Stakeholders

Stakeholders are the reason your CTI program exists, without these teams and individuals, you wouldn’t be producing intelligence for anyone, except yourself.

There are three main concepts in Stakeholders, which are the stakeholder organizations themselves, POC’s, and Feedback.

The first section, Stakeholders, list the specific organizations that will be consuming your intelligence. This section lists the POC’s for these organizations, their maturity, and the number of IR’s that the team has.

The maturity field represents the teams ability to consume intelligence produced by your team. Less mature organizations would typically be able to just ingest IOC’s into their platforms for detection and not operationalize recommendations included in reports, so it’s helpful to know what maturity level you should be writing your products at, to tailor to your specific customers needs.

The POC section lists the individual POCs that are in these organizations, and this provides a useful reference on how to best communicate with the POC’s.

Lastly, the feedback section contains useful metrics about how well your reporting has been received by customers. We measure this by two metrics, Reporting Value and Enabled Follow-on Actions. You should strive for enabling follow-on actions, whatever they may be, and this section provides a good indication if your customers are taking follow-up actions based on the intelligence you produced.