Skip to main content
All measures

Measure · ISO 27001

Maintain security contacts and use threat intelligence

Keep relevant authority and specialist contacts usable. Select reliable sources, assess information for your operations and maintain decisions through the existing process.

Accountable: ISMS coordination with incident coordination, responsible business roles and operationsReviewed

Reuse existing records

Reuse the existing contact and source section in incident or operational procedures. Keep actual reports in the case record, technical remediation in the operational or change record and risk decisions in the leading risk inventory. No new contact policy or separate threat catalogue is needed.

What to do

  1. 1

    Establish contacts and information needs

    Identify authorities relevant to your activities and jurisdictions and the purpose of each contact. Establish who contacts them and when; use reporting obligations from the leading obligations and incident procedures. Also choose suitable security groups, specialist forums or associations for warnings, experience exchange and support. Establish what you need to know about your services, sector, threat actor trends and attack methods.

  2. 2

    Maintain official routes and reliable sources

    Check authority responsibilities and contact or reporting channels against the official source. Keep required access, ownership and cover in the existing contact inventory, including relevant outage situations. Maintain specialist exchange routes and selected internal and external sources. Check their reliability and currency; collect relevant information, corroborate it where needed and prepare it in an understandable form.

  3. 3

    Analyse the meaning for your operations

    Relate information to your own information assets, other assets, technologies and processes. Consider strategic changes such as threat actor or sector trends, tactical methods and tools, and operational information about specific attacks. Establish exposure, possible effects, uncertainty and required action. A feed or contact list alone does not replace this analysis.

  4. 4

    Use results and keep exchange current

    Provide relevant findings promptly and understandably to the responsible roles. Initiate suitable risk decisions, safeguard adjustments, vulnerability prioritisation or security tests through existing processes. Share suitable findings with others while observing permitted recipients, confidentiality and agreements. Also use authority contacts to understand current or upcoming expectations. Keep sources, contacts and ownership current when material changes occur; check usable routes without unjustified external test reports.

Worked example

A sector warning affects your service

Fictional example: a maintained specialist exchange channel warns about an attack method against an access solution in use.

Information and organisational context
DecisionThe responsible person checks the source, technology in use and accessible entry points. Operations checks protection and relevant events; the risk owner considers necessary changes. For an actual incident, the existing coordination uses the prepared official contacts.
EvidenceThe existing operational or risk record links the source, assessment, decision and result. Contacts remain in their leading location.

Record the result

  • Existing maintained contacts and sources with purpose, responsible role and usable channel.
  • Contextual assessment with source, affected area, uncertainty and understandable communication.
  • Linked decision and actual use in risks, safeguards or tests; required reporting in the existing case.

Common implementation mistakes

Treat authorities and specialist groups alike

Distinguish official responsibility and reporting routes from voluntary professional exchange.

Create a separate threat record for every notice

Analyse relevant findings traceably and use the existing business record.

Assume a native integration is required

Sources and existing tools can be used manually. What matters is usable intelligence, not a particular connector.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards
  • A.5.5 · Kontakt mit BehördenGerman guide

    The workflow establishes relevant authorities, triggers, ownership and official usable routes, maintains them and uses authority information to understand expectations. Actual contact and reporting follow the circumstances.

  • A.5.6 · Kontakt mit speziellen InteressengruppenGerman guide

    Maintained specialist contacts enable relevant information flow, exchange and support. Significant findings reach the responsible roles; no mandatory membership catalogue is required.

  • A.5.7 · BedrohungsintelligenzGerman guide

    Information needs, suitable internal and external sources, preparation and contextual analysis produce understandable actionable intelligence. Strategic, tactical and operational perspectives and use in risks, safeguards and testing are included.

Templates for your implementation

Related resources

Sources and further reading