Contact with special interest groups

What the control asks

The organization is to join and stay in touch with special interest groups, specialist security communities and professional bodies. Purpose: keep useful information security knowledge flowing into and out of the organization. Guidance: membership of such groups or forums is worth considering as a way to learn good practice and stay informed; keep the organization's picture of the security environment current; get early notice of alerts, advisories and patches about attacks and vulnerabilities; reach specialist security advice; trade information on new technologies, products, services, threats and vulnerabilities; and have ready liaison points when handling security incidents (5.24 to 5.28).

Purpose in the standard’s terms, in our words: Keeps an appropriate flow of information security knowledge between the organization and specialist communities.

Attribute values in one line: Preventive, Corrective; Confidentiality, Integrity, Availability; Protect, Respond, Recover; Governance; Defence.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• A list of memberships in special interest groups, sector information sharing bodies, security forums and professional associations, with the named participant for each
• Records of alerts, advisories and patch notices received through these groups and how they were acted on
• Evidence of information exchanged, such as shared indicators or presentations, within the group's sharing rules
• Identified liaison contacts within these groups for use during incidents
• Periodic review of which memberships deliver value

Where audits commonly find gaps

• Memberships exist but advisories go to a personal mailbox and are never triaged
• No one is designated to participate, so membership lapses unnoticed
• Information received is not fed into vulnerability or threat processes
• Sharing rules of the group are not respected, creating confidentiality exposure

What ISO/IEC 27028 changes for this control

It carries more than one control type (preventive, corrective), so the register should record each and the evidence that proves each one operates. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (06.1.4) is kept in the register so an older audit file can still be traced.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.5 Contact with authorities
• 5.24 Information security incident management planning and preparation
• 5.37 Documented operating procedures

Read the five attributes All 93 controls