Stakeholder Management
Intelligence that doesn't reach the right person in the right format might as well not exist. This skill ensures every product is tailored to its audience.
Stakeholder Identification
Common CTI Stakeholders
| Stakeholder |
Needs |
Format |
Cadence |
| CISO |
Strategic risk, business impact, investment justification |
Executive summary, risk scores, trend analysis |
Monthly + ad-hoc |
| SOC Manager |
Operational context, detection priorities, hunt leads |
Operational briefs, IOC packages, hunt playbooks |
Weekly + real-time |
| SOC Analysts |
Tactical indicators, detection rules, response guidance |
IOCs, SIGMA/YARA rules, enriched alerts |
Daily + real-time |
| IR Team |
Campaign context, TTP detail, forensic indicators |
Detailed campaign reports, investigation leads |
Per-incident |
| Security Architecture |
Threat landscape, emerging attack vectors, control gaps |
Threat assessments, ATT&CK mapping, control recommendations |
Quarterly |
| Risk Management |
Threat trends, probability assessments, sector comparisons |
Risk assessments, likelihood language, quantified impact |
Quarterly |
| Board / Executive |
High-level risk posture, material incidents, peer benchmarks |
1-page dashboard, non-technical language, visual aids |
Quarterly + material events |
| Legal / Compliance |
Regulatory threat intelligence, breach notification triggers |
Compliance-focused briefs, attribution (when needed) |
Ad-hoc |
| IT Operations |
Vulnerability intelligence, patch priorities, asset exposure |
Vulnerability assessments, prioritised patch lists |
Weekly |
Stakeholder Register Template
Maintain in data/pirs/stakeholder-register.md:
| Stakeholder | Role | PIRs | Products | Format Preference | Cadence | Feedback Method |
|-------------|------|------|----------|-------------------|---------|-----------------|
| [Name/Title] | [Role] | PIR-001, PIR-003 | Threat assessments, weekly brief | Executive summary, max 1 page | Monthly | Email response |
Tailoring Intelligence Products
For Executives (CISO, Board)
- Lead with business impact, not technical detail
- Use risk language: "This threat could result in..."
- Include peer comparisons: "Organisations in our sector have seen..."
- Recommend actions in business terms: "Investment in X reduces risk by..."
- Maximum 1-2 pages
- Visual aids (charts, traffic lights, risk matrices)
For Security Operations (SOC, IR)
- Lead with actionable indicators
- Include detection rules and hunt queries
- Provide full TTP chain with ATT&CK mapping
- Technical detail is expected and valued
- Response playbook pointers
- Real-time delivery for active threats
For Risk / Compliance
- Lead with likelihood and impact assessments
- Use standardised likelihood language (probability yardstick)
- Map to frameworks (NIST CSF, ISO 27001)
- Quantify where possible
- Regulatory implications highlighted
Dissemination Matrix
| TLP |
Distribution Channel |
Notes |
| RED |
Direct communication only (in-person, encrypted message) |
Named recipients only |
| AMBER+STRICT |
Internal secure channel (encrypted email, restricted SharePoint) |
Organisation only |
| AMBER |
Secure channel + need-to-know partners |
May share with clients/partners |
| GREEN |
Community channels (ISAC portal, closed mailing lists) |
Not public |
| CLEAR |
Any channel (blog, public advisories) |
Unrestricted |
Feedback Collection
After every significant product delivery:
- Was the intelligence useful? (Yes/Partially/No)
- Was it timely? (Yes/Too late/Too early)
- Was the format appropriate? (Yes/Too technical/Too high-level)
- What should we cover next? (Free text)
Track feedback in stakeholder register. Feed into PIR refinement (see feedback-loops skill).
1---2name: stakeholder-management3description: Use when the user asks "who are our customers?" / "how do we tailor for X stakeholder?" / "who should this report go to?", or wants to map / re-map stakeholder needs. Ensures intelligence reaches the right people in the right format.4---56# Stakeholder Management78Intelligence that doesn't reach the right person in the right format might as well not exist. This skill ensures every product is tailored to its audience.910## Stakeholder Identification1112### Common CTI Stakeholders1314| Stakeholder | Needs | Format | Cadence |15|-------------|-------|--------|---------|16| **CISO** | Strategic risk, business impact, investment justification | Executive summary, risk scores, trend analysis | Monthly + ad-hoc |17| **SOC Manager** | Operational context, detection priorities, hunt leads | Operational briefs, IOC packages, hunt playbooks | Weekly + real-time |18| **SOC Analysts** | Tactical indicators, detection rules, response guidance | IOCs, SIGMA/YARA rules, enriched alerts | Daily + real-time |19| **IR Team** | Campaign context, TTP detail, forensic indicators | Detailed campaign reports, investigation leads | Per-incident |20| **Security Architecture** | Threat landscape, emerging attack vectors, control gaps | Threat assessments, ATT&CK mapping, control recommendations | Quarterly |21| **Risk Management** | Threat trends, probability assessments, sector comparisons | Risk assessments, likelihood language, quantified impact | Quarterly |22| **Board / Executive** | High-level risk posture, material incidents, peer benchmarks | 1-page dashboard, non-technical language, visual aids | Quarterly + material events |23| **Legal / Compliance** | Regulatory threat intelligence, breach notification triggers | Compliance-focused briefs, attribution (when needed) | Ad-hoc |24| **IT Operations** | Vulnerability intelligence, patch priorities, asset exposure | Vulnerability assessments, prioritised patch lists | Weekly |2526## Stakeholder Register Template2728Maintain in `data/pirs/stakeholder-register.md`:2930```markdown31| Stakeholder | Role | PIRs | Products | Format Preference | Cadence | Feedback Method |32|-------------|------|------|----------|-------------------|---------|-----------------|33| [Name/Title] | [Role] | PIR-001, PIR-003 | Threat assessments, weekly brief | Executive summary, max 1 page | Monthly | Email response |34```3536## Tailoring Intelligence Products3738### For Executives (CISO, Board)39- **Lead with business impact**, not technical detail40- Use risk language: "This threat could result in..."41- Include peer comparisons: "Organisations in our sector have seen..."42- Recommend actions in business terms: "Investment in X reduces risk by..."43- Maximum 1-2 pages44- Visual aids (charts, traffic lights, risk matrices)4546### For Security Operations (SOC, IR)47- **Lead with actionable indicators**48- Include detection rules and hunt queries49- Provide full TTP chain with ATT&CK mapping50- Technical detail is expected and valued51- Response playbook pointers52- Real-time delivery for active threats5354### For Risk / Compliance55- **Lead with likelihood and impact assessments**56- Use standardised likelihood language (probability yardstick)57- Map to frameworks (NIST CSF, ISO 27001)58- Quantify where possible59- Regulatory implications highlighted6061## Dissemination Matrix6263| TLP | Distribution Channel | Notes |64|-----|---------------------|-------|65| RED | Direct communication only (in-person, encrypted message) | Named recipients only |66| AMBER+STRICT | Internal secure channel (encrypted email, restricted SharePoint) | Organisation only |67| AMBER | Secure channel + need-to-know partners | May share with clients/partners |68| GREEN | Community channels (ISAC portal, closed mailing lists) | Not public |69| CLEAR | Any channel (blog, public advisories) | Unrestricted |7071## Feedback Collection7273After every significant product delivery:741. Was the intelligence useful? (Yes/Partially/No)752. Was it timely? (Yes/Too late/Too early)763. Was the format appropriate? (Yes/Too technical/Too high-level)774. What should we cover next? (Free text)7879Track feedback in stakeholder register. Feed into PIR refinement (see feedback-loops skill).
Liberty91LTD