ISO 27001 A.5.7: Threat Intelligence

Quick Reference: A.5.7 in 60 Seconds

What the Control Asks For

ISO 27001:2022 A.5.7 Text

ISO 27001:2022 Annex A 5.7 asks organizations to collect and analyze information about security threats to produce actionable threat intelligence.

Do you need this control?

A.5.7 is not mandatory in itself: under clause 6.1.3 you include it if your risk assessment calls for it, and record the decision in your Statement of Applicability. Include it where knowing about current threats changes your decisions, which is most organisations with internet-facing services. The scale varies widely: a small company can rely on free CERT-In advisories and vendor feeds; a bank may run a dedicated threat-intelligence function.

ISO 27002:2022 Implementation Guidance (Section 5.7)

In our own words, ISO 27002 says:

• Purpose: collect and analyse information about existing and emerging threats so you can act to prevent harm and reduce impact.
• Three layers to consider: strategic (the changing threat landscape, types of attackers and attacks), tactical (attacker methods, tools and technologies, i.e. TTPs) and operational (details of specific attacks, including technical indicators such as IOCs).
• Quality: intelligence should be relevant, insightful, contextual and actionable.
• Activities: set objectives; identify, vet and select internal and external sources; collect; process (translate, format, corroborate); analyse how it relates to you; and communicate it to the right people in a usable form.
• Use: feed it into your risk management process, into technical preventive and detective controls (firewalls, IDS, anti-malware) and into security testing.
• Share intelligence with other organisations on a mutual basis.

Auditors usually ask for one trail that shows intelligence changing something: a risk register entry, a blocked indicator or a detection rule, or a test that was added.

What Auditors Actually Check

The Threat Intelligence Lifecycle

The threat intelligence lifecycle is a continuous loop of six phases. Each phase feeds into the next, creating a self-improving system.

┌─────────────────────────────────────────────────────────────┐
│  1. PLANNING & DIRECTION                                    │
│  • Define intelligence requirements                         │
│  • Identify key questions to answer                         │
│  • Set objectives and priorities                            │
│  • Allocate resources                                       │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  2. COLLECTION                                              │
│  • Gather data from internal and external sources             │
│  • Automated feeds + manual research                        │
│  • Store raw data in centralized repository                   │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  3. PROCESSING                                              │
│  • Normalize and format data                                │
│  • Translate foreign language sources                        │
│  • Deduplicate and filter noise                             │
│  • Enrich with context (geography, industry, technology)    │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  4. ANALYSIS                                                │
│  • Assess relevance to your organization                      │
│  • Determine likelihood and impact                          │
│  • Map to MITRE ATT&CK techniques                             │
│  • Identify gaps in current defenses                        │
│  • Produce actionable recommendations                       │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  5. DISSEMINATION                                           │
│  • Package intelligence for audience                        │
│  • Strategic: Board/CISO briefing                           │
│  • Tactical (TTPs): SOC playbooks, detection rules          │
│  • Operational (specific attacks): IR procedures            │
│  • Technical indicators (part of operational): IOCs         │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  6. FEEDBACK & IMPROVEMENT                                  │
│  • Did the intelligence lead to action?                     │
│  • Was the intelligence accurate?                             │
│  • Did we prevent or detect the threat?                     │
│  • Update sources, processes, and priorities                │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
                    (Back to Planning)

Planning & Direction: Key Questions

The Four Types of Threat Intelligence

Strategic Intelligence Example

STRATEGIC THREAT INTELLIGENCE BRIEFING
Date: June 2026
Audience: Board of Directors

TOP 3 THREATS TO OUR ORGANIZATION:

1. SUPPLY CHAIN ATTACKS
   • Trend: 40% increase in software supply chain attacks in 2025
   • Impact: We use 200+ open-source dependencies
   • Risk: High — single compromised dependency could breach our entire platform
   • Mitigation: SBOM generation, dependency scanning, vendor security assessments

2. AI-POWERED SOCIAL ENGINEERING
   • Trend: Deepfake voice calls and AI-generated phishing emails increased 300%
   • Impact: Our CEO and CFO are high-value targets
   • Risk: Medium-High — wire transfer fraud could cost crores
   • Mitigation: Out-of-band verification for large transfers, voice authentication

3. RANSOMWARE TARGETING SAAS PROVIDERS
   • Trend: Ransomware groups now targeting cloud/SaaS infrastructure directly
   • Impact: Our AWS environment is a single point of failure
   • Risk: High — 72-hour downtime would cause significant lost revenue
   • Mitigation: Immutable backups, air-gapped recovery, incident response drills

RECOMMENDATION: Increase security budget by 25% for supply chain security and backup infrastructure.

Tactical Intelligence Example

TACTICAL THREAT INTELLIGENCE REPORT
Date: Week of June 15, 2026
Audience: SOC Team, IR Team

ACTIVE THREAT: "SILENT LYNX" CAMPAIGN

THREAT ACTOR: APT Group (Suspected nation-state, Asia-Pacific focus)

TACTICS:
• Initial Access: Spear-phishing with malicious PDF attachments
• Execution: Exploits CVE-2024-XXXX in Adobe Acrobat Reader
• Persistence: Registry run key modification
• C2: HTTPS communication to domains: evil-domain[.]com, bad-site[.]net

MITRE ATT&CK MAPPING:
• T1566.001 — Spear-phishing Attachment
• T1203 — Exploitation for Client Execution
• T1547.001 — Registry Run Keys
• T1071.001 — Application Layer Protocol: Web Protocols

INDICATORS OF COMPROMISE (IOCs):
• File Hash: a1b2c3d4e5f6... (malicious PDF)
• IP: 192.0.2.100, 192.0.2.101
• Domain: evil-domain[.]com, bad-site[.]net
• Registry Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Updater

RELEVANCE TO US:
• We use Adobe Acrobat Reader (confirmed vulnerable version on 3 endpoints)
• Our industry (fintech) is a known target of this group
• We received 2 suspicious PDFs in email last week (quarantined)

RECOMMENDED ACTIONS:
1. Update Adobe Acrobat Reader to latest version (IT-2026-0615)
2. Block IOCs on firewall and EDR (SOC-2026-0615)
3. Hunt for registry key on all endpoints (TH-2026-0615)
4. Review email quarantine for similar PDFs (SOC-2026-0615)
5. Brief all staff on PDF-based phishing (HR-2026-0615)

Threat Intelligence Sources

Internal Sources

External Sources (Free)

Building Your Threat Intelligence Program

Figure · Tiers

Maturity levels for threat intelligence

Threat Intelligence Program Maturity Model

Step-by-Step Implementation (Level 1 → Level 3)

Week 1: Define

• Identify 5 key questions your organization needs answered
• Select 5–10 free threat intelligence sources
• Create a simple threat intelligence log (spreadsheet)
• Assign a threat intelligence owner (CISO or security analyst)
• Schedule 30 minutes/week for threat review (e.g., Tuesday morning)

Week 2: Collect

• Subscribe to RSS feeds or email alerts from selected sources
• Set up Google Alerts for your organization name + "breach" or "hack"
• Join MISP community (free) or AlienVault OTX
• Set up dark web monitoring for leaked credentials (Have I Been Pwned)
• Configure SIEM to collect security events (if not already done)

Week 3: Analyze

• Review collected intelligence weekly
• Assess relevance: "Does this threat affect our technology, industry, or geography?"
• Map relevant threats to MITRE ATT&CK techniques
• Document analysis in threat intelligence log
• Update risk register with new threats or changed threat levels

Week 4: Disseminate & Act

• Create weekly threat summary email (3 bullets) for leadership
• Share relevant IOCs with SOC team for detection rules
• Share relevant vulnerabilities with IT for patching priority
• Add threat intelligence as standing agenda item in security meetings
• Document actions taken based on intelligence

Threat Intelligence Platforms & Tools

Platform Comparison Matrix

Tool Selection Decision Tree

┌─────────────────────────────────────────────────────────────┐
│  BUDGET?                                                    │
└─────────────────────────────────────────────────────────────┘
                              │
              ┌───────────────┼───────────────┐
              │                               │
              ▼                               ▼
        ┌─────────────┐               ┌─────────────┐
        └─────────────┘               └─────────────┘
              │                               │
              ▼                               ▼
    ┌─────────────────────┐         ┌─────────────────────┐
    │ MISP + OTX +        │         │ SIZE?               │
    │ VirusTotal +        │         └─────────────────────┘
    │ CISA KEV +          │               │
    │ RSS feeds           │    ┌──────────┼──────────┐
    │                     │    │          │          │
    └─────────────────────┘    ▼          ▼          ▼
                         ┌────────┐ ┌────────┐ ┌────────┐
                         │ Small  │ │ Medium │ │ Large  │
                         │ 1-50   │ │ 50-500 │ │ 500+   │
                         └────────┘ └────────┘ └────────┘
                             │          │          │
                             ▼          ▼          ▼
                        ┌────────┐ ┌────────┐ ┌────────┐
                        │ CERT-In ││Recorded││ThreatConnect│
                        │ MISP    ││Future  ││ Mandiant    │
                        │         ││ CrowdStrike││ Recorded Future│
                        └────────┘ └────────┘ └────────┘

MISP Setup Guide (Free, Open-Source)

MISP (Malware Information Sharing Platform) is the most popular open-source threat intelligence platform. It's used by 10,000+ organizations worldwide.

Step 1: Deploy MISP

## Docker deployment (easiest)
docker run -it --rm \
  -p 80:80 \
  -p 443:443 \
  # use the official MISP/misp-docker images (see github.com/MISP/misp-docker)

## Or use the official VM image
## https://www.circl.lu/misp-images/

Step 2: Configure Feeds

• Go to Sync Actions → List Feeds
• Enable default feeds: CIRCL, NIST, CISA, etc.
• Add custom feeds: CERT-In, NCSC, vendor-specific
• Schedule automatic feed fetching (hourly or daily)

Step 3: Create Events

• When you discover a threat, create a MISP event
• Add attributes: IPs, domains, file hashes, email addresses
• Tag with MITRE ATT&CK techniques
• Set distribution: Organization only, Community, Connected communities, All communities

Step 4: Integrate with SIEM

## Example: Fetch MISP events for Splunk
import requests

misp_url = "https://misp.your-org.com"
api_key = "YOUR_API_KEY"

headers = {
    "Authorization": api_key,
    "Accept": "application/json",
    "Content-Type": "application/json"
}

## Get recent events
response = requests.get(
    f"{misp_url}/events/restSearch",
    headers=headers,
    json={"returnFormat": "json", "last": "1d"}
)

events = response.json()
## Send to Splunk via HEC
for event in events:
    # Format and send to Splunk
    pass

Step 5: Share Intelligence

• Join sharing communities (CIRCL, FIRST, sector-specific)
• Share sanitized IOCs with trusted partners
• Consume community intelligence to enrich your own

Threat Intelligence for SaaS & Cloud Environments

Cloud-Specific Threat Intelligence Sources

Cloud Threat Intelligence Priorities

Cloud Threat Intelligence Integration

# Example: Terraform for threat-driven blocking (illustrative; test before use)
# Block IPs from a threat intelligence feed automatically

resource "aws_wafv2_ip_set" "threat_intel_blocklist" {
  name               = "threat-intel-blocklist"
  description        = "IPs from threat intelligence feed"
  scope              = "REGIONAL"
  ip_address_version = "IPV4"
  # data.external returns a map of strings, so the feed script returns a comma-separated list
  addresses          = split(",", data.external.threat_intel_ips.result.ips)
}

resource "aws_wafv2_web_acl" "main" {
  name        = "threat-intel-protected"
  description = "WAF with threat intelligence blocklist"
  scope       = "REGIONAL"

  default_action {
    allow {}
  }

  rule {
    name     = "ThreatIntelBlock"
    priority = 1

    action {
      block {}
    }

    statement {
      ip_set_reference_statement {
        arn = aws_wafv2_ip_set.threat_intel_blocklist.arn
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "ThreatIntelBlock"
      sampled_requests_enabled   = true
    }
  }
}

MITRE ATT&CK Framework Integration

Why MITRE ATT&CK Matters

MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It's the standard language for describing cyber threats.

Benefits for Threat Intelligence:

• Common language: Everyone describes threats the same way
• Gap analysis: "We have detection for T1566 but not T1059"
• Prioritization: Focus on techniques used by actors targeting your industry
• Reporting: "APT41 uses T1566.001 and T1203" is more precise than "they use phishing"
• Detection engineering: Map detection rules to ATT&CK techniques

How to Use ATT&CK for Threat Intelligence

Step 1: Map Your Threats

Threat: "Silent Lynx" Campaign
├── T1566.001 — Spear-phishing Attachment (Initial Access)
├── T1203 — Exploitation for Client Execution (Execution)
├── T1547.001 — Registry Run Keys (Persistence)
├── T1071.001 — Application Layer Protocol: Web Protocols (C2)
└── T1041 — Exfiltration Over C2 Channel (Exfiltration)

Step 2: Map Your Defenses

Defense Coverage for "Silent Lynx":
├── T1566.001 — Email security gateway ✅ (detects malicious PDF)
├── T1203 — EDR + application control ✅ (blocks exploit)
├── T1547.001 — EDR + registry monitoring ✅ (detects run key)
├── T1071.001 — Network monitoring ✅ (detects C2 traffic)
└── T1041 — DLP + network monitoring ✅ (detects exfiltration)

Step 3: Identify Gaps

Gap Analysis:
├── T1566.001 — No user training on PDF phishing ❌ (GAP)
├── T1203 — Adobe Reader not fully patched ❌ (GAP)
├── T1547.001 — Registry monitoring noisy, needs tuning ⚠️ (IMPROVE)
├── T1071.001 — HTTPS inspection not enabled ❌ (GAP)
└── T1041 — DLP not monitoring cloud uploads ❌ (GAP)

Step 4: Prioritize Actions

Priority Matrix:
├── HIGH: Patch Adobe Reader (T1203) — Easy fix, high impact
├── HIGH: Enable HTTPS inspection (T1071.001) — Critical for C2 detection
├── HIGH: Add user training (T1566.001) — Prevents initial access
├── MEDIUM: Tune registry monitoring (T1547.001) — Reduce noise
└── MEDIUM: Extend DLP to cloud (T1041) — Prevent data loss

ATT&CK Navigator for Threat Intelligence

Use the ATT&CK Navigator to:

• Visualize your detection coverage
• Overlay threat actor techniques
• Identify coverage gaps
• Generate coverage reports for auditors

Threat Intelligence Metrics & KPIs

Threat Intelligence Program Scorecard

Threat Intelligence on a Budget

Starter Programme (small team, small budget)

Expanded Programme (larger or higher-risk organisation)

Automation: STIX/TAXII & APIs

STIX/TAXII Explained

• STIX (Structured Threat Information Expression), Standard format for representing threat intelligence (JSON/XML)
• TAXII (Trusted Automated Exchange of Intelligence Information), Protocol for exchanging STIX data over HTTPS

Together, they enable automated threat intelligence sharing between organizations and tools.

Free TAXII Feeds

Python: Consume TAXII Feed

import requests
from stix2 import parse

## CISA AIS TAXII feed (example)
taxii_url = "https://<your-taxii-2.1-server>/taxii2/"  # e.g. a CISA AIS or sector TAXII 2.1 endpoint
headers = {
    "X-TAXII-Content-Type": "urn:taxii.mitre.org:message:xml:1.1",
    "Accept": "application/xml"
}

response = requests.get(taxii_url, headers=headers)
## Parse STIX objects and extract IOCs
## Add IOCs to your firewall, EDR, or SIEM

Python: VirusTotal API for IOC Enrichment

import requests
import os

VT_API_KEY = os.environ.get("VIRUSTOTAL_API_KEY")

def check_ip_reputation(ip_address):
    url = f"https://www.virustotal.com/api/v3/ip_addresses/{ip_address}"
    headers = {"x-apikey": VT_API_KEY}
    response = requests.get(url, headers=headers)
    data = response.json()
    
    malicious_votes = data["data"]["attributes"]["last_analysis_stats"]["malicious"]
    total_votes = sum(data["data"]["attributes"]["last_analysis_stats"].values())
    
    return {
        "ip": ip_address,
        "malicious_score": malicious_votes,
        "total_score": total_votes,
        "reputation": "Malicious" if malicious_votes > 5 else "Suspicious" if malicious_votes > 0 else "Clean"
    }

## Example usage
result = check_ip_reputation("192.0.2.100")
print(result)
## {'ip': '192.0.2.100', 'malicious_score': 12, 'total_score': 75, 'reputation': 'Malicious'}

Python: Check Domain Against Threat Feed

import requests

def check_domain_against_urlhaus(domain):
    url = "https://urlhaus-api.abuse.ch/v1/host/"
    headers = {"Content-Type": "application/x-www-form-urlencoded"}
    data = {"host": domain}
    
    response = requests.post(url, headers=headers, data=data)
    result = response.json()
    
    if result.get("query_status") == "ok":
        urls = result.get("urls", [])
        return {
            "domain": domain,
            "malicious_urls": len(urls),
            "threat": "Malicious" if len(urls) > 0 else "Clean"
        }
    return {"domain": domain, "threat": "Unknown"}

## Example usage
result = check_domain_against_urlhaus("evil-domain.com")
print(result)
## {'domain': 'evil-domain.com', 'malicious_urls': 3, 'threat': 'Malicious'}

India-Specific Threat Intelligence

Indian Threat Landscape

India faces unique threat challenges:

• High mobile malware rates: India has one of the highest mobile malware infection rates globally
• UPI fraud: Digital payment fraud is a massive and growing threat
• APAC-targeted APTs: Chinese and Pakistani APT groups actively target Indian organizations
• Supply chain risks: Heavy reliance on Chinese hardware and software creates supply chain vulnerabilities
• Data localization requirements: check sector rules (RBI, SEBI) and CERT-In's log-retention direction before sending threat data to overseas platforms
• Skill shortage: Shortage of trained cybersecurity professionals

India-Specific Intelligence Sources

India-Specific Threat Intelligence Priorities

AI/ML Threat Intelligence

AI-Generated Threats

AI-Powered Threat Intelligence (Defensive)

Integration with SOC & SIEM

Threat Intelligence → SOC Workflow

┌─────────────────────────────────────────────────────────────┐
│  1. THREAT INTELLIGENCE FEED                                  │
│  (MISP, TIP, vendor feed, government alert)                  │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  2. IOC ENRICHMENT                                            │
│  • Check reputation (VirusTotal, GreyNoise)                  │
│  • Check if IOC seen in our environment (SIEM query)        │
│  • Check if IOC already blocked (firewall/EDR)             │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  3. PRIORITIZATION                                            │
│  • Relevance to our environment?                              │
│  • Is it already blocked?                                     │
│  • Has it been seen in our logs?                              │
│  • What is the threat actor's targeting?                      │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  4. ACTION                                                    │
│  • Block IOC (firewall, EDR, DNS, email gateway)            │
│  • Create detection rule (SIEM, EDR, IDS)                    │
│  • Hunt in logs (retroactive search)                         │
│  • Alert SOC (high-priority ticket)                           │
│  • Update risk register (if new threat)                       │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  5. FEEDBACK                                                  │
│  • Did the detection work?                                    │
│  • Were there false positives?                                │
│  • Did we find any compromised systems?                       │
│  • Update intelligence quality assessment                   │
└─────────────────────────────────────────────────────────────┘

SIEM Integration Example: Splunk

## Splunk ES: Threat Intelligence Framework
## Automatically matches IOCs against all logs

## 1. Enable Threat Intelligence Framework
Settings → Data Inputs → Threat Intelligence Downloads

## 2. Add custom threat feeds
Name: CERT-In_Malicious_IPs
Type: csv
URL: <your TIP or MISP export URL>  (CERT-In publishes advisories as web pages, not an IOC CSV)
Interval: 3600 (1 hour)

## 3. Enable adaptive response actions
When IOC match found:
- Create notable event (high priority)
- Enrich with VirusTotal (automated)
- Create Jira ticket for SOC analyst
- Send Slack alert to #security-alerts

## 4. Dashboard: Threat Intelligence Matches
index=notable 
| stats count by threat_match_type, threat_match_value, src_ip, dest_ip
| sort -count

SIEM Integration Example: Microsoft Sentinel

## Microsoft Sentinel: Threat Intelligence Connector
## Connects to MISP, TAXII, or custom feeds

## 1. Deploy Threat Intelligence solution
Content Hub → Threat Intelligence → Deploy

## 2. Add MISP connector
Data Connectors → MISP → Configure
Server: https://misp.your-org.com
API Key: [your API key]

## 3. Create analytics rule
Name: TI Match - High Priority
Query: ThreatIntelIndicators   (the newer Microsoft Sentinel table; older workspaces use ThreatIntelligenceIndicator)
| where Active == true and ConfidenceScore > 70
| project TimeGenerated, IndicatorId, ThreatType, ConfidenceScore, SourceIP

## 4. Automated response
When alert triggered:
- Create incident (severity: High)
- Run playbook: Block IP in Azure Firewall
- Notify SOC team via Teams

Threat Intelligence-Driven Vulnerability Prioritization

The Problem: CVSS Doesn't Tell the Whole Story

CVSS scores tell you how severe a vulnerability is technically, but not whether attackers are actually exploiting it. Threat intelligence closes this gap.

Threat-Enhanced Vulnerability Scoring

Vulnerability Prioritization Matrix

Patch timelines are owned by your vulnerability management process (A.8.8); the timings below are examples of how threat intelligence changes priority.

Automated Prioritization: Python Script

import requests
from datetime import datetime, timedelta

## Fetch CISA KEV list
cisa_kev = requests.get("https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv").text

## Fetch your vulnerability scan results
vulnerabilities = [
    {"cve": "CVE-2024-XXXX", "cvss": 8.5, "asset": "web-server-01", "exploit_available": True},
    {"cve": "CVE-2024-YYYY", "cvss": 7.2, "asset": "db-server-01", "exploit_available": False},
]

def prioritize_vulnerability(cve, cvss, exploit_available):
    # Check if CVE is in CISA KEV
    in_kev = cve in cisa_kev
    
    # Calculate priority score
    score = cvss
    if in_kev: score += 2.0
    if exploit_available: score += 1.5
    
    if score >= 9.0: return "CRITICAL", "24 hours"
    if score >= 8.0: return "HIGH", "72 hours"
    if score >= 7.0: return "HIGH", "7 days"
    if score >= 6.0: return "MEDIUM", "14 days"
    if score >= 4.0: return "MEDIUM", "30 days"
    return "LOW", "90 days"

for vuln in vulnerabilities:
    priority, sla = prioritize_vulnerability(vuln["cve"], vuln["cvss"], vuln["exploit_available"])
    print(f"{vuln['cve']} on {vuln['asset']}: {priority} — Patch within {sla}")

Governance & Roles

Threat Intelligence Governance Structure

┌─────────────────────────────────────────────────────────────┐
│  THREAT INTELLIGENCE GOVERNANCE BOARD                         │
│  • Meets quarterly                                            │
│  • Reviews program effectiveness                              │
│  • Approves budget and resources                              │
│  • Members: CISO, SOC Manager, IT Director, Legal              │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  THREAT INTELLIGENCE MANAGER / LEAD                           │
│  • Owns the threat intelligence program                       │
│  • Manages sources, collection, analysis, dissemination         │
│  • Reports to CISO                                            │
│  • Skills: Threat analysis, OSINT, malware analysis, network forensics│
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  THREAT INTELLIGENCE ANALYST(S)                               │
│  • Collect and analyze threat data                            │
│  • Produce intelligence reports                               │
│  • Maintain IOC blocklists                                    │
│  • Support incident response with intelligence                │
│  • Skills: SIEM, EDR, malware analysis, Python, OSINT       │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  SOC ANALYSTS (Consumers)                                     │
│  • Use threat intelligence for detection and response         │
│  • Provide feedback on intelligence quality                     │
│  • Report sightings of IOCs in environment                    │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  ALL STAFF (Human Sensors)                                    │
│  • Report suspicious emails, calls, activity                    │
│  • Complete threat awareness training                           │
│  • Follow reporting procedures                                  │
└─────────────────────────────────────────────────────────────┘

RACI Matrix for Threat Intelligence

Training & Awareness

Threat Intelligence Training Curriculum

Threat Intelligence Awareness Program

• Monthly threat briefing email: Top 3 threats to the organization, 1-minute read
• Weekly threat digest: For security team, 5-minute summary of week's threats
• Quarterly tabletop exercise: Simulate a threat-based incident (e.g., "APT41 targets us")
• Annual threat landscape review: Complete review of year's threats and lessons learned
• Security awareness posters: "Threat of the Month" with simple protection steps

Implementation Roadmap: 4 Weeks

90-Day Program Maturity Plan

Common Audit Failures & How to Fix Them

Illustrative Scenarios: Real Intelligence in Action

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome.

Case 1: The Log4j Response (2021)

What happened: Log4j vulnerability (CVE-2021-44228) was disclosed in December 2021. Organizations with threat intelligence programs responded faster and more effectively.

Intelligence-driven response:

• Day 0 (Dec 9): Threat intelligence team identified the vulnerability within hours of disclosure via CISA alert and Twitter/X security researchers
• Day 1: Intelligence team assessed relevance: "We use Log4j in 12 applications. Exploit code is public. Mass exploitation is underway."
• Day 1: Risk register updated: Log4j added as Critical risk with 24-hour treatment deadline
• Day 2: IOCs collected from threat feeds (known exploitation IPs, domains, payloads)
• Day 2: SOC team deployed detection rules for Log4j exploitation attempts
• Day 3: All 12 applications patched or mitigated (WAF rules, Log4j upgrade)
• Week 1: Continuous monitoring for exploitation attempts via SOC and threat feeds

Lessons for A.5.7:

• Threat intelligence enabled 3-day response instead of 3-week response
• Integration with risk management and SOC was critical
• Free sources (CISA, Twitter/X, vendor blogs) were sufficient for initial response
• Having a process meant everyone knew their role and timeline

Case 2: The SolarWinds Supply Chain Attack (2020)

What the public record shows: attackers inserted a backdoor (SUNBURST) into SolarWinds Orion updates; about 18,000 customers installed the affected versions, and a much smaller number were actively exploited. FireEye (now Mandiant) discovered the compromise while investigating a breach of its own tools and published indicators in December 2020.

Intelligence lessons:

• Rapid public sharing of indicators by the first victim helped thousands of organisations check their exposure
• Supply chain risk belongs in threat intelligence priorities (link to A.5.21)
• Validate vendor security claims and monitor vendor advisories

Illustrative Scenario 3 (hypothetical): An Indian Fintech Phishing Wave

What happened: A coordinated phishing campaign targeting Indian fintech companies used UPI-themed emails to steal credentials. 15+ companies affected, with attempted fraud running into crores of rupees.

Intelligence-driven defense (successful company):

• Week 1: Commercial threat-intelligence alert about a UPI phishing trend targeting Indian fintech
• Week 1: Threat intelligence team assessed: "We are fintech. We use UPI. This is highly relevant."
• Week 2: CERT-In advisory confirmed the campaign
• Week 2: Email security team updated filters for UPI-themed phishing keywords
• Week 2: Security awareness team sent "UPI Phishing Alert" to all staff
• Week 3: SOC detected and blocked 47 phishing emails targeting the company
• Week 4: No successful breaches. Competitors without intelligence program had 3 breaches.

Lessons for A.5.7:

• India-specific intelligence (CERT-In and commercial providers) is critical for Indian organizations
• Timely communication of intelligence to all staff prevented breaches
• Free + paid sources combined for complete coverage
• Intelligence-driven awareness is more effective than generic training

Multi-Framework Mapping

FAQ

What is the minimum requirement for A.5.7?

A working process + evidence of analysis + evidence of action. In practice:

1. A procedure for collecting and analysing threat intelligence (writing it down is good practice, not an ISO requirement)
2. A list of identified sources (internal and external)
3. Evidence that someone regularly reviews the intelligence (logged entries, meeting minutes)
4. Evidence that the intelligence influenced a decision (risk register update, control change, IOC block, etc.)

Can we just use a paid threat intelligence platform and pass the audit?

No, auditors specifically look for human analysis. A SaaS platform alone is not enough. You need evidence that:

• Someone reviewed the intelligence
• Someone assessed relevance to your organization
• Someone took action based on the intelligence
• The process is documented, not just the tool output

How much time does threat intelligence require?

Do we need a dedicated threat intelligence analyst?

Not for small organizations. A small company (1-50 employees) can have the CISO or IT manager spend 30 minutes per week on threat intelligence. Medium companies (50-500) should have a security analyst dedicate 1-2 hours per week. Large companies (500+) should have a dedicated threat intelligence analyst or team.

What if we can't afford a threat intelligence platform?

Free tools are sufficient for A.5.7 compliance. MISP (free, open-source), AlienVault OTX (free), VirusTotal (free tier), CISA KEV (free), CERT-In (free), and 30 minutes per week of analyst time are enough to pass an ISO 27001 audit. The platform helps with efficiency and scale, but it's not required for compliance.

How do we integrate threat intelligence with our risk register?

Quarterly cross-reference: Review your threat intelligence log and ask:

• "Which threats from the past quarter affect our risk register?"
• "Do any risks need their likelihood or impact updated?"
• "Do we need new risks based on emerging threats?"
• "Did any intelligence validate or invalidate our current risk assessments?"

Document these updates in the risk register with the threat intelligence source cited.

What is STIX/TAXII and do we need it?

STIX/TAXII are standards for automated threat intelligence sharing. You need them if:

• You want to automate IOC sharing between tools (SIEM, firewall, EDR)
• You want to join threat sharing communities (ISACs, sector groups)
• You have a mature program with multiple tools

For basic A.5.7 compliance, STIX/TAXII are not required. Manual processes (spreadsheet, email, wiki) are sufficient.

Advanced Threat Intelligence Concepts

Sector-Specific Threat Intelligence Sources

Banking and Financial Services:

• FS-ISAC (Financial Services Information Sharing and Analysis Center): Global financial threat intelligence
• CSIRT-Fin (financial-sector CSIRT under CERT-In) and IB-CART (IDRBT): India-specific financial sector alerts
• RBI Cyber Security Alerts: Circulars and advisories on emerging threats
• NPCI Security Bulletins: UPI, IMPS, RuPay-specific threat intelligence
• SWIFT CSP Intelligence: For organizations using SWIFT messaging

Healthcare:

• H-ISAC (Health ISAC): Global healthcare threat intelligence
• MoHFW Cybersecurity Alerts: Ministry of Health advisories
• Medical Device Security Alerts: FDA, CDSCO alerts on device vulnerabilities

Government and Critical Infrastructure:

• NCIIPC (National Critical Information Infrastructure Protection Centre): Critical infrastructure threat alerts
• CERT-In Advisories: Mandatory for government organizations
• MeitY Security Guidelines: Sector-specific security directives
• National Cyber Coordination Centre (NCCC): Macro-level threat situational awareness

IT/ITeS and SaaS:

• Cloud Security Alliance (CSA): Cloud-specific threat intelligence
• Vendor Security Advisories: AWS, Azure, GCP security bulletins
• Bug Bounty Intelligence: HackerOne, Bugcrowd reports on common vulnerabilities

Threat Intelligence Automation

Automation Tier 1, Basic (Free Tools):

• CERT-In RSS feed → Email alert
• CISA KEV JSON → Weekly spreadsheet update
• MISP → Manual CSV export to SIEM

Automation Tier 2, Integrated (Commercial/Open Source):

• TIP platform → STIX/TAXII → SIEM/EDR
• SOAR playbook: New IOC → Auto-block firewall → Alert SOC → Create ticket
• Threat feed → Auto-enrich alert with threat context

Automation Tier 3, Advanced (Enterprise):

• AI/ML-based threat prediction
• Automated threat hunting queries
• Self-healing security controls (auto-patch, auto-isolate)
• Predictive risk scoring based on threat landscape

Threat Intelligence and Incident Response Integration

Pre-Incident Phase:

• Threat intelligence feeds populate watchlists and detection rules
• Threat actor TTPs map to MITRE ATT&CK for detection engineering
• Vulnerability intelligence prioritizes patching

During Incident:

• IOCs from threat intelligence accelerate containment (known bad IPs, file hashes)
• Threat actor profiles inform response strategy (ransomware groups vs. nation-state APTs)
• External intelligence confirms scope ("This threat actor typically targets X, Y, Z")

Post-Incident:

• Incident data enriches internal threat intelligence
• New IOCs extracted and distributed to security controls
• Lessons learned update threat models and detection rules
• Intelligence shared with industry peers (via ISACs) if appropriate

Building an Internal Threat Intelligence Team (India Context)

Team Structure for Indian Organizations:

Outsourcing vs. In-House:

• Micro organizations (< 50 employees): Fully outsource to an MSSP or managed threat-intelligence service
• Small organizations (50-200): Hybrid, in-house analyst + external TIP feed
• Medium organizations (200-1000): In-house team (2-3 analysts) + external ISAC membership
• Large organizations (1000+): Full in-house team + external intelligence partnerships

Legal and Ethical Considerations in Threat Intelligence

Legal Boundaries:

• Do not hack back or actively disrupt threat actors (illegal under IT Act 2000)
• Do not share personal data of suspected threat actors without legal authorization
• Do not use deceptive engagement with real people (fake personas in criminal forums) without legal clearance; honeypots on your own infrastructure are lawful and widely used
• Do obtain proper authorization for internal monitoring and data collection
• Do comply with DPDP Act 2023 when processing personal data for threat intelligence

Ethical Guidelines:

• Share intelligence responsibly, anonymize where appropriate
• Do not share intelligence with malicious intent or for competitive advantage in unethical ways
• Respect vendor confidentiality when sharing vulnerability information
• Give credit to original intelligence sources
• Maintain objectivity, do not exaggerate threats for budget or attention

Indian Legal Context:

• Section 43A of IT Act 2000: Compensation for failure to protect data, applies to threat intelligence data too
• Section 69: Government power to intercept, organizations must have legal basis for monitoring
• DPDP Act 2023: Consent and purpose limitation for data processing
• CERT-In Directions 2022: Mandatory reporting of incidents, threat intelligence may trigger reporting obligations

Additional FAQ

Q11: How do we measure the ROI of threat intelligence? A: Measure incidents prevented (estimated efficiency gains), mean time to detect reduction, vulnerability remediation speed, and audit compliance.

Q12: Can we use AI for threat intelligence analysis? A: Yes, AI/ML tools can process vast amounts of threat data, identify patterns, and predict emerging threats. However, human analysts are still essential for context, judgment, and decision-making. Use AI as a force multiplier, not a replacement.

Q13: How do we handle threat intelligence in a multi-cloud environment? A: Use cloud-native threat intelligence services (AWS GuardDuty, Microsoft Sentinel, GCP Security Command Center) and aggregate them into a central TIP or SIEM. Ensure cloud provider threat feeds are integrated with on-premise security controls.

Q14: What is the role of threat intelligence in board reporting? A: Summarize threat landscape in business terms: "We identified X active threats targeting our sector, Y vulnerabilities exploited in the wild, and Z incidents prevented this quarter. Recommended investment: [specific control]." Use metrics, not technical jargon.

Q15: How do we integrate threat intelligence with vendor risk management? A: Monitor threat intelligence for vendor-specific vulnerabilities (e.g., CVEs in your vendors' products). Subscribe to vendor security advisories. Include threat intelligence requirements in vendor contracts ("Vendor must share threat intelligence relevant to their products within 24 hours").

Q16: Should we participate in threat intelligence sharing communities? A: Yes, ISACs and sector-specific sharing groups provide invaluable peer intelligence. In India, consider FS-ISAC (finance), H-ISAC (healthcare), and CERT-In sectoral programs. Start as a consumer of intelligence; contribute as your maturity grows.

Q17: How do we handle false positives in threat intelligence? A: Implement a feedback loop: analyst reviews alerted IOCs, validates true/false positive, updates whitelist/blacklist. Track false positive rate monthly. Tune detection rules based on intelligence context. Use reputation scoring (not all IOCs are equally reliable).

Q18: What is the difference between tactical, operational, and strategic threat intelligence? A: In ISO 27002's terms, tactical intelligence is about attacker methods, tools and technologies (TTPs), used for detection and hunting. Operational intelligence is about specific attacks, including technical indicators (IPs, hashes, domains) used for blocking. Strategic intelligence is high-level trends (threat actor motivations, industry targeting) for executive decision-making. All three are needed for a complete program.

Q19: How do we handle threat intelligence during a merger or acquisition? A: Conduct threat intelligence assessment of the target company's exposure before acquisition. Check if their IP ranges, domains, or executives appear in threat actor targeting. Post-acquisition, integrate their threat intelligence into your program and apply your standards to their environment.

Q20: Can threat intelligence help with compliance beyond ISO 27001? A: Absolutely. Threat intelligence supports DPDP Act 2023 (security safeguards), RBI Cyber Security Framework (threat monitoring), SEBI CSCRF (2024), and PCI DSS (threat awareness). A single threat intelligence program serves multiple compliance requirements.

Indian Threat Landscape, 2026 Overview

Active Threat Actors Targeting India

Top 10 Threat Vectors in India (2026)

1. Phishing and Social Engineering: the most common initial access route in CERT-In advisories
2. Ransomware: a leading cause of serious incidents for Indian organisations
3. Supply Chain Attacks: Third-party software compromise increasing
4. Credential Stuffing: Reuse of breached credentials from Indian breaches
5. Insider Threats: Data theft by departing employees, contractor misuse
6. Cloud Misconfiguration: Exposed S3 buckets, open databases
7. IoT and OT Vulnerabilities: Smart city devices, industrial control systems
8. Mobile Banking Trojans: Android malware targeting UPI apps
9. Business Email Compromise (BEC): Invoice fraud, CEO fraud targeting Indian exporters
10. DDoS: Extortion-driven attacks on e-commerce during festivals

CERT-In Statistics

CERT-In publishes annual figures through its annual reports and government statements in Parliament (for example, about 1.59 million incidents handled in 2023 and about 2 million in 2024, as reported in government answers). Use the latest official figure, with its source, when you brief management.

Indian Regulatory Context for Threat Intelligence

Indian organizations should integrate CERT-In, NCIIPC and sector-specific advisories into their threat intelligence program. CERT-In publishes periodic alerts on malware campaigns, vulnerabilities and attack trends affecting Indian entities, while NCIIPC shares threat intelligence for critical information infrastructure. RBI and SEBI circulars expect regulated entities to monitor threat intelligence and incorporate relevant indicators into security monitoring. The DPDP Act 2023 adds a data-protection lens: threat intelligence must not inadvertently process personal data without a lawful basis, and breach indicators that reveal a personal data breach must trigger Section 8(6) intimation. We recommend that Indian companies subscribe to at least one India-focused threat feed, participate in industry forums such as DSCI and relevant ISACs, and document how external intelligence is actioned within 24 hours.