A.5.7
Threat intelligence
Organizational controlsCheckpoints 5Evidence 5Cases 5
Control objective
This control requires the organization to collect, analyze, and use information about information security threats that may target it, so that the threat landscape is understood and addressed proactively. It calls for keeping current on attacker tactics/techniques/procedures (TTPs), targets, motivations, exploited vulnerabilities, and indicators of compromise (IOCs), and feeding that knowledge into risk assessment, detection/blocking rules, and the prioritization of safeguards. The aim is to shorten the time to recognize and respond to emerging threats and to keep defenses continuously aligned with the actual threat situation.
Key checkpoints
- Are internal and external sources and a collection procedure defined for threat information relevant to the organization?
- Is collected threat information analyzed at strategic, tactical, and operational levels, with source reliability and organizational relevance evaluated?
- Are analysis results reflected in real safeguards, such as risk assessment, detection rules, blocking policies, and vulnerability remediation priorities?
- Is threat information shared in a timely manner with relevant functions and stakeholders, such as incident response and monitoring teams?
- Are roles and responsibilities for threat intelligence assigned, and is the effectiveness of the activity reviewed and improved periodically?
Implementation guidance
- Identify internal sources (logs, incident history, vulnerability assessment results) and external sources (CERTs/response bodies, industry information sharing communities, security vendors, open-source feeds) and select them according to purpose.
- Analyze threat information by level: strategic (long-term threat trends), tactical (attacker TTPs), and operational (immediately usable indicators such as IOCs).
- Evaluate source reliability, timeliness, and organizational relevance to filter out false positives and noise, and assign priorities.
- Turn analysis into defense by feeding it into detection/blocking rules in SIEM/IPS/firewalls, risk assessment updates, and vulnerability remediation priorities.
- Structure threat information using standard formats and exchange protocols (for example, STIX and TAXII) and participate in trust-based sharing communities to enable two-way use of information.
- Assign roles and responsibilities for the threat intelligence process and document how outputs are used and fed back, so that the activity does not rely on the capability of a single individual.
Evidence
- Threat intelligence collection/analysis procedure and role/responsibility definition document
- List of threat information sources and status of subscriptions/contracts/community participation
- Periodic threat intelligence reports (strategic/tactical/operational levels)
- Records of threat information applied (detection rule change history, blocked IOC lists, risk assessment update records)
- Records of threat information sharing (internal distribution history, sends/receives with external sharing communities)
Nonconformity examples
- Threat information is only collected, with no analysis or use procedure, so it is never reflected in safeguards or detection rules.
- Threat information collection and analysis rely solely on one individual's capability, with no documented sources or procedures, so the work is not reproducible.
- External threat feeds are subscribed to but applied as-is without evaluating organizational relevance or reliability, causing a large volume of false positives.
- Information about an actively exploited new vulnerability is obtained but is not reflected in vulnerability remediation priorities.
- Threat intelligence results are not shared with the incident response/monitoring teams, so they cannot be used for actual detection and response.