5.7 Threat intelligence
Requires information about information security threats to be collected and analysed so that it becomes usable threat intelligence. Supporting material frames this as gathering and applying intelligence proactively, to i
5
artefacts
1
held by a system
1
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Feedback records showing whether the intelligence proved relevant, used to refine the sources · Document repository
periodic reviewEvidence produced at each review
- Evidence that intelligence changed something, such as a rule added to detection, a control adjusted or a risk reassessed · Document repository
governing documentDocuments that govern the control
- The defined sources of threat information, covering strategic, tactical and operational levels · Document repository
- The process for analysing raw information into intelligence relevant to the organisation, naming who performs it · Document repository
- Intelligence products produced during the period and their distribution list · Document repository
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Document repository on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Feeds subscribed to but never contextualised, so generic threat reports are filed with no assessment of applicability
- Intelligence consumed by the security team alone and never reaching risk management or the business owners who would act on it
- No traceable outcome, so the control cannot be shown to be effective even though the process exists
- Intelligence limited to technical indicators, with no view of threat actors targeting the organisation's sector
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet5.6 Contact with special interest groups · 5.8 Information security in project management