ISO/IEC 27001:2022 · Organizational control · New in 2022
ISO 27001 Annex A 5.7: Threat intelligence
Quick answer
ISO 27001 Annex A 5.7 (Threat intelligence) is an organizational control introduced in the 2022 edition. Collect and analyse information about threats relevant to the organisation and use it to inform risk decisions and defences.
What auditors look for
Auditors check that 5.7 is either justified as not applicable in your Statement of Applicability or implemented and working. Typical evidence includes:
- Threat intelligence sources list
- Periodic threat summaries
- Examples of detections or controls changed because of intelligence
How to implement 5.7 in practice
- Start with free feeds such as CISA KEV and vendor advisories
- Focus on threats to your sector and technology
- Feed findings into the risk register and patch priorities
- Name an owner for 5.7, decide how often it runs and file evidence each time, so the control is audit-ready all year.
Recording 5.7 in the Statement of Applicability
List 5.7 with whether it applies, the reason (usually the risks it treats or a legal or contractual requirement), its implementation status and where the evidence lives. If you exclude it, explain why none of your risks or obligations require it.
Free resources
More organizational controls
- 5.3 Segregation of duties
- 5.4 Management responsibilities
- 5.5 Contact with authorities
- 5.6 Contact with special interest groups
- 5.8 Information security in project management
- 5.9 Inventory of information and other associated assets
- 5.10 Acceptable use of information and other associated assets
- 5.11 Return of assets