Multi-State Information Sharing and Analysis Center (MS-ISAC)

Step 4: Reach out to Your Outreach Channels

Identify Stakeholders in Order to Reach Out To Them
(Sponsors and Partners)

Stakeholders are individuals or organizations with a legitimate interest in a given situation or cause, in this case it is efforts to increase state and local cyber security. They are your partners who are directly affected by the decisions your organizations make and with whom you share success and failures. Properly defining stakeholders is a key element in planning and delivering any successful outreach plan.

Example of Cyber Security Stakeholders

Each of the following stakeholders has been listed by other MS-ISAC member states as important to their individual programs.

State legislators and elected officials, including city, county, and state levels
City and county managers and representatives, such as information security officers and chief information officers
Private industry, local businesses, or chamber of commerce officials
Local K-12 education community
Librarians
Higher education community including community colleges and universities, both public and private
Executive management, managers and supervisors, technical staff
Employees and contractors, volunteers, retirees , interns and student help, and others who access your agency's systems and information
First responders - such as law enforcement, emergency management, fire department, and emergency medical services
Information security organizations and associations, such as the Information Systems Security Association (ISSA) or InfraGard
Consumers and those who use your agency's services, products, systems, or information
Members of the media - such as TV news directors, reporters for local newspapers, magazines, or websites

They are your partners who are directly affected by the decisions your organizations make and with whom you share success and failures. Properly defining stakeholders is a key element in planning and delivering any successful outreach plan.

Depending upon your particular situation, you may want to consider how the groups above could potentially benefit from your program as well as assist you in reaching out to other audiences to broaden the impact of your program activities.

Establish Contacts

Build a list of contacts that can be reused.

Each stakeholder audience will possess unique characteristics that can be leveraged toward gaining their attention and buy-in.

Various contact lists can be obtained from many already established resources within your state, such as Internet listings of elected officials, or an existing Information Security Officer list. In some cases, the owners of these lists may be unwilling to share them with you.
Ask if you can prepare a message and whether the owners of these lists would consider sending it to their members on your behalf. You may find that most owners are readily open to accommodating these types of requests.
Know where to go and don't be afraid to ask. As you develop communication channels to reach targeted audiences and stakeholders, you may find these lists and communication channels beneficial for a variety of specific purposes such as communications during a crisis.

Best Practices

How to get Stakeholder Buy-in?

Meet with those who have an interest in the success of the event. Determine what the "hot topics" are well in advance of the event so you can include those in your Call for Presenters notice.
This is one of the hardest ones. I've learned that data does not convince people to buy-in. All the facts about actual security incidents don't make some execs budge an inch. It takes something emotional. They need to be emotionally engaged to take action. That means you have to connect with their fear, greed, or desire for position and power. True.

What do I need to do before working with Sponsors and Exhibitors?

Talk with your Ethics Officer to determine ahead of time what you can or cannot do with regard to sponsors and exhibitors. Ask if there are limitations on communications and commitments that will be necessary for the event. Armed with this knowledge you will be able to smartly advance the event either directly contact them or need to partner with an organization that can.
The sample template about how to include a vendor is helpful. It separates you from the money decisions and handling any money. It's nice to stay neutral.

Lessons Learned

In this section, describe lessons learned and identify pitfalls to avoid for this activity...

To Learn More

Templates page for additional resources