A.5.6
Contact with special interest groups
Organizational controlsCheckpoints 5Evidence 5Cases 5
Control objective
This control establishes and maintains ongoing contact with information security special interest groups, security forums, professional associations, information sharing and analysis centers (ISACs), and threat information sharing communities. Its purpose is to let the organization rapidly obtain current information on threats, vulnerabilities, attack techniques, and response good practice from external expert networks, keeping internal security knowledge up to date and enabling proactive response to new risks. It requires trusted relationships and points of contact to be secured in advance so that external expertise and support can be drawn on when an incident or emergency occurs.
Key checkpoints
- Is a list maintained of the special interest groups/security forums/ISACs/professional associations to participate in, selected to suit the organization's sector, technology stack, and threat environment?
- Are the point of contact, responsible person, and mode of participation (membership, subscription, two-way sharing) set for each group, with a backup person designated for absences?
- Is the threat/vulnerability information obtained externally actually reflected in internal risk assessment, patch management, vulnerability remediation, and awareness activities?
- When sharing information with external groups, are the scope and procedure controlled so that the organization's confidential information/personal data/internal configuration details are not exposed inappropriately?
- Is the effectiveness of participation (timeliness and usefulness of the information obtained) reviewed periodically and the set of groups updated?
Implementation guidance
- Define the types of information the organization needs (vulnerability alerts, threat intelligence, regulatory/technology trends, response good practice) and list the external groups/forums/communities that meet each need.
- Document the point of contact and backup person, means of contact, and participation level for each group, and keep this current as personnel change.
- Establish an internal handling flow that classifies/evaluates the information obtained and links it into risk assessment, patch management, vulnerability remediation, and incident response procedures.
- Define recipients, permitted information, and review/approval procedures for external sharing. Allow limited sharing of undisclosed vulnerabilities with suppliers or response bodies through an authorized coordinated disclosure process, while minimizing personal data and internal confidential details.
- Define the internal dissemination path and emergency response trigger (escalation) for when an early warning of a threat/vulnerability is received.
- Define contacts by position/job rather than by an individual's informal network, so the relationship is handed over when a person changes.
- Review the value of participation periodically, retiring low-value channels and adding needed ones.
Evidence
- List of special interest groups/security forums/ISACs/associations participated in, and the responsible person designation document
- Proof of membership/subscription and participation history (meeting minutes, newsletter receipt, forum activity records)
- Records showing externally obtained threat/vulnerability information reflected in internal handling (risk assessment/patch/vulnerability remediation)
- Records of review/approval and scope control when sharing information
- History of internal dissemination and response actions after receiving an early warning
Nonconformity examples
- Participation in special interest groups relies on an individual's informal network, so the contact relationship is severed when that person leaves or is absent.
- External forums/newsletters are only subscribed to, but the threat/vulnerability information obtained is not reflected in risk assessment or patch management at all.
- Internal system configuration/asset details are exposed without review while sharing information with external groups.
- The list of groups and the responsible person designation are not documented, so actual activity cannot be verified.
- An early warning of a new vulnerability is received, but there is no internal dissemination/response procedure, so remediation is delayed.