ISO 27001 Annex A 5.6 Contact with special interest groups
What it says
The organization shall establish and maintain contact with special interest groups or other specialist security forums and professional associations.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMaintain ties with security groups to stay updated on threats and best practices.
This control is about keeping in touch with groups and organisations that specialise in information security. Doing so helps you stay informed about the latest threats and how to protect against them. If you don't keep these connections, you risk missing out on critical updates that could protect your organisation from security breaches.
Free. Save your status, tasks and notes.
Why it matters
Lack of engagement with security groups can lead to missed threat intelligence, increasing the risk of undetected vulnerabilities and slower incident responses.
How to implement
The IT manager should join security groups and forums that focus on industry-specific threats and best practices.
This can be done by identifying reputable organisations online or through industry contacts and ensuring ongoing participation in discussions and updates.
The board should allocate resources for attending relevant security conferences and webinars.
This not only promotes continuous learning but also provides networking opportunities to connect with security professionals.
The compliance officer should ensure regular communication with these groups, sharing relevant information and receiving updates on threats.
This involves subscribing to newsletters, participating in forums, and attending events where leading experts discuss current security trends.
The HR department should include involvement in special interest groups as part of the ongoing security training programs for relevant staff.
This can be integrated into professional development goals to encourage engagement with larger security communities.
The overall security strategy team should periodically review memberships and participation in these groups to assess the value and relevance of continued association.
This ensures the organisation stays aligned with the most applicable and advantageous resources.
Keep it running
Join relevant security forums and ISACs; assign owners to monitor alerts, share summaries internally, and track actions from shared threat intel.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of memberships or subscriptions to security groups and forums.
Look at
The frequency and relevancy of these connections.
Good evidence
Active and ongoing engagement with at least several well-recognised security groups.
- Check 2 of 5What an auditor asks for
Ask for
To see evidence of participation in security conferences or webinars over the past year.
Look at
The topics and organisations hosting these events. GOOD means attending events that offer practical insights into emerging security threats and solutions.
- Check 3 of 5What an auditor asks for
Ask for
Records of internal discussions or reports that include information shared from these groups.
Look at
How this external information is integrated into the organisation's security policies. GOOD shows a clear link between shared information and security policy updates.
- Check 4 of 5What an auditor asks for
Ask for
Documentation or communication that details alerts or advisories received from these groups.
Look at
How quickly and effectively the organisation responds to these alerts. GOOD reflects processes in place for timely implementation of new security measures.
- Check 5 of 5What an auditor asks for
Ask for
To see professional development plans for staff that involve interaction with these groups.
Look at
The integration of this engagement into their roles. GOOD should demonstrate staff actively participating and applying information from these groups in their work.
Mappings
Closest match in ASD Information Security Manual: ISM-2000, Regular cyber security briefings for executives, which partially overlaps with this control.
ASD Information Security Manual: 1 mapping
This control partially overlaps ISM-2000.
Annex A 5.6 requires the organisation to establish and maintain ongoing contact with special interest groups and specialist security forums/professional associations. ISM-2000 requires executives to seek regular briefings on cyber posture and the threat environment from internal and external subject matter experts, which can be satisfied in part through sustained relationships with external security communities and professional networks. ISM-2000 is oriented to executive assurance and reporting rather than explicitly requiring organisational participation/contacts with security forums, so the overlap is partial.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.