Threat and Vulnerability Catalogue Template (ISO/IEC 27005, ATT&CK)

12 threat sources, 24 threat events and 18 vulnerabilities linked to Annex A controls and ATT&CK v20 tactics, scenario building, OT entries, update route

ISMS và ISO/IEC 27001Đầy đủISO/IEC 27001:2022 + Amd 1:2024 clauses 6.1.2 c, 8.2 and Annex A (cited only); ISO/IEC 27005:2022; MITRE ATT&CK v20 tactic namesthreat vulnerability catalogueCập nhật 1 thg 11, 2026

Mở trong editorTải .md

Cách dùng: Use it before the first risk assessment and keep it live for every workshop. Fill the relevant threat sources first, then prune and extend the threat event and vulnerability examples from your incidents, audits and threat intelligence. The main pitfall is a catalogue copied once from a public list and never updated.

Xem trước

Threat and Vulnerability Catalogue: [Organization name] ISMS

A maintained catalogue of threat sources, threat events and vulnerabilities that risk assessors use to build risk scenarios, so that every assessment starts from the same, current list instead of a blank page. Each entry is linked to ISO/IEC 27001:2022 Annex A controls (by number with a short label) and, for adversarial events, to MITRE ATT&CK Enterprise tactics (names only). It supports risk identification under ISO/IEC 27001:2022 + Amd 1:2024 clause 6.1.2 c and clause 8.2, follows the event-based and asset-based approaches described in ISO/IEC 27005:2022, and takes input from threat intelligence (Annex A control A.5.7). Replace every [bracketed] value and every row marked Example.

Document control

Field	Value
Document ID	DOC-ISMS-018
Version	[1.0]
Status	[Draft / In review / Approved / Superseded]
Owner	[@isms-manager]
Approvers/reviewers	[@ciso], [@security-operations-lead], [@it-operations-lead]
Last updated	YYYY-MM-DD
Classification	[Internal]
Standard and edition	ISO/IEC 27001:2022 + Amd 1:2024 (clauses 6.1.2 c, 8.2; Annex A); ISO/IEC 27005:2022; ISO/IEC 27002:2022
External taxonomy	MITRE ATT&CK Enterprise v20 (October 2026), tactic names only
Inputs	Threat intelligence procedure (DOC-ISMS-045), incident register (DOC-ISMS-021), vulnerability remediation tracker (DOC-ISMS-072), audit findings register (DOC-ISMS-086)
Used by	DOC-ISMS-010, DOC-ISMS-016, DOC-ISMS-017
Number of entries	[Sources: 12 / Threat events: 24 / Vulnerabilities: 18]
Next scheduled review	YYYY-MM-DD

Approvals

Role	Name	Decision	Date
ISMS manager	[@isms-manager]	[Prepared]	YYYY-MM-DD
CISO or security lead	[@ciso]	[Approved]	YYYY-MM-DD
IT or OT operations representative	[@it-operations-lead]	[Reviewed]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
1.0 (Example)	YYYY-MM-DD	[@isms-manager]	First issue for the baseline risk assessment
1.1 (Example)	YYYY-MM-DD	[@isms-manager]	Added THR-022 after threat intelligence on data leakage into public AI services; ATT&CK tactic names updated to v20
[x.y]	YYYY-MM-DD	[@author]	[Change summary and trigger]

1. Purpose and scope
2. How the catalogue is used
3. Structure, fields and identifiers
4. Threat sources
5. Threat events
6. Vulnerabilities and conditions
7. Building risk scenarios
8. Operational technology and sector additions
9. Keeping the catalogue current
10. Size tiers
11. Records and evidence
12. References
Standard and licence note

1. Purpose and scope

The catalogue gives risk assessors a shared, maintained vocabulary of what can go wrong (threat sources and events) and why it could succeed (vulnerabilities and conditions). It makes risk identification under clause 6.1.2 c systematic and repeatable, and means two assessors looking at the same situation reach similar scores (clause 6.1.2 b).

Item	Value
Covers	[All information, systems, processes, sites, people and suppliers in the ISMS scope (DOC-ISMS-002)]
Excludes	[Pure financial and market risks; product quality defects without a security dimension]
Who may propose entries	Any risk assessor, control owner, security operations analyst or internal auditor
Who approves changes	ISMS manager; CISO for retirements of adversarial events
Relationship to the register	Catalogue entries are referenced by ID in risk scenarios; the catalogue holds no scores

2. How the catalogue is used

Approach (ISO/IEC 27005:2022)	Starting point	How the catalogue helps	Typical use
Event-based	Risk sources and the events they can cause, at a strategic level	Assessors pick relevant sources (section 4) and events (section 5) and describe the consequences for the business	Annual cycle, first assessment, management workshops
Asset-based	Assets from the inventory (DOC-ISMS-012), then threats and vulnerabilities per asset	Assessors pair events (section 5) with vulnerabilities (section 6) that exist on each asset	Critical systems, new services, detailed technical assessments

Workshop routine (Example):

Before the workshop, the facilitator filters the catalogue to the asset types and processes in scope.
Participants confirm which threat events are credible for the scope, add missing ones and say which vulnerabilities exist today.
The facilitator writes each credible combination as a scenario (section 7) and passes it to scoring under DOC-ISMS-010 and the criteria in DOC-ISMS-015.
New entries proposed in the workshop go through the change route in section 9.

3. Structure, fields and identifiers

Prefix	Entry type	Key fields
SRC-NN	Threat source (who or what causes harm)	Type, capability or nature, motivation where adversarial, relevance
THR-NNN	Threat event (what happens)	Source type, typical targets, ATT&CK tactics (adversarial only), properties affected, related Annex A controls, likelihood drivers
VUL-NNN	Vulnerability or condition (why it can succeed)	Category, threat events that exploit it, related Annex A controls, how it is detected
SCN-NNN	Scenario (combination used in an assessment)	Source, event, vulnerability, asset, consequence, link to risk register ID

Properties use C (confidentiality), I (integrity) and A (availability). Annex A references use the control number with a short label written for this library, consistent with the Statement of Applicability (compliance/statement-of-applicability). ATT&CK references use tactic names from ATT&CK Enterprise v20; check the current version on the MITRE ATT&CK site, because tactic names and counts change between releases (v20 lists 15 Enterprise tactics, with Stealth (TA0005) and Defense Impairment (TA0112) where earlier versions had a single Defense Evasion tactic; map older scenarios accordingly).

4. Threat sources

ID	Source	Type	Capability or nature	Motivation	Relevant? (Example)
SRC-01	Organised cybercriminal groups	Adversarial, external	High; ransomware and access-broker ecosystems	Financial gain	Yes: all tiers
SRC-02	State-sponsored or state-aligned actors	Adversarial, external	Very high; persistent	Espionage, disruption	Yes for Quillmere Group (manufacturing IP); low for others
SRC-03	Hacktivists	Adversarial, external	Low to moderate	Ideology, publicity	Yes: public-facing websites
SRC-04	Malicious insiders (staff, contractors)	Adversarial, internal	Moderate; legitimate access	Grievance, gain	Yes: all tiers
SRC-05	Compromised or malicious suppliers	Adversarial, third party	Varies; trusted access	Financial gain, espionage	Yes: all tiers
SRC-06	Staff error	Accidental, internal	Everyday mistakes	None	Yes: all tiers
SRC-07	Privileged user error	Accidental, internal	High impact per mistake	None	Yes: all tiers
SRC-08	Hardware and software failure	Structural	Component faults, defects	None	Yes: all tiers
SRC-09	Supplier and cloud service failure	Structural, third party	Outage, insolvency, withdrawal of service	None	Yes: all tiers
SRC-10	Natural hazards and climate-related events	Environmental	Flood, storm, heat, wildfire, earthquake	None	Yes where sites or providers are exposed (see DOC-ISMS-003)
SRC-11	Utility failure	Environmental, structural	Power, cooling, telecommunications	None	Yes: own sites and colocation
SRC-12	Loss of key people	Structural, internal	Departure, illness, single points of knowledge	None	Yes: especially small organisations

5. Threat events

ID	Threat event	Source type	Typical targets	ATT&CK tactics (v20, names)	C I A	Related Annex A controls	Likelihood drivers
THR-001 (Example)	Phishing that captures staff credentials or session tokens	SRC-01, SRC-02	E-mail, identity provider, SaaS suite	Initial Access, Credential Access	C, I	A.6.3 awareness, A.8.5 secure authentication, A.8.23 web filtering, A.5.17 authentication information	Volume of mail, MFA type, training completion
THR-002 (Example)	Ransomware encrypts servers and endpoints	SRC-01	File servers, virtual machines, backups	Execution, Impact	I, A	A.8.7 malware protection, A.8.13 backup, A.8.8 vulnerability management, A.5.29 security during disruption	Patch latency, backup isolation, EDR coverage
THR-003 (Example)	Password spraying or credential stuffing against internet-facing logins	SRC-01	VPN, admin portals, customer portal	Credential Access, Initial Access	C	A.8.5 secure authentication, A.5.17 authentication information, A.8.16 monitoring	Exposed logins without MFA, reuse of breached passwords
THR-004 (Example)	Exploitation of a vulnerability in a public-facing application	SRC-01, SRC-02, SRC-03	Web applications, APIs, edge devices	Initial Access, Execution	C, I, A	A.8.8 vulnerability management, A.8.26 application security requirements, A.8.29 security testing	Exposure, time to patch, listing in vulnerability catalogues of known exploitation
THR-005 (Example)	Business e-mail compromise leading to payment fraud	SRC-01	Finance staff, supplier master data	Initial Access, Collection, Impact	I	A.6.3 awareness, A.5.3 segregation of duties, A.5.14 information transfer	Payment approval process, mailbox security
THR-006 (Example)	Exfiltration of data by a malicious insider	SRC-04	Customer datasets, source code, designs	Collection, Exfiltration	C	A.6.1 screening, A.5.18 access rights, A.8.12 data leakage prevention, A.8.16 monitoring	Breadth of access, offboarding speed, monitoring of bulk export
THR-007 (Example)	Accidental disclosure through misaddressed e-mail or public sharing links	SRC-06	E-mail, file sharing, collaboration tools	Not applicable (accidental)	C	A.5.14 information transfer, A.5.12 classification, A.8.12 data leakage prevention	Default sharing settings, labelling
THR-008 (Example)	Cloud storage or service exposed by misconfiguration	SRC-06, SRC-07	Object storage, databases, cloud consoles	Discovery, Collection, Exfiltration (when found by an attacker)	C, I	A.8.9 configuration management, A.5.23 cloud service use, A.8.16 monitoring	Infrastructure as code coverage, posture monitoring
THR-009 (Example)	Compromise through a supplier or software supply chain	SRC-05	Build pipeline, third-party libraries, managed service providers	Resource Development, Initial Access	C, I, A	A.5.19 supplier relationships, A.5.21 ICT supply chain, A.5.22 supplier monitoring, A.8.28 secure coding	Supplier access level, dependency management
THR-010 (Example)	Regional outage of the cloud service provider	SRC-09	Production platform	Not applicable	A	A.5.23 cloud service use, A.5.30 ICT readiness, A.8.14 redundancy	Single-region design, failover testing
THR-011 (Example)	Failure, withdrawal or insolvency of a critical SaaS supplier	SRC-09	Ticketing, payroll, CRM, identity provider	Not applicable	A, C	A.5.19 supplier relationships, A.5.22 supplier monitoring, A.5.30 ICT readiness	Concentration, exit plan, data export capability
THR-012 (Example)	Distributed denial of service against public services	SRC-01, SRC-03	Websites, APIs, DNS	Impact	A	A.8.20 network security, A.8.6 capacity management, A.8.14 redundancy	Upstream protection, capacity headroom
THR-013 (Example)	Misuse of standing administrator privileges	SRC-04, SRC-07	Directory, cloud tenant, databases	Privilege Escalation, Persistence	C, I, A	A.8.2 privileged access, A.8.18 privileged utility programs, A.8.15 logging	Number of standing admins, review frequency
THR-014 (Example)	Lateral movement after an endpoint compromise	SRC-01, SRC-02	Internal network, servers	Discovery, Lateral Movement	C, I, A	A.8.22 network segregation, A.8.1 user endpoint devices, A.8.16 monitoring	Flat network, local admin rights
THR-015 (Example)	Theft or loss of a laptop or mobile device	SRC-06, SRC-01	Laptops, phones, removable media	Not applicable	C	A.7.9 assets off-premises, A.8.1 user endpoint devices, A.8.24 cryptography	Travel, remote work, encryption coverage
THR-016 (Example)	Hardware or storage failure in an own facility	SRC-08	On-premises servers, storage arrays, plant controllers	Not applicable	A, I	A.7.13 equipment maintenance, A.8.13 backup, A.8.14 redundancy	Equipment age, maintenance contracts
THR-017 (Example)	Fire, flood or extreme weather affecting a site	SRC-10	Offices, plants, data centre	Not applicable	A	A.7.5 physical and environmental threats, A.5.30 ICT readiness, A.7.11 supporting utilities	Site location, climate exposure in DOC-ISMS-003
THR-018 (Example)	Power or cooling failure	SRC-11	Server rooms, colocation, data centre	Not applicable	A	A.7.11 supporting utilities, A.8.14 redundancy	Generator and UPS testing, cooling redundancy
THR-019 (Example)	Unauthorised physical entry to secure areas	SRC-01, SRC-04	Offices, comms rooms, plant control rooms	Not applicable	C, I	A.7.1 physical perimeters, A.7.2 physical entry, A.7.4 physical monitoring	Tailgating, visitor process
THR-020 (Example)	Erroneous change breaks production or corrupts data	SRC-06, SRC-07	Applications, infrastructure, databases	Not applicable	I, A	A.8.32 change management, A.8.31 environment separation, A.8.29 security testing	Change volume, automated testing
THR-021 (Example)	Disabling or tampering with security tools and logs	SRC-01, SRC-04	EDR agents, logging pipeline, SIEM	Stealth, Defense Impairment	I	A.8.15 logging, A.8.16 monitoring, A.8.7 malware protection	Tamper protection, log integrity, admin separation
THR-022 (Example)	Confidential data entered into public generative AI services	SRC-06	Customer data, source code, contracts	Not applicable (accidental)	C	A.5.10 acceptable use, A.8.12 data leakage prevention, A.5.23 cloud service use	Approved AI tools, policy awareness
THR-023 (Example)	Unauthorised remote access to an OT control network	SRC-01, SRC-02, SRC-05	Plant remote access, engineering workstations	Initial Access, Lateral Movement	I, A	A.8.22 network segregation, A.8.20 network security, A.8.5 secure authentication, A.5.21 ICT supply chain	Vendor remote access, IT and OT connectivity
THR-024 (Example)	Loss of a key person who alone runs a critical process	SRC-12	Release process, key management, OT engineering	Not applicable	A	A.5.37 documented operating procedures, A.5.2 roles and responsibilities, A.6.3 awareness and training	Team size, documentation, cross-training

6. Vulnerabilities and conditions

ID	Vulnerability or condition	Category	Exploited by	Related Annex A controls	How detected
VUL-001 (Example)	Password-only authentication on remote, admin or SaaS access	Technology	THR-001, THR-003, THR-013	A.8.5 secure authentication	Identity provider reports, access review
VUL-002 (Example)	Internet-facing systems not patched within target times	Technology	THR-002, THR-004	A.8.8 vulnerability management	Vulnerability scans, remediation tracker DOC-ISMS-072
VUL-003 (Example)	Staff not trained to recognise phishing and fraud	People	THR-001, THR-005, THR-007	A.6.3 awareness, education and training	Training records, phishing simulation results
VUL-004 (Example)	Standing privileged access without periodic review	Process	THR-013, THR-014	A.8.2 privileged access, A.5.18 access rights	Access reviews, privileged account inventory
VUL-005 (Example)	Endpoint disks not encrypted on some devices	Technology	THR-015	A.8.24 cryptography, A.8.1 user endpoint devices	MDM compliance report
VUL-006 (Example)	Backups reachable from production credentials or not restore-tested	Technology, process	THR-002, THR-016	A.8.13 backup	Backup restore test log DOC-ISMS-071
VUL-007 (Example)	Flat internal network without segmentation	Technology	THR-014, THR-023	A.8.22 network segregation	Network diagrams, firewall rule review
VUL-008 (Example)	Logs not collected centrally or not reviewed	Technology	THR-006, THR-021	A.8.15 logging, A.8.16 monitoring	Log source coverage report
VUL-009 (Example)	Cloud and server configuration not baselined, drift undetected	Technology	THR-008, THR-020	A.8.9 configuration management	Posture management findings
VUL-010 (Example)	Supplier engaged without security assessment or contract clauses	Supplier	THR-009, THR-011	A.5.19 supplier relationships, A.5.20 supplier agreements	Supplier register DOC-ISMS-066
VUL-011 (Example)	Production in a single region or site without tested failover	Technology	THR-010, THR-017, THR-018	A.8.14 redundancy, A.5.30 ICT readiness	Architecture review, DR test reports
VUL-012 (Example)	No data leakage controls on e-mail, sharing or AI services	Technology	THR-006, THR-007, THR-022	A.8.12 data leakage prevention	DLP coverage report, sharing audit
VUL-013 (Example)	Joiner, mover and leaver steps incomplete or late	Process	THR-006, THR-013	A.5.16 identity lifecycle, A.5.18 access rights	Access review exceptions, HR and IT reconciliation
VUL-014 (Example)	Continuity and recovery plans not tested	Process	THR-002, THR-010, THR-017	A.5.30 ICT readiness, A.5.29 security during disruption	Exercise records, DR test reports
VUL-015 (Example)	Weak change control and shared development and production environments	Process	THR-020, THR-009	A.8.32 change management, A.8.31 environment separation	Change records sample, pipeline review
VUL-016 (Example)	Inadequate physical entry control at an office or plant	Physical	THR-019	A.7.2 physical entry, A.7.4 physical monitoring	Site walk-through, badge log review
VUL-017 (Example)	Legacy OT systems that cannot be patched or run unsupported software	Technology (OT)	THR-023, THR-016	A.8.8 vulnerability management, A.8.22 network segregation	OT asset inventory, vendor support status
VUL-018 (Example)	Critical procedures undocumented and known by one person	People, process	THR-024, THR-020	A.5.37 documented operating procedures	Process maturity review, absence test

7. Building risk scenarios

Scenario	Source	Event	Vulnerability	Asset or process	Consequence	Register ID
SCN-001 (Example)	SRC-01	THR-001	VUL-001, VUL-003	Customer database via staff SaaS accounts	Customer personal data disclosed (C)	R-001
SCN-002 (Example)	SRC-01	THR-002	VUL-002, VUL-006	Production platform and backups	Service unavailable for days, data loss (A, I)	R-006
SCN-003 (Example)	SRC-06	THR-015	VUL-005	Laptop fleet	Local files with customer extracts exposed (C)	R-003
SCN-004 (Example)	SRC-09	THR-010	VUL-011	Analytics platform in the primary region	Platform unavailable beyond contractual service level (A)	R-008
SCN-005 (Example)	SRC-02	THR-023	VUL-007, VUL-017	Plant control network at one site	Production stop and safety risk (I, A)	R-014

Rules for scenario writing:

One scenario per credible combination; merge combinations that would receive the same treatment and owner.
If no catalogue entry fits, write the scenario anyway and propose the new entry through section 9; do not force a poor match.
Keep the scenario ID in the register so that a catalogue change can be traced to the risks it affects.

8. Operational technology and sector additions

Where the scope includes operational technology (OT), add or adapt entries for:

vendor remote access to controllers and engineering workstations (THR-023);
unsupported operating systems on control systems that cannot be patched without a plant shutdown (VUL-017);
loss of view or loss of control of a process, with safety consequences that use the safety column of the impact scale in DOC-ISMS-015;
removable media used to move files into isolated networks;
dependence on a small number of engineers (THR-024).

MITRE also publishes ATT&CK for ICS, a separate matrix for industrial control systems. Use its tactic names for OT entries if your team already works with it, and record the version used.

Sector extensions in this library: energy (isms/energy-27019-controls), telecom (isms/telecom-27011-controls), health (isms/health-27799-controls) and IoT (isms/iot-27400-security).

9. Keeping the catalogue current

Input	Route	Frequency (Example)
Threat intelligence items (DOC-ISMS-045)	Triage log; relevant items become new or updated entries	Monthly, and within 5 working days for urgent advisories
Incidents and near misses (DOC-ISMS-021)	Post-incident review proposes entries	After each incident review
Vulnerability management (DOC-ISMS-072)	Recurring weakness classes become VUL entries	Quarterly
Internal and external audit findings (DOC-ISMS-086)	Systemic weaknesses become VUL entries	After each audit
Public catalogues of exploited vulnerabilities (for example the CISA Known Exploited Vulnerabilities Catalog) and scoring systems (FIRST CVSS v4.0)	Inform likelihood drivers and VUL detection	Continuous through vulnerability management
New ATT&CK release	Tactic names checked and updated	At each release (MITRE has issued major versions about twice a year, in April and October)

Maintenance rules:

Review the full catalogue at least every [12] months, before the annual risk assessment.
Retire entries that are no longer credible by setting status "Retired" with a reason; never reuse an ID.
Record the source of each new entry (advisory, incident, audit).
When an entry changes, list the affected scenarios and tell their risk owners.

10. Size tiers

Aspect	Small: Quillmere Analytics Ltd (Example)	Medium: Quillmere Health Systems (Example)	Large or multi-site: Quillmere Group (Example)
Size of catalogue	About 30 entries; OT entries removed	About 45 entries, including clinical data and colocation entries	Group catalogue of about 80 entries plus plant-specific OT annexes
Maintainer	Part-time ISMS manager (0.5 FTE)	ISMS manager with the 3-person security team	CISO's security office (14 people); site security coordinators propose additions
Intelligence input	Free advisories, cloud provider bulletins, sector mailing lists	Commercial feed plus health sector information sharing	Commercial feeds, sector information sharing, OT vendor advisories
Main approach	Event-based for the annual cycle	Event-based plus asset-based for the scheduling platform	Event-based at group level, asset-based per plant and for the data centre
Review frequency	Annual, plus after incidents	Semi-annual	Quarterly at group level

11. Records and evidence

Record	Proves	Owner	Location (Example)	Retention (Example)
Approved catalogue versions	Systematic risk identification (6.1.2 c)	ISMS manager	Document management system, DOC-ISMS-018	All versions for 3 years
Threat intelligence triage log	A.5.7 operating and feeding the catalogue	Security operations lead	Ticketing system	3 years
Change requests for entries	Controlled updates with sources	ISMS manager	Ticketing system	3 years
Scenario lists in assessment reports	Catalogue used in assessments (8.2)	ISMS manager	DOC-ISMS-017	3 years
Notifications to risk owners	Affected risks reassessed	ISMS manager	E-mail or ticket records	3 years

12. References

Reference	Edition or version	Use
ISO/IEC 27001:2022 + Amd 1:2024	3rd edition 2022; Amd 1 2024-02-23	Clauses 6.1.2 c, 8.2; Annex A control numbers
ISO/IEC 27002:2022	3rd edition	Control purpose and guidance, including A.5.7 threat intelligence
ISO/IEC 27005:2022	4th edition	Event-based and asset-based approaches, risk sources
MITRE ATT&CK Enterprise	v20, October 2026	Tactic names for adversarial events
NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments	September 2012	Free reference for threat source types
FIRST Common Vulnerability Scoring System	Version 4.0	Vulnerability severity input
CISA Known Exploited Vulnerabilities Catalog	Live catalogue, checked November 2026	Evidence of active exploitation

Related templates: compliance/risk-methodology, isms/isms-risk-appetite-criteria, compliance/risk-register, isms/isms-risk-assessment-report, isms/threat-intelligence-procedure, compliance/asset-inventory, isms/vulnerability-remediation-tracker, security/threat-model, compliance/statement-of-applicability.

Official text: https://www.iso.org/standard/82875.html, https://www.iso.org/standard/75652.html, https://www.iso.org/standard/80585.html.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (clauses 6.1.2 c and 8.2, Annex A control numbers), ISO/IEC 27002:2022 and ISO/IEC 27005:2022. All entries, descriptions, short control labels and examples are original text written for this template; no ISO or IEC text is reproduced, and you need the official standards to interpret the requirements. MITRE ATT&CK tactic names are cited as names only; ATT&CK is a trademark of The MITRE Corporation. NIST, CISA and FIRST publications are cited by name and version. Check the current editions and versions before use.

Template licence: MIT.

Template liên quan

ISMS và ISO/IEC 27001