agentleFS
Sign inStart free
Liberty91LTDLiberty91LTD/cti-skills/skills/stakeholder-management/SKILL.md

stakeholder-management

Skill35 starsChanged 46 days agoMITView on GitHub

Use when the user asks "who are our customers?" / "how do we tailor for X stakeholder?" / "who should this report go to?", or wants to map / re-map stakeholder needs. Ensures intelligence reaches the right people in the right format.

3 other projects use a version of this.

Adopted by

Most recently taken up by

The file

We split this skill into the rules it gives an agent

3 rules. 0 are common, 3 are distinctive, and 0 are very specific to this project.

  • 0

    Common

    Most of the 3 edited versions we read keep these.

  • 3

    Distinctive

    This author's own choices. Worth a look.

  • 0

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Use risk language: "This threat could result in..."

    line 43
  2. Distinctive:

    Use standardised likelihood language (probability yardstick)

    line 59
  3. Distinctive:

    After every significant product delivery:

    line 76

“Common” is measured: kept by at least 6 in 10 of the 3 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Stakeholder Management

Intelligence that doesn't reach the right person in the right format might as well not exist. This skill ensures every product is tailored to its audience.

Stakeholder Identification

Common CTI Stakeholders

StakeholderNeedsFormatCadence
CISOStrategic risk, business impact, investment justificationExecutive summary, risk scores, trend analysisMonthly + ad-hoc
SOC ManagerOperational context, detection priorities, hunt leadsOperational briefs, IOC packages, hunt playbooksWeekly + real-time
SOC AnalystsTactical indicators, detection rules, response guidanceIOCs, SIGMA/YARA rules, enriched alertsDaily + real-time
IR TeamCampaign context, TTP detail, forensic indicatorsDetailed campaign reports, investigation leadsPer-incident
Security ArchitectureThreat landscape, emerging attack vectors, control gapsThreat assessments, ATT&CK mapping, control recommendationsQuarterly
Risk ManagementThreat trends, probability assessments, sector comparisonsRisk assessments, likelihood language, quantified impactQuarterly
Board / ExecutiveHigh-level risk posture, material incidents, peer benchmarks1-page dashboard, non-technical language, visual aidsQuarterly + material events
Legal / ComplianceRegulatory threat intelligence, breach notification triggersCompliance-focused briefs, attribution (when needed)Ad-hoc
IT OperationsVulnerability intelligence, patch priorities, asset exposureVulnerability assessments, prioritised patch listsWeekly

Stakeholder Register Template

Maintain in data/pirs/stakeholder-register.md:

| Stakeholder | Role | PIRs | Products | Format Preference | Cadence | Feedback Method |
|-------------|------|------|----------|-------------------|---------|-----------------|
| [Name/Title] | [Role] | PIR-001, PIR-003 | Threat assessments, weekly brief | Executive summary, max 1 page | Monthly | Email response |

Tailoring Intelligence Products

For Executives (CISO, Board)

  • Lead with business impact, not technical detail
  • Use risk language: "This threat could result in..."
  • Include peer comparisons: "Organisations in our sector have seen..."
  • Recommend actions in business terms: "Investment in X reduces risk by..."
  • Maximum 1-2 pages
  • Visual aids (charts, traffic lights, risk matrices)

For Security Operations (SOC, IR)

  • Lead with actionable indicators
  • Include detection rules and hunt queries
  • Provide full TTP chain with ATT&CK mapping
  • Technical detail is expected and valued
  • Response playbook pointers
  • Real-time delivery for active threats

For Risk / Compliance

  • Lead with likelihood and impact assessments
  • Use standardised likelihood language (probability yardstick)
  • Map to frameworks (NIST CSF, ISO 27001)
  • Quantify where possible
  • Regulatory implications highlighted

Dissemination Matrix

TLPDistribution ChannelNotes
REDDirect communication only (in-person, encrypted message)Named recipients only
AMBER+STRICTInternal secure channel (encrypted email, restricted SharePoint)Organisation only
AMBERSecure channel + need-to-know partnersMay share with clients/partners
GREENCommunity channels (ISAC portal, closed mailing lists)Not public
CLEARAny channel (blog, public advisories)Unrestricted

Feedback Collection

After every significant product delivery:

  1. Was the intelligence useful? (Yes/Partially/No)
  2. Was it timely? (Yes/Too late/Too early)
  3. Was the format appropriate? (Yes/Too technical/Too high-level)
  4. What should we cover next? (Free text)

Track feedback in stakeholder register. Feed into PIR refinement (see feedback-loops skill).

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free