentiality terms.	Legal review of membership terms of service.	Is there a record of legal or CISO sign-off on terms?
9	Annual effectiveness review.	Management review minutes regarding group ROI.	Is there a recurring audit task for membership review?
10	Cessation of contact process.	Logs showing removal of access for expired groups.	Are workflows triggered for membership terminations?

Top 3 Mistakes People Make and How to Avoid Them

The top 3 Mistakes People Make For ISO 27001 Annex A 5.6 are

1. You didn’t register with any special interest groups

Not even one person in your company could find even a tenuous link to something that would satisfy this and they fail you on it.

2. You registered but you didn’t engage

You thought it was a tick box so you registered and you never engaged. As a result you actually have no idea what the special interest group is, does or gives you as benefit. At least before the audit have a basic understanding of what you signed up to.

3. Your document and version control is wrong

Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

The Definitive Directory of Security Forums

To truly master ISO 27001 Annex A 5.6, you need a curated “Global Authority List”. As a Lead Auditor, I don’t expect you to join every group listed below; I expect you to choose the ones that map directly to your risk profile. This directory is your starting point for building a high-performance intelligence network.

Category	Organisation / Forum	Primary Value for ISO 27001
Generalist & Professional	ISACA	Industry-standard frameworks (COBIT) and audit certifications (CISA).
	(ISC)²	Deep technical security knowledge and CISSP-level peer networking.
	BCS (The Chartered Institute for IT)	UK-centric professional standards and legislative updates.
Government & National	NCSC (UK) – CiSP	The Cyber Security Information Sharing Partnership; critical for UK threat alerts.
	CISA (US)	Mandatory for US-linked firms; provides the “Known Exploited Vulnerabilities” catalog.
	ENISA (EU)	Essential for understanding NIS2 and European-wide security certification (ECCF).
Technical & Vulnerability	OWASP	The gold standard for web application security; critical for Annex A 8.8 compliance.
	FIRST.org	The global forum for incident response and security teams.
	CVE / MITRE ATT&CK	Technical taxonomy of vulnerabilities and adversary tactics for threat intelligence.
Sector-Specific (ISACs)	FS-ISAC (Finance)	Peer-to-peer sharing of financial sector attack vectors and DORA compliance updates.
	H-ISAC (Health)	Specialist advice on medical device security and HIPAA-related threat trends.
	RH-ISAC (Retail)	Focuses on point-of-sale (POS) security and e-commerce fraud prevention.
	EE-ISAC (Energy)	Critical for infrastructure providers managing SCADA and ICS security risks.

Auditor’s Pro-Tip: The “Quality Over Quantity” Rule

Do not attempt to join every group in this directory. An auditor will be more impressed by active participation in two highly relevant groups than by a list of ten newsletters that go unread. Your Special Interest Group Register should clearly state why you joined a specific group and what technical outcomes you expect from it.

Applicable Laws and Related Standards

Framework / Law	Mapping / Requirement	Implementation Strategy
NIST CSF v2.0	GV.OC-04 (Communication) & ID.RA-02 (Threat Intel)	Engage in Information Sharing and Analysis Centres (ISACs) to satisfy the “Govern” and “Identify” functions.
NIS2 Directive (EU)	Article 21 (Supply Chain & Vulnerability Handling)	Participate in CSIRTs and industry forums to meet mandatory vulnerability disclosure and coordinated response requirements.
DORA (EU)	Article 13 (Information Sharing Arrangements)	Establish formalised arrangements to exchange cyber threat information and intelligence within the financial sector.
SOC2 (AICPA)	CC1.4 (Communication of Information)	Use special interest groups as evidence of communicating with external parties regarding the functioning of internal controls.
GDPR / UK Data (Use and Access) Act 2025	Article 32 (Security of Processing)	Stay informed of “state of the art” technical measures via professional bodies to ensure “appropriate” security levels are maintained.
UK Cyber Security and Resilience Bill	Mandatory Reporting for MSPs	Liaise with the NCSC and specialist MSP forums to ensure compliance with expanded reporting thresholds for managed services.
CIRCIA (USA)	72-Hour Incident Reporting	Use sector-specific groups to establish the communication channels necessary for mandatory reporting to CISA.
EU AI Act / ISO 42001	Risk Management & Post-Market Monitoring	Join AI safety forums to monitor emerging bias risks and algorithmic vulnerabilities as part of the AI Management System (AIMS).
HIPAA (USA)	§164.308(a)(5)(ii)(B) (Security Awareness)	Monitor external health-tech security groups to provide “Security Reminders” based on actual sector-specific threats.
CCPA / CPRA (California)	Reasonable Security Procedures	Demonstrate “reasonableness” by benchmarking security controls against peer organisations within professional associations.
EU Product Liability Directive (PLD)	Strict Liability for Cyber Flaws	Engage with software security groups (e.g., OWASP) to prove adherence to security-by-design and reduce liability risk.
ECCF (EU Cybersecurity Cert)	Harmonised Security Labels	Participate in ENISA-led groups to align product security configurations with EU-wide certification schemes.

What Changed in ISO 27001:2022 Annex A 5.6?

In the transition from the 2013 version to ISO 27001:2022, the most significant change to this control was its reclassification and the increased expectation of utility. Previously categorised under “Internal Organisation” as Control 6.1.7, it has been promoted to “Organisational Controls” as Annex A 5.6. While the core requirement to maintain external networks remains, the 2022 update places a much heavier emphasis on the value of the information received. It is no longer enough to simply be a member: the standard now implicitly links this control to the new Annex A 5.7 (Threat Intelligence), requiring you to prove that these contacts actually inform your defensive posture.

Feature	ISO 27001:2013 (Old Standard)	ISO 27001:2022 (Current Standard)
Control Number	Control 6.1.7: Contact with special interest groups.	Annex A 5.6: Contact with special interest groups.
Categorisation	Part of “Internal Organisation” (A.6).	Part of “Organisational Controls” (A.5).
Audit Context	Often treated as a static list of memberships.	Treated as a dynamic input for threat and risk management.
Strategic Alignment	Standalone networking requirement.	Explicitly supports the new Annex A 5.7 (Threat Intelligence) and Annex A 5.24 (Incident Planning).
Expectation of Value	Focused on “maintaining contact” and “obtaining specialist advice.”	Focused on “appropriate flow of information” and “early warnings” to trigger technical action.
Documentation	A simple list or “Register of Memberships” was usually sufficient.	Requires a Special Interest Group Register that includes roles, responsibilities, and evidence of information dissemination.

Applicability of across different business models

Business Type	Applicability & Interpretation	Examples of Control
Small Businesses	Free Alerts & Vendor Newsletters. You don’t need expensive memberships. Compliance is achieved by subscribing to free national alert services and reading the security newsletters from your core software vendors.	• National Alerts: Subscribing to the free email alert service from the NCSC (UK) or CISA (US) to receive warnings about major phishing campaigns. • Vendor Blogs: Following the official “Microsoft Security” or “Xero Security” blog/RSS feed to stay updated on vulnerabilities affecting your specific tools.
Tech Startups	Technical Communities. Your “Special Interest Groups” are the communities where vulnerabilities in your stack are discussed. It’s not just about reading news; it’s about monitoring the tech-specific chatter.	• Stack-Specific Forums: Active monitoring of subreddits like r/netsec or specific Slack communities (e.g., Kubernetes Security) for early warning of exploits. • OWASP: Using Open Web Application Security Project (OWASP) resources and attending local chapter meetups to stay ahead of web vulnerabilities.
AI Companies	AI Safety & Ethics Boards. The definition of “security” in AI includes safety and bias. You must engage with groups defining the standards for AI regulation and model safety.	• AI Safety Institutes: Engaging with or following the output of the US or UK AI Safety Institutes to understand emerging regulatory requirements. • Ethics Forums: Participation in bodies like the “Partnership on AI” or Hugging Face ethics discussions to track adversarial attack vectors (e.g., jailbreaking).

Related ISO 27001 Controls

• ISO 27001 Clause 4.2 Understanding The Needs And Expectations of Interested Parties
• ISO 27001 Annex A 5.5 Contact With Authorities

Further Reading

• How to Implement ISO 27001 Annex A 5.6: Contact with Special Interest Groups
• How to Audit ISO 27001 Annex A 5.6: Contact with Special Interest Groups
• Your Small Business Guide to ISO 27001 Annex A 5.6: Contact with Special Interest Groups
• ISO 27001 Annex A 5.6 for Tech Startups: Crowdsourcing Your Security
• ISO 27001 Annex A 5.6 for AI Companies: Staying Ahead of the Curve
• ISO 27001 Annex A 5.6 for Small Business: Getting Expert Help for Free

ISO 27001 Controls and Attribute Values

Control type	Information security properties	Cybersecurity concepts	Operational capabilities	Security domains
Preventive	Confidentiality	Protect	Governance	Defence
	Integrity	Respond
	Availability	Recover

About the author