Control 5.7 asks you to collect information about threats and analyse it so you can act. It is new in ISO 27001:2022. A small team does not need a paid feed to start. Existing logs, vendor advisories and a written process for using what you learn can satisfy it.
What the control wants
The purpose is to gather threat information and analyse it so the organisation can take suitable mitigation action. That means a process, not a product. The process should say where information comes from, who reads it and what happens next.
Where the information can come from
The guidance names three kinds of source:
- Technology you already use, such as software, hardware and networks.
- Internal systems, for example fault logs from systems, servers and network devices.
- Alerting tools that report new threats, vulnerabilities and incidents, such as SIEM systems. Larger companies are more likely to need these.
For a small company, the practical route is to extract threat information from existing systems like fault logs and describe the process in an incident management procedure.
What to do with it
Threat information is only useful if it changes something. The guidance suggests using it to:
- Add preventive controls to IT systems.
- Improve risk assessment.
- Introduce new security testing methods.
A simple habit helps: when a relevant advisory or incident report arrives, note whether it changes a risk rating, a control or a test, and record the answer.
A light process in four steps
- List your sources: vendor security pages, advisories for your main technologies, internal logs.
- Name who reviews them and how often.
- Record decisions: no action, update a risk, add a control, add a test.
- Review the log at the management review.
People and documents
Make staff aware of why threat information matters, and train them on how threats are reported and to whom. Documents are recommended but not mandatory: an incident management procedure for small companies, and a threat intelligence procedure for mid sized and larger ones.
What the auditor may ask
Auditors may check whether information about threats is gathered and analysed. Have a few dated examples ready showing an input, a decision and the change that followed.
An example entry
A dated log entry might read: advisory received for a library we use in the API, we are exposed through one service, risk rating raised from medium to high, patch scheduled, a regression test added. That single line shows an input, an analysis and a resulting change, which is what the control is after. Ten such entries over a year tell a better story than a purchased feed nobody reads.
Quick check
Do we have to buy a threat feed?
The guidance does not say so. Existing logs and system sources can be used, and larger companies are more likely to need dedicated alerting tools.
Is a threat intelligence procedure mandatory?
No. It is recommended for mid sized and larger companies. Smaller ones can cover it in an incident management procedure.
Sources
Last reviewed: 19 October 2026.
