Considering workstreams


As the ISAC matures and starts dealing with activities and outputs, there may be momentum for creating workstreams or working groups. Workstreams are commonly created around themes and may be permanent or have an end date. Working groups may be created to tackle a challenge, for instance a specific threat type or incident. They are often ad-hoc and end with producing a solution or recommendation.

Working groups typically work together separately but in coordination with the wider ISAC community. They may organise meetings of their own or share information using their own distribution channels and then report their result back to the main group.

When considering workstreams or working groups, it is recommended to distribute the responsibility for running them among the members in order to share the workload.


  • Activities – Physical meetings, teleconferences, email conversations
  • Documents – Agendas, meeting minutes
  • Tools – E-mail list, online conference platform

This site uses cookies to offer you a better browsing experience.
Aside from essential cookies we also use tracking cookies for analytics.
Find out more on how we use cookies.

Accept all cookies Accept only essential cookies