Contact with special interest groups
Purpose
Support the appropriate flow of security information by maintaining links with specialist groups and forums.
How to meet this control
In short: Maintain contact with security forums and professional associations.
- Step 01Take out membership or subscriptions with relevant groups (ACSC Partnership Program, an industry ISAC, AISA or OWASP) and record the joining details
- Step 02Assign named staff to monitor advisories and alerts from these groups and act on them
- Step 03Feed early warnings, patches and advisories received into the vulnerability and patch management process
- Step 04Log how external advice or shared intelligence has been used to inform decisions
- Step 05Use the groups as liaison points during incidents and record any engagement
Tip: Membership of a CERT or ISAC counts as evidence.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Join relevant special interest groups, security forums or professional associations
- ›Use membership to learn best practices and stay current with security developments
- ›Keep your understanding of the security environment up to date through these groups
- ›Receive early warnings, alerts, advisories and patches about threats and vulnerabilities
- ›Gain access to specialist security advice and expertise
- ›Exchange information about new technologies, products, threats and vulnerabilities
- ›Establish liaison points to help when handling security incidents
Audit evidence to keep
- - Evidence of membership of security forums or special interest groups (ACSC, AISA, ISAC)
- - Records of advisories or alerts received and the action taken in response
- - Subscription confirmations or attendance records for relevant security events
- - Notes showing specialist advice obtained through these groups
Common mistakes
- - Writing a policy but not operating the process
- - Keeping evidence in personal folders where auditors cannot trace it
- - Letting exceptions stay open with no owner or expiry date
Owner, cadence, and proof
Assign one accountable owner for A.5.6. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.