Considering workstreams

As the ISAC matures and starts dealing with activities and outputs, there may be momentum for creating workstreams or working groups. Workstreams are commonly created around themes and may be permanent or have an end date. Working groups may be created to tackle a challenge, for instance a specific threat type or incident. They are often ad-hoc and end with producing a solution or recommendation.

Working groups typically work together separately but in coordination with the wider ISAC community. They may organise meetings of their own or share information using their own distribution channels and then report their result back to the main group.

When considering workstreams or working groups, it is recommended to distribute the responsibility for running them among the members in order to share the workload.

Outcome:

• Activities – Physical meetings, teleconferences, email conversations
• Documents – Agendas, meeting minutes
• Tools – E-mail list, online conference platform