Contact with special interest groups

What the requirement asks

The organization is to join and stay in touch with special interest groups, specialist security communities and professional bodies. Purpose: keep useful information security knowledge flowing into and out of the organization. Guidance: membership of such groups or forums is worth considering as a way to learn good practice and stay informed; keep the organization's picture of the security environment current; get early notice of alerts, advisories and patches about attacks and vulnerabilities; reach specialist security advice; trade information on new technologies, products, services, threats and vulnerabilities; and have ready liaison points when handling security incidents (5.24 to 5.28). In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Special interest groups give access to threat and practice information. The guidance asks which groups the organization belongs to, who represents it and what was brought back and used.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep A list of memberships in special interest groups, sector information sharing bodies, security forums and professional associations, with the named participant for each and one live sample together.

Evidence an assessor asks for

• External security communityA list of memberships in special interest groups, sector information sharing bodies, security forums and professional associations, with the named participant for each
• External security communityRecords of alerts, advisories and patch notices received through these groups and how they were acted on
• External security communityEvidence of information exchanged, such as shared indicators or presentations, within the group's sharing rules
• External security communityIdentified liaison contacts within these groups for use during incidents
• External security communityPeriodic review of which memberships deliver value

The question an assessor will ask

An assessor will ask for A list of memberships in special interest groups, sector information sharing bodies, security forums and professional associations, with the named participant for each, then trace it to the system it protects. For A.5.6 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Memberships exist but advisories go to a personal mailbox and are never triaged
• No one is designated to participate, so membership lapses unnoticed
• Information received is not fed into vulnerability or threat processes
• Sharing rules of the group are not respected, creating confidentiality exposure

Before the next audit

Before the next audit, check one live sample for this gap: memberships exist but advisories go to a personal mailbox and are never triaged.