What evidence does ISO 27001:2022 5.7 need?

Statement of Applicability entry for control A.5.7, showing inclusion or justified exclusion, implementation status and the risks it treats. Documented threat intelligence objectives and a process covering collection, processing, analysis and dissemination. A list of vetted internal and external intelligence sources with the rationale for selection

5.7 of ISO 27001:2022, stated here in our words and cited to that clause.

Does it map to the other framework?

Yes, to 1 criteria in the other framework, each with a confidence and a reason. A link is a topical overlap, not a legal equivalence.

ISO 27001:2022 5.7 evidence: Threat intelligence

ISO 27001:2022 5.7: Threat intelligence

ISO 27001:2022 5.7 covers Threat intelligence. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.5.7, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Feeds are subscribed to but nobody analyses what they mean for the organization.

Information about security threats is to be gathered and examined so that it yields threat intelligence. Purpose (stated in ISO/IEC 27002:2022): makes the organization aware of the threats it faces so fitting mitigations can be chosen. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 5.7.

What evidence supports 5.7?

Annex A organizational controlStatement of Applicability entry for control A.5.7, showing inclusion or justified exclusion, implementation status and the risks it treats
Annex A organizational controlDocumented threat intelligence objectives and a process covering collection, processing, analysis and dissemination
Annex A organizational controlA list of vetted internal and external intelligence sources with the rationale for selection
Annex A organizational controlThreat intelligence outputs at strategic, tactical and operational levels, such as landscape briefings, attacker technique summaries and indicator feeds
Annex A organizational controlEvidence that intelligence updated the risk assessment or risk register

Where this requirement comes from

This is our own statement of ISO 27001:2022 5.7, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.

Common gaps an assessor flags

Feeds are subscribed to but nobody analyses what they mean for the organization
Only operational indicators are consumed and strategic or tactical intelligence is ignored
Intelligence does not reach risk management or the teams running detective controls
Sources are never evaluated for reliability or relevance

How it maps to SOC 2

CC3.2 medium Threat intelligence informs risk analysis but is not a risk identification process.

A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.