Threat intelligence

Plain-language summary

New in 2022: gathering and analysing information about the threats relevant to your organisation and turning it into intelligence you act on — in risk assessments, technical defences, testing and awareness — instead of collecting alerts nobody reads.

What the clause is really asking

The point of this control is to stop treating threats as abstract. It asks you to gather information about threats that matter to you and analyse it until it becomes intelligence — something that informs a decision. Three levels are commonly described: strategic (how the threat landscape is changing and who targets organisations like yours), tactical (attacker methods, tools and techniques) and operational (specific campaigns and indicators such as malicious domains, IP addresses and file hashes). Useful intelligence is relevant to you, adds understanding, comes with context and points to an action. The process runs from objectives and sources, through collection and analysis, to the people who use the results — the risk owner, the team configuring email filtering, the awareness trainer. The common misunderstanding is that this needs a paid feed and a security operations centre. A proportionate approach works for most organisations: vendor advisories, CSIRT alerts, sector sharing groups and security tools already licensed. South African sources include alerts from the national Cybersecurity Hub, sector bodies such as SABRIC for banking, and vendors' published threat reports.

What auditors look for

Auditors ask what sources you use and who reviews them, then look for the analysis step — evidence that someone decided what was relevant to your organisation rather than forwarding every alert. They pick a recent item and trace it: received, assessed, acted on, communicated. Typical traces are a phishing campaign that led to an email filter rule and a staff warning, or an actively exploited vulnerability that moved a patch up the queue. They check whether threat information fed the last risk assessment. The hard question: name a threat that changed one of your controls in the past twelve months.

Typical evidence

Threat intelligence procedure with objectives, sources and responsibilities; list of sources and subscriptions; threat log showing items assessed, relevance decision and action taken; records of resulting changes such as blocked indicators, filter rules or patch reprioritisation; threat briefings to management or staff; risk assessment updates citing threat information.

How to comply — recommendations

Write a one-page threat intelligence procedure: what you want to know, which sources you use, who reviews them, how often, and where findings go. Start with free and existing sources — vendor advisories, national and sector CSIRT alerts, your security tools' threat dashboards and annual industry threat reports. Have the security lead review them weekly and log only relevant items with the decision and action: block, patch, warn staff, update a risk. Send a short quarterly threat summary to management and use it in the annual risk assessment. Feed operational indicators into email filtering, firewall and endpoint tools where they support it.

Common nonconformities

No threat intelligence process or defined sources; alerts collected but never analysed for relevance; no record of action taken on threat information; threat information not used in risk assessment; intelligence not passed to those who configure controls or deliver awareness; reliance on a single feed nobody reviews; sources never reviewed for continued relevance.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.