The first call
Incident lead
Owner of the old system
CSIRT contact
Nobody named
Decision Record Operation Silk Harvest · fill in as you play, read in the debrief
The three Executive Decisions
1
What stops today, and what exposure do we buy?
Option chosenABCNo resolution (wait outcome)Voteof ___
Rolltarget __+ d20 ___ backers +__ specialty +__ total ___FullPartialFailureNo roll
What it led to
2
Whose time, and what exposure do we carry?
Option chosenABCNo resolution (wait outcome)Voteof ___
Rolltarget __+ d20 ___ backers +__ specialty +__ total ___FullPartialFailureNo roll
What it led to
3
What do we say, to whom, and when?
Option chosenABCNo resolution (wait outcome)Voteof ___
Rolltarget __+ d20 ___ backers +__ specialty +__ total ___FullPartialFailureNo roll
What it led to
The leadership calls
The first call
Incident lead
Owner of the old system
CSIRT contact
Nobody named
Restart before certification
ReopenWaitNot asked
Voteof 4. Roll (15+)
It led to
The consultant
BoughtNot bought
Voteof 4
Financial one step worse to the end of the session when bought.
What the table found
AFast-track exceptionFoundMissed
BNobody owned the trade-offFoundMissed
CSpeed again and againFoundMissed
The risk board, at the end
Security
SteadyStrainedSeriousCritical
Financial
SteadyStrainedSeriousCritical
Reputational
SteadyStrainedSeriousCritical
Circle the step each marker ended on.
The verdict
The two marksWays in shutLeak stopped
ContainmentReachedNot yet reached
The cost, one sentence
What we take back: one line per seat
CEO
WhenI willby
CFO
WhenI willby
CIO
WhenI willby
CISO
WhenI willby
CEO
Accountable for fixing what this showedby
Malware & Management · the CEO writes the remediation owner Decision Record