Threat Intelligence & ISO 27002:2022 ' What's New?

• Published date: 26 September 2022
• Subject Matter: Technology, Security
• Law Firm: Ankura Consulting Group LLC
• Author: Amit Jaju and Amol Pitale

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) have ISO 27000 series which provides requirements for an information security management system (ISMS). They have revised the new information security standard ISO 27002:2022 from the earlier ISO 27002:2013. In the new standard, a new structure and several new controls have been introduced.

What's New?

In the new standard, the number of controls have decreased to 93 as a result of removal of few controls, merger of some controls, and addition of 11 new controls.

Control 5.7 - Threat Intelligence

A notable addition to the new standard is Control 5.7, which refers to Threat Intelligence. This covers the need for organizations to collect, analyze, and produce threat intelligence relating to information security threats. In today's environment of an ever-changing threat landscape, cyber threat intelligence allows firms to take preventative measures before an attack begins.

For maximum efficiency, ISO advises three aspects of intelligence.

What Organizations Should Do?

Start by assessing what is relevant for you and comparing the market trends with peers, combined with expert advice and valid, current data sets. Organizations should take a proactive approach by assembling their protection measures before there is a breach.

Relevance for ISO 27001 Certification

No immediate steps need to be undertaken since ISO/IEC 27001 has not been updated so far. But it is important to start reviewing and updating internal controls ahead of the anticipated ISO 27001:2022 update. These guidelines and best practices help better align with the ISO 27001 requirements to get certification. The inclusion of Threat Intelligence highlights...