Incident Master's Glance
Malware & Management · one sheet for the person running the hour · the safety page is read aloud before the first brief
The hour, 56 minutes
| Minute | What you do |
|---|---|
| 0 | State the objective, read the Escalation Card, ask the CISO for thirty seconds |
| 6 | Deliver the first inject, take two questions |
| 14 | Executive Decision 1, against the timer |
| 22 | Deliver the next inject, take two questions |
| 30 | Executive Decision 2, against the timer |
| 36 | Deliver the remaining injects, take two questions |
| 41 | Executive Decision 3, against the timer |
| 47 | Declare containment, or do not |
| 47 to 60 | Verdict on the three risks, then the debrief |
The vote
A strict majority carries an option, against the timer. A tie fails; the table may re-propose once while time remains. If the timer runs out with no majority, the decision is spent and the wait option applies with its printed cost and complication, with no roll and no shield.
| Seats | Carries |
|---|---|
| 4 | 3 |
| 5 | 3 |
| 6 | 4 |
| 7 | 4 |
| 8 | 5 |
The dice
Roll only in doubt, and only when no option fits the facts with its groundwork done. At or above the printed target the intended result happens. Within 3 below, it happens with a complication and no marker moves. 4 or more below, the complication lands whole and the board moves. Backing adds +1 per seat that commits something concrete, to a maximum of +3. The proposing seat adds its specialty grade. There is no bonus for holding the card.
What you may rule, and what you may not
You may rule on anything the printed sheets leave open: who is in the room, how long silence lasts, whether an exhibit is legible from where a seat sits, and how a complication is told. You may not add or remove a decision, change a printed target, move the board on a partial result, or tell a seat what another seat wrote.
The log, in your hand
The three risks, as the board reads after each decision, one step per mark, from 1 to 8.
| After | Security | Financial | Reputational |
|---|---|---|---|
| Start | |||
| Decision 1 | |||
| Decision 2 | |||
| Decision 3 |
The triangle for each decision and what it bought. It resets to 4/4/4 at the start of every Executive Decision.
| Decision | Money | Time | Quality | Option bought |
|---|---|---|---|---|
| 1 | ||||
| 2 | ||||
| 3 |
The votes, and whether the timer caught the table.
| Decision | For | Against | Carried, tie, or expired |
|---|---|---|---|
| 1 | |||
| 2 | |||
| 3 |
The two containment marks, Ways in shut and Leak stopped. The scenario card says which decision sets them and on which result bands; copy the card, do not infer a rule. Declare containment only when both are set and you judge the incident contained.
| Mark | Set by | Set at |
|---|---|---|
| Ways in shut | ||
| Leak stopped |
The ending in one line: containment or not, the cost sentence read off the board, and the one process failure the debrief lands on.
| Containment | Cost sentence | Process failure |
|---|---|---|
Malware & Management, by Klaus Agnoletti. CC BY-NC 4.0. This sheet stays with the Incident Master; it is not a player handout.