What it asks for. This control expects information relating to information security threats to be collected and analysed to produce threat intelligence. It was new in the 2022 edition.
In practice. Good practice means defining what threat information is relevant to the organisation, collecting it from suitable sources such as vendors, national CSIRTs and sector groups, and analysing it to inform decisions. Intelligence is used in risk assessment, detection and vulnerability prioritisation. Auditors look for defined sources, records of analysis and examples of actions taken based on intelligence.
Common gaps. Typical gaps are subscribing to feeds without analysis, intelligence not shared with the teams that can act on it and no link to risk management. Intelligence sources are also seldom reviewed for relevance and quality.