A.5.7
Threat intelligence
ISO 27001 · ISO/IEC 27001:2022 · Last verified July 2026
Objective
Collect and analyze information about information security threats so it can inform risk decisions and prioritize defenses.
Points of focus
- Relevant threat sources identified: cloud/platform advisories, dependency and container scanning, vendor security bulletins, sector-specific alerts
- A named person or channel triages incoming intelligence on a defined cadence
- Credible threats feed into the risk register or trigger a patch/mitigation ticket
- Sources are reviewed periodically for continued relevance as the stack changes
Implementation notes
Wire dependency scanning such as Dependabot or Snyk, cloud provider security bulletins, and any vendor advisories that affect the production stack into a single triage point — a ticket queue or channel with a named owner and an SLA by severity. Record the decision for each item, even 'not applicable, no exposure,' so there is a dated trail an auditor can sample. Feed anything credible into the risk register rather than treating threat intelligence as a disconnected activity that lives only in a policy document. Revisit the source list when you add a new cloud provider, database, or major dependency — threat intelligence scoped to last year's stack misses this year's exposure.
Audit tip: Pick one CVE from the last quarter that affected your stack — via Dependabot, npm audit, or an AWS bulletin — and walk the auditor from alert to ticket to patched deploy with timestamps. A subscription list with no worked example is a paper control.
Evidence auditors typically request:
- List of subscribed sources: AWS/GCP/Azure security bulletins, GitHub Dependabot alerts, CISA or sector ISAC feeds
- Slack channel or ticket queue where advisories are triaged with a decision recorded — act, monitor, or not applicable
- A sample ticket tracing one CVE from alert to patched dependency with dates
- Security meeting notes showing periodic review of open threat-intel items
Common gaps
- Dependency and vulnerability alerts flow into an inbox or channel nobody is assigned to monitor
- High-severity CVEs affecting production dependencies sit open for months with no documented risk acceptance
- Threat intelligence is a slide in the risk assessment deck with no link to an actual triage record
- Sources were reviewed once at ISMS setup and never revisited as the tech stack changed
Cross-Framework Mapping
| Framework | Requirement | Implementation note |
|---|---|---|
| ISO 27001 | A.5.7 | This control |
| SOC 2 | CC7.1 | CC7.1 expects a process to identify vulnerabilities from internal and external sources — the same triage log usually covers both frameworks without extra work. |
Primary sources
- ISO/IEC 27001:2022 Annex A: ISO/IEC 27001:2022 Annex A (A.5.7)