Key takeaways
- Collect and analyse information about threats relevant to you and act on it.
- Knowing which attackers and techniques target organisations like yours helps you prioritise controls instead of guessing.
- Start here: choose sources: government advisories, vendor feeds, sector groups, your own logs.
Purpose
Collect and analyse information about threats relevant to you and act on it.
Requirement
Requirement summaryInformation relating to information security threats shall be collected and analyzed to produce threat intelligence.
Why it matters
Knowing which attackers and techniques target organisations like yours helps you prioritise controls instead of guessing.
How to implement
- Choose sources: government advisories, vendor feeds, sector groups, your own logs.
- Define who collects, analyses and shares threat information and how often.
- Turn relevant intelligence into actions: patches, detection rules, awareness messages.
- Record what was received and what you did about it.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.7. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- A short procedure for threat intelligence (information about current threats): which sources you use, who reviews them and what happens next.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.7 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Examples of threat information received, such as national security advisories or supplier security notices.
- A few examples showing a threat was checked for relevance and any action was tracked to completion.
- Updates to your risk register prompted by new threats.
Things you should be able to show or explain
- Be able to explain how you decide whether a threat matters to you.
How much to show: A handful of threat items from the last year.
Common mistakes
- Advisories received but never acted on.
- Threat information not feeding into your risk assessment.
- Subscribing to feeds that nobody reads.
- Collecting intelligence that never changes a decision.
- Tip: Start small: one feed, reviewed monthly, with actions logged.
Policies & documents to have
- Operations Security Policy
- Information Security Roles and Responsibilities Policy
FAQ
Is A.5.7 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.7?
Be ready to explain how the control works in your organisation and to provide things like: A short procedure for threat intelligence (information about current threats): which sources you use, who reviews them and what happens next…