Difference Makers Award Rules & Governance

SECTION 1 — PROGRAM IDENTITY AND PURPOSE

1.1 What the Difference Makers Awards Are

The Difference Makers Awards recognize individuals, teams, and organizations that have made a material, demonstrable difference to the information security profession — through practice, research, education, leadership, or community building. This is not an honorary program. Recognition is earned through evidence of impact, not through marketing effort or organizational size.

The awards were created by SANS Institute because the cybersecurity community routinely produces exceptional work that goes unrecognized. The goal of this program is to correct that — and to provide the profession with a credible, transparent, peer-grounded signal about who and what is genuinely worth attention.

1.2 Dual-Track Award Architecture

Each eligible category produces two separate, equal awards. Neither outranks the other; they represent two distinct and legitimate forms of peer recognition:

Important: The two award tracks are announced simultaneously at the same ceremony. A nominee may win both, one, or neither. The Advisory Board Award winner has no bearing on the Public Vote Award winner, and vice versa.

1.3 Advisory Board–Only Categories

The following categories are not open to public nomination. Nominations originate exclusively from the Advisory Board:

• CISO of the Year
• Lifetime Achievement Award

For these categories, no public vote is held. Only the Advisory Board Award track applies. The finalist pool for these categories is not publicly announced in advance; only the recipient is revealed at the ceremony.

SECTION 2 — 2026 AWARD CATEGORIES

The Advisory Board sets, modifies, and retires categories each cycle by recorded vote under Section 3.6. The following categories are active for the 2026 program year. The performance period for all categories is January 1, 2025 through December 31, 2025, unless otherwise specified in the category description. A nomination carried over under Section 4.4 is evaluated against the performance period of the cycle in which it was first submitted.

Recognizes a practitioner who has built or grown something the community now depends on — a meetup, mentorship program, open forum, or body of free work. The nominee must have done this without requiring the community to pay for access, and the work must show evidence that it can outlast the nominee's immediate involvement. Scoring Criteria:

• Demonstrated Impact — The community actively uses or relies on what the nominee built.
• Rigor and Quality — The work was constructed with care and professional craft.
• Community Benefit — Access is free, open, or broadly available to practitioners.
• Sustainability — The contribution shows evidence of lasting more than a single event or moment.

Recognizes a tool, open-source project, or technical innovation that changed how defenders do the work — not just how people talk about doing it. The nomination must be for a specific, released, and publicly usable artifact. Vaporware, beta-only access, or marketing concepts are ineligible. Scoring Criteria:

• Demonstrated Impact — Adoption is measurable: downloads, forks, integrations, or documented use in operations.
• Technical Rigor — The tool or project reflects sound engineering and security-aware design.
• Community Benefit — The tool helps the defender community, not just the vendor's customer base.
• Innovation — It solves a real problem in a meaningful new way, or makes an existing approach significantly more accessible.

Recognizes an early-career practitioner who is already producing work that senior professionals pay attention to. "Early career" means no more than five years of cumulative full-time-equivalent professional experience in a security role at the time the nomination window closes, or no more than three years after the degree or certification that marked the career change if entering from another field. Part-time work counts proportionally; internships and academic coursework do not count. Nominees must meet the minimum age requirement in Section 12.7.

Scoring Criteria:

• Demonstrated Impact — The nominee's work is visible and valued beyond their employer.
• Trajectory — The output quality or scope has accelerated materially within the performance period.
• Community Benefit — The work is shared, published, presented, or otherwise accessible to others.
• Independence — The nominee produces or drives the work themselves, not as a supporting contributor.

Awarded across four independent disciplines. Nominations must specify one discipline. Nominations are not moved between disciplines without the nominator's consent (see Section 4.3). Each discipline produces its own Advisory Board Award and Public Vote Award winner. Eligible Disciplines:

• Cyber Defender — Practitioners focused on detection, protection, and defensive operations.
• ICS/OT Defender — Practitioners focused on industrial control systems and operational technology security.
• Red Teamer / Offensive Operator — Practitioners conducting authorized adversary emulation, red teaming, or offensive security operations.
• DFIR / Threat Intelligence Forensicator — Practitioners conducting digital forensics, incident response, or threat intelligence analysis.

Scoring Criteria:

• Demonstrated Impact — The nominee's work produced measurable security outcomes.
• Technical Excellence — The work reflects practitioner-level craft — not process compliance, but actual capability.
• Community Benefit — Findings, tools, techniques, or knowledge were shared beyond the immediate engagement.
• Reproducibility — Others could learn from or replicate the approach.

Recognizes a person creating technical content the field actually returns to — not just content the field clicks once. The nomination must be for a specific, ongoing body of work (a podcast series, a recurring livestream, or a published book) that has demonstrated a sustained audience within the security practitioner community. Scoring Criteria:

• Demonstrated Impact — Audience size, return engagement, or citations by other practitioners.
• Technical Depth — The content reflects genuine practitioner knowledge, not surface-level commentary.
• Accessibility — The content is freely accessible or available at a reasonable cost.
• Consistency — The body of work represents sustained output, not a single viral moment.

Recognizes a security leader whose program holds up under scrutiny — not just in a press release. The nominee must have demonstrably improved the security posture of their organization through leadership, investment prioritization, team development, or program architecture. Public communications, media presence, or conference speaking activity are not criteria. Every Board-originated nomination in this category must be accompanied by a written evidence memo prepared by the nominating member, documenting the basis for the nomination; the memo is retained with the cycle's records and is subject to Section 4.3's verification standard. Scoring Criteria:

• Program Integrity — The security program reflects sound architecture and defensible decisions.
• Leadership Impact — The nominee has developed practitioners, not just managed headcount.
• Community Engagement — The nominee contributes to the broader profession, not only internal outcomes.
• Resilience Under Pressure — The program's posture is demonstrable, including through adverse events.

Recognizes an organization the community trusts to do right by its customers and the field at large. This is not a product award. The nomination must address organizational conduct: how the company treats its customers during incidents, how it handles vulnerability disclosures, whether its public communications reflect technical accuracy, and how it supports the practitioner community. Organizational nominees are vetted under Section 5.6. Scoring Criteria:

• Community Trust — Practitioners recommend the company based on conduct, not marketing.
• Transparency — The organization communicates honestly about limitations, incidents, and trade-offs.
• Field Contribution — The company contributes meaningfully to the community: research, tools, training, or direct practitioner support.
• Customer Integrity — The company's actions during adverse events reflect an orientation toward the customer, not brand protection.

Recognizes a career's worth of contribution to cybersecurity and the people in it. The nominee must have made sustained, multi-decade contributions to the profession that have shaped how the field is practiced, taught, or understood. This award is given at most once per cycle and may not be awarded if no nominee in the Advisory Board's judgment meets the standard. The award [SANS TO CONFIRM: may / may not] be conferred posthumously; if permitted, the Section 5.2 self-disclosure is replaced by enhanced Secretariat review and next-of-kin consent. Scoring Criteria:

• Career Scope — The body of work spans multiple decades and multiple types of contribution.
• Field-Level Impact — The contributions shaped how the profession works, not just a single organization.
• Practitioner Legacy — The nominee's work has measurably influenced how others learn, practice, or lead.
• Integrity — The career reflects a consistent standard of professional conduct.

SECTION 3 — THE ADVISORY BOARD

3.1 Role and Authority

The Advisory Board serves three functions: (1) category governance — setting, modifying, and retiring award categories each cycle; (2) judging — evaluating all nominees and selecting Advisory Board Award recipients; and (3) special category nomination — originating all nominations for CISO of the Year and Lifetime Achievement. The Advisory Board operates with administrative support from the SANS Awards Secretariat but retains sole authority over finalist selection and winner decisions. No SANS Institute staff member with a commercial interest in any nominee may serve on the Advisory Board without full disclosure and applicable recusal. The Secretariat's administration of the program is overseen by the Awards Oversight Officer (Section 10.4).

3.2 Composition Requirements

• Minimum of nine (9) members per cycle.
• Representation from at least four of the following domains: practitioner/operations, academia/research, policy/government, DFIR, ICS/OT, training/workforce development, security architecture, and CISO/leadership community.
• No more than one-third of members from any single employer organization.
• A Chair whose role is ministerial (facilitating process per these rules) and not decisional. The Chair's ministerial duties include convening sessions, assigning nominations under the published domain mapping, logging recusals and disclosures, and transmitting sealed tallies; the Chair casts no deciding vote and breaks no ties.
• Advisory Board member names and organizational affiliations are published on the Awards website no fewer than 60 days before the nomination window opens. Any mid-cycle change in membership is published within 14 days.

3.3 Advisory Board Member Code of Ethics

Every Advisory Board member must, before each awards cycle, sign a Non-Disclosure Agreement (NDA) covering all nomination content, deliberations, and preliminary results, and complete a Conflict of Interest (COI) Disclosure identifying any professional, financial, or personal relationships with nominees or nominating organizations. Disclosure is a continuing obligation: a conflict arising mid-cycle must be disclosed to the Chair within seven (7) days of arising. Members affirm adherence to the following obligations:

• Impartiality and Fairness — Evaluate nominees solely on merit. Refrain from favoritism, bias, or prejudice toward any nominee, category, or nominating organization.
• Confidentiality — Do not disclose deliberations, evaluations, or preliminary results at any stage. This obligation survives the public announcement of winners.
• Conflict of Interest — Recuse from any category or nominee with which there is a direct or perceived conflict. The Chair must be notified of all recusals before deliberation begins.
• Independence — Exercise independent judgment free from external pressure. Reject any attempt to influence decisions by nominees, nominators, sponsors, or third parties. If improperly contacted, notify the Secretariat immediately.
• Ethical Standards — Uphold standards consistent with those expected of a senior information security professional. Comply with all applicable law and professional codes.
• Expertise and Diligence — Commit the time necessary to evaluate all assigned nominations fairly. Score each element of the scoring rubric independently; do not superficially review entries.
• Fair Evaluation Across Organizations and Geographies — Consider and respect diverse backgrounds, organizational sizes, and geographies. Ensure that large, well-resourced organizations do not systematically outperform small teams by virtue of nomination resources alone.
• Promptness — Complete scoring by the published judging close date. Notify the Secretariat immediately if unable to complete on time.

3.4 Recusal and Conflict of Interest Procedure

Mandatory recusal. An Advisory Board member must recuse from a category's deliberation and vote if, with respect to any nominee in that category, the member is or has been: a direct report, supervisor, employer, or employee; a co-founder or business partner; a co-author or co-presenter within the past three (3) years; a mentor or mentee in an ongoing or recent formal relationship; a member of the nominee's immediate family; or the holder of a financial interest in the nominee's success or recognition. A close personal relationship that a reasonable observer would expect to affect judgment also requires recusal; the member is responsible for making that call conservatively. Adverse-interest recusal. Conflicts run both directions. A member with a competitive, adversarial, or personal interest in a nominee not winning must recuse on the same terms. Gray zones. Where a member is uncertain whether a relationship requires recusal, the member discloses it to the Chair before deliberation. The Chair logs the disclosure and refers the question to the non-conflicted members of the Board, who decide by majority under Section 3.6. Judging floor. If recusals reduce the number of non-conflicted members assigned to a category below three (3), the Chair reassigns additional non-conflicted members. If the full Board cannot field three non-conflicted judges for a category, the matter is escalated to the Awards Oversight Officer, who may approve a panel supplemented by [SANS TO CONFIRM: external judge mechanism] or defer the category for the cycle. The Chair logs all recusals. A summary of recusals per category — without identifying the individual recused — is publicly disclosed on the Awards website within 7 days of the ceremony.

3.5 Appointment, Terms, and Vacancies

Advisory Board members are appointed by [SANS TO CONFIRM: appointing authority, e.g., SANS executive leadership on the recommendation of the sitting Board] for terms of [SANS TO CONFIRM: two] cycles. The Chair is designated by [SANS TO CONFIRM: same authority]. A mid-cycle vacancy is filled by the same appointment process; the replacement is published within 14 days, inherits no prior scoring, and does not score nominations already in deliberation. Removal for cause is governed by Section 10.4.

3.6 Quorum, Voting Thresholds, and Ties

For any Advisory Board decision under these rules, quorum is two-thirds of the members not in conflict on the matter. Voting thresholds are counted against the full number of non-conflicted members, not merely those present. Unless a higher threshold is stated, decisions are by majority of non-conflicted members. Ties in winner selection are resolved under Section 6.1 Step 6; any other tie fails the motion. No tie is broken by the Chair.

3.7 Eligibility of Board Members and Program Staff; Nominating Restrictions

Sitting Advisory Board members, Secretariat staff, the Awards Oversight Officer, and their immediate families are not eligible for nomination in any category during service and for one full cycle after service ends. Sitting members do not submit or solicit nominations in categories open to public nomination. Secretariat staff disclose any conflict with a nominee or nominator to the Awards Oversight Officer and hand the affected entry's administration to an unconflicted colleague; these handoffs are logged.

SECTION 4 — NOMINATION PROCESS

4.1 Who May Nominate

Any individual may submit a nomination for categories that are open to public nomination, subject to Section 3.7. Self-nomination is not permitted for any category. For organizational nominees, a nomination submitted by the organization's employees, contractors, or agents (including public relations or marketing firms acting for it) is treated as self-nomination and is not permitted. Nominators must provide a valid professional or personal email address and must disclose their relationship to the nominee (for example: none, colleague, former colleague, customer, community member). Material nondisclosure of a relationship is grounds for removal of the nomination. Anonymous nominations are not accepted. The Secretariat holds nominator identities confidential from nominees and the public, disclosing them only to the Board and staff as needed to administer the program or as required by law.

4.2 Nomination Window

The nomination window will be published no fewer than 30 days before it opens. The window will remain open for a minimum of 60 days. All program deadlines are measured in [SANS TO CONFIRM: timezone, e.g., US Eastern Time] as of 11:59 p.m. on the stated date. No late nominations are accepted, with one exception: if the Secretariat verifies a failure of the nomination platform, it may declare a single uniform extension, announced publicly and applied to all nominators equally. The Secretariat will issue one public reminder no fewer than 14 days before the close of nominations.

4.3 Required Nomination Content

Each nomination must include all of the following:

• Nominee Identity — Nominee's full name, professional title, and affiliated organization (or "Independent" if applicable). For organizational nominees, the organization's legal name and primary point of contact.
• Category Selection — The specific category for which the nomination is submitted. The Secretariat may propose reassignment to a more suitable category or discipline; no nomination is moved without the nominator's consent. Absent consent, the entry is evaluated as filed.
• Justification Narrative — A narrative of no more than 2,500 characters (approximately 400 words), structured using the Situation / Actions / Outcomes format: What was the problem or gap? What did the nominee specifically do? What measurably changed as a result?
• Performance Period — The specific timeframe (start and end date) to which the nominated work applies. Work must fall within the applicable performance period (Section 2, Section 4.4).
• Supporting Evidence — URLs, publications, public repositories, conference talks, or other verifiable materials that support the nomination, up to [SANS TO CONFIRM: eight] primary items. Publicly accessible evidence is strongly preferred. Where the nominated work cannot be publicly evidenced (for example, client-confidential engagements), the nominator may submit a confidential evidence supplement to the Secretariat; confidential evidence is weighed only to the extent the Secretariat can verify it, and is handled under Section 12.9.
• Accuracy Attestation — The nominator attests that all information in the nomination is accurate to the best of their knowledge, regardless of what tools were used to draft it. The nominator, not the drafting tool, is responsible for every claim.
• Standing Attestation — Nominator's attestation of nominee professional standing (see Section 5).

Nominations are submitted in English; nominators needing an accommodation may contact the Secretariat.

4.4 Re-nomination and Carryover

A nomination that does not result in selection in one cycle may be carried over to the following cycle only with the nominator's written consent and a fresh standing attestation. A carried-over nomination is evaluated against the performance period of the cycle in which it was first submitted, together with any updated supporting evidence. Lifetime Achievement candidates under Board consideration carry over automatically at the Board's direction. No nomination may carry over more than two consecutive cycles.

SECTION 5 — NOMINEE VETTING AND PROFESSIONAL STANDING

The Standing Principle: A SANS Difference Makers Award recognizes not only exceptional work but also the character of the person or organization being recognized. The award reflects on SANS Institute and on the profession. A nominee must not only have achieved something noteworthy — they must be in good professional standing at the time of recognition.

5.1 Nominator Attestation (At Submission)

Every nominator must confirm the following at the point of submission: "To the best of my current knowledge, the individual or organization I am nominating has behaved consistently with the professional standards and ethical expectations of the information security community. I am not aware of any current or recent investigation, sanction, legal proceeding, or public conduct concern that would be inconsistent with receiving a SANS Difference Makers Award." This is not a requirement for the nominator to conduct an independent investigation. It is a statement of the nominator's own knowledge at the time of submission.

5.2 Nominee Consent and Self-Disclosure (Before External Checks and Finalist Announcement)

Before any external standing check under Section 5.3 is run, and before being announced as a finalist, every nominee will be notified that they have been nominated and asked whether they consent to proceeding. Consent includes the publicity license described in Section 12.2 and acknowledgment of these rules. Nominees who do not consent are removed from consideration with no negative inference. A nominee may withdraw consent at any time before the ceremony; a withdrawal after the finalist announcement is announced without inference, the finalist slot is not backfilled, and public votes cast for the withdrawn finalist are void. If a nominee dies during the cycle, the nomination is treated as withdrawn, except as provided for Lifetime Achievement in Section 2. Nominees who consent must affirm the following in a confidential written statement to the Secretariat: "I have read the Difference Makers Awards Professional Standards and agree to conduct myself in accordance with them. I attest that: (a) I have not been found to have engaged in conduct contrary to professional ethics in any formal proceeding or investigation; (b) I am not subject to any unresolved formal finding of such conduct; (c) I am not, to my knowledge, currently the subject of a pending investigation or proceeding of that nature — or, if I am, I am disclosing this in a separate confidential statement submitted herewith; and (d) where a binding confidentiality obligation lawfully prevents me from answering any part of this attestation fully, I have stated that such an obligation exists, without further detail." [FOR COUNSEL: final wording] A statement under clause (d) is not an automatic disqualifier; the Advisory Board considers it in context. Disclosure of a pending proceeding does not automatically disqualify a nominee. The Advisory Board will consider the context, status, and relevance of the disclosed matter at its discretion. Omission or misrepresentation of material information is grounds for immediate disqualification and permanent ineligibility.

5.3 Secretariat Standing Verification Checks

The SANS Awards Secretariat conducts the following checks on nominees who have consented under Section 5.2, before the finalist list is published. Pre-consent screening is limited to nomination completeness and SANS Institute's own internal records. All checks are conducted confidentially. Nominees are not publicly identified as having been reviewed. Media reporting may prompt a confidential review but is never, by itself, the basis for adverse action (see Sections 5.5 and 10.3).

Organizational nominees are checked under Section 5.6. Personal data collected under this section is handled per the SANS privacy notice at [SANS TO CONFIRM: URL], is accessible only to the Secretariat, the Chair, and the Awards Oversight Officer, and is retained and destroyed per Section 12.9.

5.4 Disqualification Grounds

A nominee may be disqualified before the finalist announcement or before the award is conferred upon confirmation of any of the following:

• Active revocation or suspension of a relevant professional certification due to an ethics violation.
• Active criminal proceeding related to professional conduct, fraud, computer crime, or financial crime.
• Formal finding of professional misconduct by a recognized professional body within the past five years.
• Material misrepresentation in the nomination or nominee self-disclosure.
• Active debarment from SANS Institute programs for cause.

• Substantiated conduct in the public record that is fundamentally inconsistent with the professional standards this program exists to recognize. This ground requires documented conduct rather than accusation alone, a written rationale recorded by the Board, and a two-thirds vote of non-conflicted members.

Disqualification under the first five grounds is decided by a majority vote of non-conflicted Advisory Board members under Section 3.6. Where timing permits, the nominee receives written notice and fourteen (14) days to respond before a final vote; an expedited path without a response window is available for matters arising within 21 days of the ceremony. The nominee is informed confidentially. No public statement of disqualification is made unless required by law.

5.5 Award Revocation (Post-Ceremony)

A previously announced or conferred award may be revoked through the following procedure:

1. Trigger — A written request for revocation must be submitted to the Secretariat, accompanied by verifiable documentation from a court, professional regulator, recognized certifying body, or government agency. Employer findings and media reports may support a request but are not sufficient, alone or together, to trigger formal review. Revocation requests are limited to awards conferred within the past [SANS TO CONFIRM: number] cycles.
2. Preliminary Review — The Secretariat reviews documentation for substantiveness. Frivolous or unsupported requests are dismissed; all requests and dispositions are logged, and a summary of dismissals is reported to the Chair and the Awards Oversight Officer each cycle.
3. Notification — If the request advances, the award recipient is notified in writing and given a minimum of 30 days to submit a written response.
4. Advisory Board Vote — The full Advisory Board (minus those in conflict) votes on revocation. A two-thirds supermajority of non-conflicted members is required (Section 3.6).
5. Hard Triggers — A felony conviction; a misdemeanor conviction involving fraud, dishonesty, computer crime, or abuse of trust; formal disbarment or censure by a recognized professional certifying body; or conduct involving financial fraud against the security community will trigger expedited review with a 14-day response window.
6. Outcome — If revocation is approved, the recipient is notified; their name is removed from the Awards website; and the recognition-marks license under Section 12.4 terminates. SANS may issue a brief public statement confirming the revocation without detailing the underlying matter, using the counsel-approved template, unless required by law to say more.

5.6 Organizational and Team Nominees

Organizations. An authorized officer of a nominated organization executes the Section 5.2 consent and the following adapted attestation: that the organization is not subject to any unresolved formal regulatory enforcement finding involving deceptive conduct toward customers or the security community; that material government enforcement actions within the past five years are disclosed in a confidential statement; and that the information in the nomination is accurate. Standing checks for organizations cover public regulatory actions, litigation relevant to the category's conduct criteria, and the organization's public incident-disclosure conduct. Teams. A team nomination names each member, up to [SANS TO CONFIRM: eight]. Each named member individually consents and attests under Section 5.2. If a named member withdraws or becomes ineligible, the nomination proceeds for the remaining members unless the nominator withdraws it.

SECTION 6 — JUDGING PROCESS

6.1 Advisory Board Judging Steps

Step 1 — Triage and Screening. The Secretariat screens all nominations for completeness, category alignment, and standing per Section 5.3's pre-consent limits, and verifies that supporting evidence links resolve to the claimed materials. Incomplete or misaligned nominations are corrected with the nominator's cooperation or removed from consideration; the nominator is informed of a removal and its general basis. Secretariat conflicts are handled under Section 3.7. Step 2 — Assignment. The Chair assigns each nomination to Advisory Board members best positioned to evaluate the relevant domain, per the published domain mapping. No member is assigned to a category in which they have disclosed a conflict. Step 3 — Independent Scoring. Each assigned member independently scores each nomination against the published criteria rubric. Scores are submitted through a secure digital platform and may not be altered after submission; they are the permanent audit record of the cycle. Step 4 — Deliberation and Finalist Confirmation. The Secretariat calculates averaged scores per nomination. Nominees meeting the Section 6.3 minimums form the qualifying pool, ranked by weighted composite. The Chair convenes deliberation per category; members may depart from the presumptive composite ranking in confirming the finalist slate only by recorded vote with a written rationale retained in the cycle's records. Up to five finalists are confirmed per category. Step 5 — Finalist Announcement. Finalists for all open categories are publicly announced no fewer than 30 days before the ceremony and no earlier than 30 days after the nomination window closes, preserving the vetting period. A Public Vote Award is conferred in a category only if at least [SANS TO CONFIRM: three] finalists are announced; with fewer, only the Advisory Board Award track runs that cycle. CISO of the Year and Lifetime Achievement finalists are not publicly announced; only recipients are revealed at the ceremony. Step 6 — Sealed Final Ballots. After finalist confirmation, each non-conflicted assigned member submits a sealed final ballot ranking the finalists to the Secretariat. The Secretariat and Chair alone tally the ballots; the Advisory Board Award recipient's identity is known only to the Chair and Secretariat until the ceremonial reveal. A tie resolves to the finalist with the higher weighted composite score; a persisting tie produces joint recipients. No Advisory Board member may disclose ballot contents. Step 7 — Recipient Succession. If a selected recipient is disqualified or withdraws before the award is conferred, the award passes to the next-ranked finalist on the sealed tally who passes standing verification. If none qualifies, the category's Advisory Board Award is not conferred that cycle.

6.2 Public Voting Track

Eligible Voters — Any individual 18 or older may cast one vote per category. Voting is one vote per person, not per email address; the Secretariat applies verification measures including email confirmation, alias normalization, and disposable-domain screening [SANS TO CONFIRM: additional measures]. Advisory Board members, Secretariat staff, and the Awards Oversight Officer do not vote in the public track. Vote Period — Voting opens on the finalist announcement date and closes 72 hours before the ceremony, measured per Section 4.2. Vote Integrity — Bulk or automated voting, votes procured through payment or anything of value, vote-exchange schemes, and misrepresentation of the voting process are prohibited. SANS reserves the right to audit voting and to disqualify votes or voters it determines to be inauthentic; vote-integrity determinations are final. Votes cast for a finalist who is subsequently disqualified or withdraws are void; the remaining tally stands, and the Secretariat announces the adjustment. An exact tie produces joint Public Vote Award recipients. Per-category vote totals [SANS TO CONFIRM: are / are not] published within 14 days of the ceremony. Promotion vs. Manipulation — Finalists and their employers, colleagues, and communities may announce finalist status, link to the voting page, and promote that fact through organic or paid channels. What no one may do: offer anything of value in exchange for votes, deploy automation or bulk registration, coordinate vote-exchange schemes, or approach Advisory Board members (Section 9). Promotion of a finalist is expected; procurement of votes is prohibited. Weighting — Public vote results determine the Public Vote Award only. They have no influence on the Advisory Board Award. A nominee with high public votes but a weaker nomination does not displace the Advisory Board winner.

6.3 Scoring Rubric (Advisory Board)

Each nomination is scored across four dimensions on a 1–10 scale. Each category's Scoring Criteria in Section 2 define how these four dimensions apply to that category, in the order listed. Qualifying minimums apply to the averaged score across assigned judges, not to any single judge's score.

Composite Minimum: A nominee must achieve a weighted composite score of 6.0 or above to qualify as a finalist. The Advisory Board may, by majority vote under Section 3.6, decline to award a category if no nominee meets the standard meriting recognition.

SECTION 7 — SPONSOR AND COMMERCIAL INTEGRITY

Anti-Pay-to-Play Policy: Sponsorship of the Difference Makers Awards does not confer any influence over nominee selection, finalist determination, vetting outcomes, or winner decisions. Sponsors receive recognition at the ceremony, on the Awards website, and in communications — nothing more.

7.1 Sponsor-Affiliated Nominees

The cycle's sponsor list is published on the Awards website alongside the Advisory Board list, no fewer than 60 days before the nomination window opens. Advisory Board members affiliated with a sponsoring organization must disclose that affiliation at each cycle. If a sponsoring organization has nominees in a given cycle, Advisory Board members from that organization must recuse from all categories in which those nominees appear. Category-governance votes (creating, modifying, or retiring categories) are recorded with member affiliations noted in the record; a member abstains, on their own motion or the Chair's referral under Section 3.4, where a sponsor with which they are affiliated has a direct commercial interest in the category decision.

7.2 SANS Institute Employees and Affiliates

Current SANS Institute employees and contractors are eligible for nomination, except: anyone who performs any Secretariat function during the cycle; Advisory Board members and others covered by Section 3.7; and [SANS TO CONFIRM: employees within the awards program's reporting line]. Any Advisory Board member with a management relationship to a nominated SANS employee must recuse from that category.

SECTION 8 — TRANSPARENCY COMMITMENTS

The Difference Makers Awards publicly publishes the following, updated each cycle on the program website:

SECTION 9 — ENTRANT AND NOMINEE CODE OF ETHICS

By submitting a nomination or consenting to be a nominee, all parties agree to the following conduct standards. Assent is recorded at submission and at nominee consent.

• Honesty — All information in a nomination must be accurate and truthful. If any information is found to be inaccurate — at any stage, including after an award is announced — the nomination or award may be disqualified or revoked.
• No Undue Influence — Nominees and nominators must not attempt to influence Advisory Board members, the integrity of the public voting process, or the Secretariat. Any attempt to gain unfair advantage — including procuring votes through payment or anything of value, automated or bulk voting, or vote-exchange schemes as defined in Section 6.2 — results in immediate disqualification and ineligibility from future cycles. Promotion permitted under Section 6.2 is not undue influence.
• No Improper Contact — Nominees and nominators must not contact Advisory Board members regarding a nomination. Advisory Board members who are improperly contacted must immediately notify the Secretariat. The identity of Advisory Board members assigned to specific categories is not disclosed before the ceremony.
• Respect — Nominees and nominators must treat the Advisory Board, Secretariat, and other nominees with professional respect. Bad-faith personal attacks on other nominees made to influence the awards process constitute a violation of this code. Good-faith professional critique of published work is not a violation.
• Acceptance of Process — By proceeding through nomination, nominees and nominators accept these rules in full, including the finality of Advisory Board decisions on the merits. There is no appeal of an Advisory Board Award decision on the merits.

SECTION 10 — APPEALS AND COMPLAINTS

10.1 No Merit Appeal

There is no appeal of an Advisory Board Award decision on the merits. The Advisory Board's selection of finalists and winners is final.

10.2 Procedural Complaints

Procedural complaints — alleging that the published process was not followed — may be submitted in writing to the Secretariat within 14 days of the event complained of, or within 21 days of the ceremony, whichever is later. The Secretariat will investigate and respond in writing within 30 days. Remedies for an upheld complaint may include correction of the record, public disclosure of the defect, and process changes for future cycles; an upheld procedural complaint does not overturn a merit decision.

10.3 Third-Party Reports on Nominee Standing

Third parties may submit information about a nominee's professional standing at any point during the awards cycle using the Secretariat's secure reporting form. Anonymous reports are accepted but given lower weight than attributed reports. Reports must include verifiable documentation from a credible source — such as a professional body, court record, or government agency record. Media reports alone are not sufficient. The Secretariat holds reporter identities confidential to the extent law allows, and retaliation against a good-faith reporter is itself a violation of Section 9.

10.4 Complaints About Advisory Board Members; Program Oversight

Complaints about an Advisory Board member's conduct in relation to the awards may be submitted to the Chair. Complaints about the Chair, escalations from the Secretariat, and the logs and summary reports required by these rules are directed to the Awards Oversight Officer: a SANS Institute executive outside the awards program's reporting line, named on the Awards website [SANS TO CONFIRM: named role]. The Advisory Board may, by two-thirds vote of non-conflicted members under Section 3.6, remove a member for cause.

SECTION 11 — GLOSSARY

SECTION 12 — GENERAL PROVISIONS

12.1 Amendment, Suspension, and Cancellation

SANS Institute may amend these rules and may suspend or cancel the program or any category. Material amendments made after the nomination window opens are announced publicly with a change log per Section 8 and applied prospectively where feasible. These rules are reviewed before each cycle.

12.2 Publicity and Likeness

A nominee's consent under Section 5.2 grants SANS a non-exclusive license to use the nominee's name, likeness, affiliation, and a summary of the nomination in program communications, including the finalist announcement and ceremony. Winners additionally grant use in program marketing. A non-winning nominee may request removal from program materials after the cycle concludes.

12.3 Nomination Materials License

Nominators grant SANS a non-exclusive license to reproduce, evaluate, excerpt, and archive submitted nomination materials for program administration and recognition purposes. Nominators must have the right to submit the materials they provide.

12.4 Award Marks and Badge License

Finalist and winner designations, badges, and program marks are used under a revocable, non-exclusive license, subject to these rules and to the marks-usage guidelines published at [SANS TO CONFIRM: URL]. The license terminates automatically upon revocation under Section 5.5. SANS enforces against false or misleading claims of nomination, finalist status, or winning.

12.5 Sanctions and Legal Compliance

Nominations, recognition, and any conferred benefit are subject to applicable sanctions, export, and anti-corruption laws. SANS screens as required and withholds or withdraws recognition where conferral is prohibited. [FOR COUNSEL: screening scope]

12.6 Nature of the Award

No purchase, payment, or commercial relationship with SANS is required to nominate, be nominated, vote, or win. [SANS TO CONFIRM: statement of what recipients receive, e.g., trophy and recognition only; if anything of monetary value is conferred, FOR COUNSEL: contest-law review.]

12.7 Minimum Age

Nominees must be 18 years of age or older at the close of the nomination window. [FOR COUNSEL: alternative guardian-consent mechanism if the Board wishes to permit younger nominees.]

12.8 Force Majeure

Postponement, relocation, or cancellation of the ceremony does not void awards or restart process clocks except as publicly announced by the Secretariat.

12.9 Records and Data Handling

Nomination, vetting, scoring, ballot, and voting records are retained for [SANS TO CONFIRM: period] following the cycle and then destroyed, except records SANS must retain by law. Access is limited to the Secretariat, the Chair, and the Awards Oversight Officer. Personal data is handled per the SANS privacy notice at [SANS TO CONFIRM: URL]. [FOR COUNSEL: lawful basis, cross-border transfer, and data-subject request handling, including third-party standing reports.]

12.10 Governing Law and Disputes

These rules are governed by the laws of [FOR COUNSEL: jurisdiction]. Disputes are resolved in [FOR COUNSEL: forum].

12.11 Severability and Entire Rules

If any provision of these rules is held unenforceable, the remainder stands. These rules, together with the documents they incorporate by reference, are the complete terms of the program.