ISO 27001 Threat Intelligence (Annex A 5.7): Turning ASD Alerts and Your Security Tools into Audit Evidence

Most ISO 27001 systems meet control 5.7 with one sentence in the information security policy and a subscription to the cyber.gov.au alert service. The sentence says the organisation “monitors threat intelligence”. The subscription goes to an inbox nobody owns.

That is the gap auditors find, and it is the same gap the Victorian Information Commissioner found in the Department of Education breach: the advisory arrived on time, and nobody could show what happened next. This guide covers what 5.7 actually asks for, where your threat intelligence already comes from (much of it is in tools you pay for), and the record that turns it into evidence. There is a free register at the end.

Short answer

ISO 27001 Annex A control 5.7 asks you to collect information about threats to your information security and analyse it to produce threat intelligence you can act on. It was new in the 2022 revision. Collecting is the easy part: ASD’s alerts, your Microsoft Defender or AWS console, and your vendors’ advisories already supply plenty. The part auditors test is the decision trail: for each relevant item, whether it affects you, what you did, and how it fed your risk assessment.

What control 5.7 actually asks for

The control itself is a single sentence. The guidance in ISO/IEC 27002:2022 fills it out, and three ideas from it matter in practice.

Intelligence is not the same as information. A feed of alerts is information. Intelligence is what you get after someone has asked “does this affect us, and what should we do?” The guidance describes intelligence that is relevant, insightful, contextual and actionable. An alert about a product you do not run is none of those.

It works at three levels. The guidance splits threat intelligence into three layers. In plain terms, for a business of 20 to 200 people:

It is a process, not a feed. The guidance describes a cycle: decide what you need to know, choose and vet sources, collect, process, analyse, and communicate the result to the people who need it. It also expects the output to feed back into risk management, technical controls and testing.

Where your threat intelligence already comes from

Most organisations do not need a paid threat intelligence feed. They need to use what they already have.

ASD’s Australian Cyber Security Centre

• Alerts and advisories. The free alert service at cyber.gov.au is the operational backbone for any Australian ISMS. When ASD says it is aware of active exploitation in Australia, that is about as relevant as intelligence gets. We set out how to subscribe in the alerts and groups worth following.
• Joint advisories. ASD regularly co-seals advisories with the FBI, CISA, the UK’s NCSC and others. On 8 October 2026, for example, it co-sealed an advisory on China-linked actors exploiting eight known vulnerabilities to steal email. These are tactical intelligence: techniques, not just patches.
• The Annual Cyber Threat Report. Strategic intelligence for management review. The 2024–25 edition, released in October 2025, reported more than 1,200 incidents responded to and an average self-reported cost of cybercrime for small business of $56,600 per report.
• The Cyber Security Partnership Program. ASD’s partnership program gives organisations closer access to ASD’s advice. Its Cyber Threat Intelligence Sharing (CTIS) platform, which is two-way, is open to ASD Cyber Security Network Partners, and ASD and Microsoft built a plugin, which Microsoft describes as free to download, so Microsoft Sentinel customers can connect to it.

Microsoft Defender XDR

If you have Microsoft 365 Business Premium (which includes Defender for Business), Microsoft 365 E5, or another Microsoft Defender product, open Threat analytics in the Defender portal. Each report describes an active threat, actor or vulnerability, and then shows your own exposure: affected devices, related incidents and recommended actions. It is the closest thing most small businesses have to an analyst who has already done the “does this affect us?” step.

Access requires a licence for at least one Microsoft Defender product; Defender for Endpoint Plan 1 on its own does not include it. Note that Microsoft retired the standalone Defender Threat Intelligence (MDTI) subscription on 1 August 2026 and folded its content into Defender XDR and Microsoft Sentinel, so older guides that point to a separate MDTI portal are out of date.

Microsoft Sentinel and Azure

If you run Microsoft Sentinel, its threat intelligence features import indicators from external feeds, including standards-based TAXII feeds, and match them against your logs. This is also where the CTIS plugin sits. Microsoft Defender for Cloud raises alerts for Azure workloads, and those belong in the same triage process.

AWS

Amazon GuardDuty generates findings from AWS’s own threat detection, and lets you add your own threat lists of known-bad IP addresses, domains and file hashes (up to six of each list type per account per Region), plus trusted lists to suppress noise. That is a practical place to load indicators from an ASD advisory or a vendor bulletin.

Your own vendors

The advisories that matter most are often the least glamorous: the security bulletins for the firewall, VPN, accounting system and line-of-business software you actually run. The Mathspace breach turned on a vendor patch published four days before the attack. This is where your asset register earns its keep. If you do not know what you run, you cannot tell which advisories are yours.

The step most systems skip: triage

Collection without triage is how a business ends up with 400 unread alerts and no evidence. The fix is a single short decision for each item that might be relevant:

1. Does it affect us? Check it against the asset register. Yes, no, or “checking”, with a date.
2. If yes, what will we do, and by when? Patch, change a configuration, block an indicator, brief staff, or accept the risk with a reason.
3. Who owns it? A named person, not “IT”.
4. Is it closed? Date and how you know.

Most items will be “no, we don’t run that”. Recording that is still worth doing, because it shows the process ran. The items that matter link straight into other controls: A.8.8 (technical vulnerabilities) for patching, the incident controls (A.5.24 to A.5.27) if it turns out you were hit, A.8.16 (monitoring) if you load indicators into your tools, and clause 6.1 when a threat changes the likelihood of a risk you already hold.

What an auditor will ask for

When we audit 5.7, the subscribing is almost never the problem. These are the questions that separate a working control from a sentence in a policy:

• What are your sources, and why those? A short list with an owner and a review frequency for each.
• Who reviews them, and how often? Weekly for operational alerts is a sensible default for most small businesses.
• Show me three. The auditor picks items from the last quarter and asks you to trace each from receipt to decision. This is where an unowned inbox fails.
• What changed because of it? At least one example of intelligence changing a risk rating, a control or a priority.
• Where does it reach management? Changes in external and internal issues, and the results of risk assessment, are required inputs to management review under clause 9.3.

The same trace-three approach belongs in your own clause 9.2 internal audit, so you find the gap before the certification body does.

Right-sizing it

ISO 27001 does not require a threat intelligence platform, a security operations centre or a paid feed. It requires a process proportionate to your risks.

• Small business: one owner, a 15-minute weekly review of ASD alerts, Defender Threat analytics or GuardDuty findings, and vendor bulletins, recorded in a register. A monthly summary goes to whoever runs management review, and the year’s register is an input to the annual review.
• Larger or higher-risk organisations: indicators fed automatically into Sentinel, GuardDuty or a SIEM, CTIS membership, and tactical intelligence shaping detection rules and testing.

Both meet the control. What fails is the version with no owner and no record.

Free download: Threat Intelligence Register

Download the Threat Intelligence Register (Excel). It opens with a short read-me, then has four working tabs:

• Sources: each source, its layer (strategic, tactical, operational), owner and review frequency, prefilled with the Australian sources above.
• Register: one row per item: date, source, summary, whether it affects you and which assets, decision, action, owner, due date and closure, with a link to the risk or incident it touched.
• Summary: counts that update themselves, ready for management review.
• Standards mapping: how each column maps to ISO 27001 clauses and Annex A controls.

Frequently asked questions

Is threat intelligence mandatory in ISO 27001?

Control 5.7 is in Annex A, so your Statement of Applicability must either include it or record a justification for excluding it. In practice it is very hard to justify excluding, because almost every organisation faces threats it could learn about in advance.

Do we need to pay for a threat intelligence feed?

No. ASD’s alerts, advisories and annual report are free, and many organisations already have threat intelligence inside Microsoft Defender, Sentinel or AWS GuardDuty. The standard asks for a process proportionate to your risks, not a particular product.

Is subscribing to cyber.gov.au alerts enough for 5.7?

Not on its own. The subscription covers collection. The control also needs analysis: a record of whether each relevant alert affects you and what you did about it.

How often should we review threat intelligence?

Weekly for operational alerts suits most small and medium businesses, with same-day action when ASD reports active exploitation of something you run. Strategic intelligence, such as ASD’s Annual Cyber Threat Report, belongs at management review.

What happened to Microsoft Defender Threat Intelligence?

Microsoft retired the standalone Defender Threat Intelligence subscription on 1 August 2026 and moved its content into Microsoft Defender XDR, through Threat analytics, and Microsoft Sentinel. Access now comes through a Defender or Sentinel licence.

What evidence do auditors want for control 5.7?

A defined list of sources with owners, a record of items reviewed with decisions and actions, at least one example of intelligence changing a risk or control, and evidence that threats reach management review.

How is 5.7 different from 5.6?

Control 5.6 is about maintaining contact with special interest groups, forums and professional associations. Control 5.7 is about turning threat information into decisions. The groups you join under 5.6 are often a source for 5.7.

Where Streamline fits

Streamline builds and audits ISO 27001 information security management systems for Australian organisations, and you deal directly with a practising ISO Lead Auditor. If your 5.7 evidence is a policy sentence and an inbox, an internal audit will show you exactly what is missing, and ISO mentoring suits teams that want to build the process themselves. For the wider picture, see what the Annex A controls actually cover, or get in touch.

Sources

• ISO/IEC 27001:2022, Annex A control 5.7, and ISO/IEC 27002:2022, control 5.7 guidance
• Australian Signals Directorate, Annual Cyber Threat Report 2024–2025, and the Minister for Defence media release, 14 October 2025
• Australian Signals Directorate, Join the Cyber Threat Intelligence Sharing service through Sentinel, and ASD’s Cyber Security Partnership Program
• Microsoft Australia, Microsoft and ASD join forces: uniting Sentinel and CTIS
• Microsoft Learn, Threat analytics in Microsoft Defender XDR
• Microsoft Tech Community, MDTI is converging into Microsoft Sentinel and Defender XDR
• Amazon Web Services, GuardDuty entity lists and IP address lists
• FBI, CISA, NSA and partners including ASD’s ACSC, joint advisory AA26-281A, 8 October 2026

This article is general information from an auditing and management system perspective. Product features and licensing change often; check the vendor’s current documentation.