What it asks for. The organisation should establish and maintain contact with special interest groups, security forums and professional associations. These contacts help keep knowledge current and provide early warning.
In practice. Security staff take part in sector information sharing groups, national or industry ISACs, professional bodies and vendor security communities. Information received, such as threat alerts, is assessed and acted on, and the organisation shares in return where appropriate and permitted. Membership and participation are recorded. Evidence includes a list of memberships, examples of advisories received and acted on, and any rules for handling shared information.
Common gaps. Membership is often held by one person and lapses when they leave. Alerts received from these groups are read informally but not fed into vulnerability or threat management processes.