February 28, 2024

ISO 27001:2022 Annex A Control 5.6: Contact With Special Interest Groups

Annex 5.6 of the 2022 version of the ISO 27001 standard can be mapped to ISO 27001:2013 Annex 6.1.4.

Full name

Share this post

A woman smiles while using a tablet, surrounded by digital notifications and a data chart.

There are times when an industry, sector or even a like-minded group of organisations can improve performance and advance best practice by collaborating and communicating openly. The collective term for these groups, networks or bodies has been termed special interest groups within the 2022 version of the ISO 27001 standard.

Annex 5.6 of the ISO 27001 standard reflects the value that an organisation can gain from interacting with special interest groups such as professional associations, industry bodies and security forums.

Contact with special interest groups: what you need to know

Most organisations retain relationships with special interest groups of one form or another. Annex 5.6 is designed to ensure that knowledge and best practice relating to information security is exchanged with these groups where necessary. Within the Annex, it is noted that the requirement, purpose and implementation guidelines for contacting these groups should be documented and maintained.

There are a number of advantages to communicating and collaborating effectively with special interest groups. These include:

Keeping up to date with best practice relating to information security
Maintaining a current understanding of the information security environment
Keeping in the loop on alerts and patches relating to the kinds of attacks and vulnerabilities that are prevalent in a given industry or sector
Exchanging information relating to services, solutions and technologies that may benefit an organisation

What’s changed from ISO 27001:2013?

ISO 27001:2022 Annex A control 5.6 Contact with special interest groups was previously featured under control 6.1.4 of the ISO 27001:2013 standard. A number of small changes to the phrasing of the annex have been made In the 2022 version of the standard but the two are very similar in their composition and messaging.

‍

Risk Management

Compliance Reporting

Policy Management

Incident Management

Audits and Assessments

Ready to Take Control of Your Privacy Compliance?

See how Hicomply can accelerate your path to CAF compliance in a 15-minute demo.

Risk Management

Identify, assess, and mitigate security risks with an integrated risk register.Hicomply’s automated risk management software maps controls across ISO 27001, SOC 2, and NIST frameworks — helping teams track risk treatment plans, assign ownership, and monitor real-time compliance status.Build a resilient ISMS that reduces audit findings and demonstrates continuous improvement.

Compliance Reporting

Generate instant, audit-ready compliance reports across multiple frameworks — from ISO 27001 and SOC 2 to GDPR, DORA, and NHS DSPT.Automated evidence collection and built-in dashboards provide a single source of truth for your compliance posture, saving weeks of manual work during audits.

Policy Management

Centralise, version, and publish all your information security policies in one place.Hicomply automates approvals, reminders, and distribution, ensuring your ISMS documentation stays current and aligned with frameworks like ISO 42001 and NIST CSF.Say goodbye to outdated PDFs — manage policies dynamically and maintain full traceability.

Incident Management

Capture, investigate, and resolve security incidents with structured workflows and automated evidence trails.Hicomply integrates with ticketing tools like Jira, Zendesk, and Azure DevOps to streamline incident response and link findings to risk and control updates — a key step for SOC 2 Type II readiness.

Audits and Assessments

Simplify internal and external audit preparation with built-in audit templates and automated task assignments.
Hicomply’s audit management platform aligns with ISO 27001, ISO 9001, and ISO 14001, giving teams a clear overview of control effectiveness, audit evidence, and corrective actions — all from one dashboard.