CYBER LIBRARY
Explore the bootcamp
Making change happenBeginner

Stakeholders and communication

Give the right people information and involvement for the decisions they own.

3 min readUpdated 12 Oct 20265 connections
Markdown

The idea

Stakeholders are people or groups affected by or able to influence the project. Identify their interests, responsibilities, information needs, and decision authority. Communication should be purposeful, timely, and understandable. Technical teams, service owners, support, leadership, and users may need different views. Involve affected people early enough to uncover operational requirements and adoption risks rather than only announcing a completed change.

In practice

An authentication rollout includes support staff and users in recovery testing, while leaders receive a concise view of risk and rollout readiness.

A common misunderstanding

Sending the same detailed technical report to everyone is not always effective communication.

Check your understanding

How should an update be tailored?

Think it through: Start with the recipient’s decision or task, then provide the relevant evidence and next action.

Understand interests and decision rights

A stakeholder can affect a project or be affected by its outcome. The list may include users, service owners, support, privacy, finance, suppliers, and leadership. Influence and impact are not the same: a frontline support worker may have little budget authority but substantial knowledge of how a proposed security control will affect people. Include that knowledge early.

Communication should serve a purpose. A sponsor may need a decision on funding, while operators need a procedure and users need clear instructions. Sending every group the same technical status report rarely meets those needs. Identify what information each audience requires, when it becomes useful, and how they can raise concerns.

A fictional authentication rollout

A team designs stronger staff authentication with engineers and management but forgets instructors who teach from shared classroom devices. The pilot exposes a workflow problem that could have been identified through an early conversation. The team revises enrollment guidance and tests the classroom use case before wider release.

Engagement does not mean every preference becomes a requirement. Conflicting needs still require a decision by the appropriate owner. Document the tradeoff and explain the outcome to affected people. Silence can be mistaken for agreement, especially when people are unsure whether they have permission to challenge a plan.

Design two communications

For a fictional device-encryption change, write a short message for affected staff and a separate decision brief for the service owner. The staff message should explain what they need to do and where to get help. The decision brief should explain scope, operational risk, and unresolved choices. Compare the two and remove information that distracts from each reader's task without hiding a material consequence.

Keep exploring

GO TO THE SOURCE

References & further reading

Original explanations, with primary references for deeper study.

UK Government: Project Delivery Functional Standard
EXPLORE THIS IDEA’S CONNECTIONS

A small part of a bigger picture.

4 notes · 3 connections
100%
Stakeholders and communication · depth 1
Drag to pan · Pinch or use +/− to zoom · Click to preview · Double-click to read
Browse notes as a list (4)
FOLLOW ANOTHER THREADExplore the rest of the library
Start with a concept. Follow its connections.
Detection & responseAbuse Elevation Control MechanismElevation-control abuse bypasses or misuses mechanisms governing privileged execution.Making change happenAcceptance criteriaDefine observable conditions for a deliverable to be accepted.Security essentialsAccess controlUnderstand subjects, resources, permissions, and enforcement through a shared-drive example, including how access changes over time.Detection & responseAccess Token ManipulationAccess token manipulation changes or adopts operating-system security contexts.Risk & resilienceAccount Access RemovalAccount access removal disrupts legitimate users by changing, deleting, or restricting their identities.Evidence & investigationAccount DiscoveryAccount discovery enumerates identities available in a system or environment.Detection & responseAccount ManipulationAccount manipulation changes identity settings to preserve or expand access.Adversarial thinkingAcquire InfrastructureInfrastructure acquisition obtains domains, servers, or other resources used to support operations.Adversarial thinkingActive ScanningActive scanning probes target infrastructure to learn reachable services or weaknesses.Security essentialsAdversary in the middleAn intermediary may observe or alter a communication path.Security essentialsAESA symmetric block cipher whose safe use depends on its mode and implementation.Making change happenAgile deliveryUse short feedback cycles to adapt toward a useful outcome.