ISO 27001 Annex A 5.7 Threat intelligence collection and analysis
What it says
Information relating to information security threats shall be collected and analysed to produce threat intelligence.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishGather and study threat information to improve your security measures and readiness.
Imagine learning about potential threats before they can harm your business. That's what threat intelligence is about. It helps you understand what dangers are out there so you can better protect your organisation's confidential information, operations, and reputation.
Free. Save your status, tasks and notes.
Why it matters
Without threat intelligence, critical attack patterns can be missed, leaving the organisation vulnerable to emerging threats.
How to implement
The IT manager should establish clear objectives for gathering threat intelligence.
These can include understanding what information is most vital to protect and which threats pose the greatest risk. Hold workshops or meetings to identify these priorities with input from leadership and key operational staff.
Procurement should look into credible sources for gathering threat intelligence.
These sources can be external, like government advisory reports, or internal, such as logs from your own systems. Ensure these sources are reputable and relevant to your industry by reviewing past performance or user reviews.
The security team should analyse the collected information.
Break down the data to understand the potential threats and how they relate to your current security measures. Use team meetings to discuss findings and develop insights on how these threats might impact your business.
The IT department should integrate threat intelligence into existing security processes.
This means regularly updating security systems like firewalls and anti-malware based on new threat data. Conduct training sessions for staff to explain any adjustments made to security protocols.
Management should encourage sharing threat intelligence with other organisations, like industry groups.
This can improve the overall security posture for your sector. Facilitate information exchange by participating in cross-organisational workshops or using online platforms dedicated to threat sharing.
Keep it running
Validate threat intel sources, correlate feeds with internal logs, and triage findings so only actionable intelligence drives controls.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask how threat information is collected and which sources are used, for example vendor advisories, ACSC alerts, threat feeds or industry sharing groups; this can be shown in a document or demonstrated live.
Look at
Look at the sources in use and recent examples of threat information that was collected from them.
Good evidence
Threat information is being collected from identifiable sources and recent examples can be produced.
- Check 2 of 5What an auditor asks for
Ask for
Ask for evidence that threat information has actually been collected, such as feed records, subscriptions or logs of received advisories.
Look at
Examine a sample of recent items to confirm they relate to information security threats and were captured from the identified sources.
Good evidence
Recent samples show threat information being received and recorded from the sources described, not just a plan on paper.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the records or working files that show how collected threat information is analysed.
Look at
Check that the analysis considers what the threat means for the organisation rather than simply storing the raw information.
Good evidence
Analysis records show that collected information is reviewed and interpreted, with conclusions recorded about its relevance and significance.
- Check 4 of 5What an auditor asks for
Ask for
Ask for examples of the threat intelligence produced from the collected and analysed information.
Look at
Confirm the outputs are derived from the collected information and the analysis performed on it, and that they can be traced back to their inputs.
Good evidence
Threat intelligence outputs exist, are clearly based on the collected information and its analysis, and are traceable to their sources.
- Check 5 of 5What an auditor asks for
Ask for
Ask for a demonstration of the end-to-end process, following one recent threat from initial collection through analysis to the resulting threat intelligence.
Look at
Trace the item through each step to confirm that collection, analysis and production of threat intelligence all took place as described.
Good evidence
A recent item can be walked through every step, with evidence at each stage showing the process operates as documented.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML2.8, Cyber security events are analysed in a timely manner, which partially overlaps with this control.
ASD Essential Eight: 5 mappings
This control partially overlaps E8-AC-ML2.8.
Annex A 5.7 requires organisations to collect and analyse information security threat information to produce threat intelligence. E8-AC-ML2.8 overlaps by requiring timely analysis of cyber security events to identify incidents, which contributes operational indicators and patterns that can be incorporated into threat intelligence. E8-AC-ML2.8 is narrower and operational (event analysis for incident identification), while Annex A 5.7 also covers external threat sources and broader intelligence products for prevention and preparedness.
This control partially overlaps E8-MF-ML2.9.
Annex A 5.7 requires organisations to collect and analyse information about information security threats to produce actionable threat intelligence. E8-MF-ML2.9 relates by requiring timely analysis of cyber security events to identify incidents, which is one important internal source of threat intelligence. However, E8-MF-ML2.9 is focused on operational event triage/incident identification rather than broader external and strategic threat intelligence collection and analysis covered by Annex A 5.7.
This control supports E8-PO-ML3.5.
E8-PO-ML3.5 requires organisations to apply critical driver patches within 48 hours based on vendor criticality or known working exploits. Annex A 5.7 requires collection and analysis of threat information to produce threat intelligence, which can inform whether exploits are active and where driver vulnerabilities are being weaponised. This threat intelligence supports prioritisation and justification for rapid patching in E8-PO-ML3.5, but it does not mandate patch deployment timeframes.
This control depends on E8-PA-ML3.1.
E8-PA-ML3.1 requires urgent patching within 48 hours when vendors rate vulnerabilities as critical or when working exploits exist for key application categories. Annex A 5.7 requires collection and analysis of threat information to produce threat intelligence, which supports identifying exploit activity and prioritising the urgent remediation events that trigger E8-PA-ML3.1. Annex A 5.7 does not mandate patch deployment timelines or specify the application classes covered by E8-PA-ML3.1.
This control depends on E8-PO-ML3.6.
E8-PO-ML3.6 requires organisations to patch non-critical driver vulnerabilities within one month when no working exploits exist. ISO/IEC 27001:2022 Annex A 5.7 supports this by driving collection and analysis of threat information that can inform whether exploit code exists or is emerging for driver vulnerabilities, affecting how the E8-PO-ML3.6 condition is assessed. Annex A 5.7 does not mandate patch deployment timeframes, but improves the quality of decisions behind E8-PO-ML3.6's exploit-based condition.
ASD Information Security Manual: 6 mappings
This control partially overlaps ISM-2116.
ISM-2116 requires organisations to use cyber threat intelligence services to support detection of cyber security events and identification of incidents. ISO/IEC 27001 Annex A 5.7 requires collecting and analysing threat-related information to produce threat intelligence, which is a direct input to (or can be met via) the intelligence "services" ISM-2116 expects to be consumed. The overlap is the intelligence lifecycle element (collection/analysis vs consumption), while ISM-2116 is explicitly about operationalising intelligence in detection and incident identification rather than producing it.
This control supports ISM-1696.
ISM-1696 requires applying critical OS patches within 48 hours when vendors assess vulnerabilities as critical or when working exploits exist. ISO/IEC 27001:2022 Annex A 5.7 requires collecting and analysing threat information to produce threat intelligence, which can inform whether working exploits exist and drive prioritisation decisions for patching. Annex A 5.7 does not require patch application, but it strengthens the decision inputs and triggers that help organisations meet ISM-1696 timeframes.
This control supports ISM-2039.
Annex A 5.7 requires collection and analysis of threat information to produce threat intelligence. ISM-2039 supports this by requiring the software threat model to be reviewed through the SDLC to reflect changes to the threat environment, which typically relies on current threat intelligence inputs. ISM-2039 is limited to application/system threat modelling, whereas Annex A 5.7 is organisation-wide and includes establishing processes for ongoing threat intelligence production.
This control supports ISM-2153.
ISM-2153 mandates quarterly threat hunting to be informed by current cyber threat intelligence. Annex A 5.7 requires the collection and analysis of threat information to produce intelligence, which is crucial for conducting intelligence-led hunts. ISM-2153 focuses on operational hunting, while Annex A 5.7 establishes the intelligence capability.
This control depends on ISM-1203.
ISM-1203 requires system owners, in consultation with the system's authorising officer, to conduct a threat and risk assessment for each system. Annex A 5.7 (Threat Intelligence Collection and Analysis) supports ISM-1203 by providing the threat information inputs needed to identify credible threat actors, attack methods, and likelihoods during the assessment. Annex A 5.7 focuses on collecting/analysing threat information, whereas ISM-1203 focuses on performing the system-specific risk assessment and documenting risk decisions.
- ISM-1526System owners continuously monitor security and manage threats, risks and controlsDepends on
This control depends on ISM-1526.
ISM-1526 requires system owners to monitor each system and its associated cyber threats, security risks and controls on an ongoing basis. ISO/IEC 27001:2022 Annex A 5.7 supports this by requiring the collection and analysis of threat information to produce threat intelligence that can feed system threat/risk monitoring. The ISM control is broader and governance-focused, while Annex A 5.7 is specifically about producing threat intelligence as an input.
ASD Essentials for enterprise IT: 2 mappings
- IT.IDE-04.1Feed continuously reviewed threat intelligence and weaknesses into risk assessmentsPartially overlaps
This control partially overlaps IT.IDE-04.1.
IT.IDE-04.1 requires relevant weaknesses, malicious actor techniques and cyber threat behaviours to be identified as inputs to risk assessments and reviewed on a continuous basis. Identifying actor techniques and threat behaviours relies on the same collection and analysis of threat information that ISO/IEC 27001 Annex A 5.7 requires to produce threat intelligence. IT.IDE-04.1 is directed specifically at risk assessment and also covers weaknesses, while Annex A 5.7 addresses producing threat intelligence for any purpose.
- IT.PRO-06.3Remediate or mitigate above-threshold vulnerabilities within defined timeframes and verify effectivenessSupports
This control supports IT.PRO-06.3.
IT.PRO-06.3 requires vulnerabilities exceeding defined risk thresholds to be remediated or mitigated within defined timeframes, with prioritisation that explicitly considers exploitation. Judging whether a vulnerability is being exploited relies on the threat intelligence that Annex A 5.7 requires the organisation to collect and analyse, so IT.PRO-06.3 depends on that capability as an input. Annex A 5.7 covers threat intelligence generally and does not itself require any vulnerability treatment.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.