Threat intelligence for ISO 27001 (Annex A 5.7) in a small organisation
Threat intelligence sounds like something only big companies can afford. For ISO 27001 it means something much simpler: you follow a few reliable sources of information about threats relevant to you, review them regularly, and act on what matters.
A small organisation can meet this control in about an hour a month.
Why it matters
Annex A 5.7 (threat intelligence) was new in ISO/IEC 27001:2022. In summary, it asks you to collect and analyse information about information security threats, to produce threat intelligence you can act on.
That information should be relevant (to your sector, technology and suppliers), actionable (it leads to a decision), and used: to update risks, adjust controls, or warn staff.
Sources to follow
Good free sources for UK organisations:
- NCSC advisories and weekly threat reports.
- Your key vendors' security advisories: your cloud platform, email, firewall and operating systems.
- Your sector body, if it shares security alerts.
- Your managed IT provider, if you have one: ask what they see across their clients.
Choose a handful you'll actually read.
What an auditor looks for
- Named sources you follow, chosen for relevance.
- Regular reviews, recorded with a date and who did them.
- Decisions. For each relevant item, what you concluded and what you did: updated a risk, patched something, briefed staff, or "not relevant to us".
- A link to the rest of the ISMS: risks, vulnerabilities and awareness training.
Common reasons it fails: no record of reviews; a list of sources nobody reads; or intelligence that never leads to any action.
Common mistakes, and how to keep it manageable
- Too many sources. Three or four you read beats twenty you skim.
- Recording everything. Record what's relevant and what you did about it. You don't need to log every advisory.
- No follow-through. If something matters, raise a risk update or a task there and then.
How to do it in ClearIMS
- Open Threat intelligence and record the named sources you follow.
- Record each review: what you looked at, your decision on relevance, and which of your records it affects, such as a risk or an asset.
- Raise follow-up actions with owners and dates, and attach any evidence.
- Keep it on schedule. It's a review workspace for your own decisions, not a live threat feed, so set a regular review and let a recurring task remind you.
Related pages
- Risk register: where threats change your risk scores.
- Vulnerabilities: when intelligence points to a weakness you have.
- Incidents: when a threat becomes real.
- Training and competence: sharing what staff need to know.