Key takeaways
- Stay connected to security forums and industry groups to learn about threats.
- Industry groups and security forums give early warning of threats and practical knowledge you would otherwise learn the hard way.
- Start here: pick a few relevant groups: sector ISACs, local security meetups, vendor advisory lists.
Purpose
Stay connected to security forums and industry groups to learn about threats.
Requirement
Requirement summaryThe organization shall establish and maintain contact with special interest groups or other specialist security forums and professional associations.
Why it matters
Industry groups and security forums give early warning of threats and practical knowledge you would otherwise learn the hard way.
How to implement
- Pick a few relevant groups: sector ISACs, local security meetups, vendor advisory lists.
- Assign someone to follow them and share useful items internally.
- Record memberships and how insights feed into risk or threat intelligence.
- Review whether each group is still worth the time.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.6. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- A list of security groups, forums or professional bodies your organization belongs to or follows.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.6 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Membership confirmations, newsletter subscriptions or event attendance records.
- An example of useful information from these groups that was shared or acted on.
Things you should be able to show or explain
- Be able to explain how information from these groups is used.
How much to show: One or two recent examples.
Common mistakes
- Memberships listed but no sign of taking part.
- Useful information received but never used.
- Joining groups but never acting on what is learned.
- No record that the contact exists.
- Tip: Subscribe to your national CERT and a sector ISAC newsletter.
Policies & documents to have
- Human Resource Security Policy
- Information Security Roles and Responsibilities Policy
FAQ
Is A.5.6 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.6?
Be ready to explain how the control works in your organisation and to provide things like: A list of security groups, forums or professional bodies your organization belongs to or follows…