Dissemination, Reporting, and Stakeholder Communication
What this domain tests
Dissemination, reporting, and stakeholder communication tests whether you can turn analysis into a product that fits the audience, states confidence and sourcing, and respects sharing rules. Expect questions about product types, BLUF, TLP, and the difference between tactical and strategic reporting.
Know the audience
- Tactical consumers (SOC, detection engineers) need indicators, detection logic, hunt hypotheses, and context for blocking. They care about precision and actionability.
- Operational consumers (IR, CTI, hunt teams) need campaign timelines, actor TTPs, infrastructure, and targeting.
- Strategic consumers (executives, board, risk owners) need business impact, likelihood, trends, and recommendations. They do not need raw hashes.
Product types
Common products include flash alerts for urgent threats, daily or weekly briefs, actor and campaign assessments, intelligence estimates, threat landscape reports, and incident-specific notes. Each should state the question, key judgments, confidence, sources, and recommended actions.
Writing rules
Lead with the bottom line (BLUF). Use short sections, plain language, and defined estimative terms. Separate fact, inference, and assumption. State confidence and what would change the judgment. Cite sources at the right level; protect sensitive sources. Give owners and deadlines for recommendations. Include a review date.
Sharing and TLP
Traffic Light Protocol 2.0 has CLEAR, WHITE, GREEN, AMBER, AMBER+STRICT, and RED. TLP is about sharing scope, not classification. Apply the most restrictive marking that fits, and do not forward without permission. Need-to-know and handling caveats still apply.
Worked example
A ransomware campaign hits a peer organization. The strategic brief should not open with a list of SHA-256 hashes. It should state the business risk, the likely targeting pattern, the confidence, and three actions: enforce MFA on remote access, segment backups, and rehearse recovery. A tactical annex can carry the IOCs and detection rules. The reasoning is that the same intelligence is packaged for different decisions; the executive needs risk and action, the SOC needs precision.
Traps that cost marks
- Sending tactical indicators to a board and calling it strategic intelligence.
- Burying the key judgment below background.
- Overusing TLP:RED and breaking sharing.
- Presenting inference as fact or omitting confidence.
- Ignoring the feedback loop and never asking whether the product changed a decision.
- Using unexplained jargon with non-technical stakeholders.