Role card · your seat · you vote

CEO

Chief Executive Officer

Your archetypeI answer for this. The table decides together, and I make sure someone owns every call.

Strengths and bonuses

  • +3Stakeholder judgement: Knowing what the firm can say, and to whom
  • +2Accountability: Making sure every decision has a named owner and a deadline
  • +1Framing: Pulling a discussion back to what the business is actually deciding

If you proposed the option the table carried and it plays to one of these strengths, add that number to the roll. It stacks with backers.

Focus areas

  • Who is in charge of the response
  • What stakeholders, customers and the public hear
  • Whether the table is deciding or drifting
  • What the firm will have to answer for afterwards

When you shine

  • At the briefing you set the tone: this is a decision room, not a status meeting.
  • In the Executive Decisions you are the voice the table looks to when it stalls, but you hold one vote like everyone else.
  • At the end you answer the question every CEO gets afterwards: who owned what, and when did we know?
  • The risk to watch for: deciding for the table. A tie fails, and nobody breaks it, you included.

Role-play tips

  • Ask for a name and a date, not a plan
  • Use the CFO, CIO and CISO before you decide, and give them your one sentence
  • Say out loud what you are prepared to be accountable for

Questions to drive the game

  1. "Who owns this, by name, and by when?"An unowned decision is the most common process failure in a real incident. Naming an owner is the cheapest fix there is.

  2. "What are we prepared to say, and to whom?"Silence and over-sharing are both decisions. Make the choice before someone else makes it for you.

  3. "What does the business lose if we wait ten more minutes?"It makes the cost of delay as concrete as the cost of acting.

  4. "Which of these can we undo, and which can we not?"Reversible calls can be fast. Irreversible calls deserve the vote.

CFO

Brings you what the response costs and what the business can afford. Ask for a number, then decide how much risk the firm buys with it.

CIO

Tells you what IT can actually do and what it breaks. Ask for the cost of each option before you ask for a recommendation.

CISO

Gives you the 30-second summary and the line to the outside. Ask what is confirmed and what is still unknown.

Malware & Management · every seat votes, a tie fails, your Incident Master rules the restRole card

Role card · your seat · you vote

CFO

Chief Financial Officer

Your archetypeEvery option has a price in cash and in time. I make sure we see it before we choose.

Strengths and bonuses

  • +3Cost of options: Putting a price on each path, in cash and in time
  • +2Resourcing: Whose time, and what exposure, the response draws on
  • +1Trade-offs: Showing what each option buys for what it costs

If you proposed the option the table carried and it plays to one of these strengths, add that number to the roll. It stacks with backers.

Focus areas

  • What delay costs, per hour and per day
  • Emergency spend and who authorises it
  • What the response pulls away from other work
  • The point where the business has paid more than it can afford

When you shine

  • At the briefing you ask what this will cost in cash and in time.
  • In the Executive Decisions you are the seat that makes trade-offs visible, especially when the table wants everything.
  • At the end you show what the incident really cost, and where the money went.
  • The risk to watch for: protecting the budget at the expense of the response. A cheap decision that fails is the expensive one.

Role-play tips

  • Bring numbers, even rough ones, and say how rough they are
  • Ask what a cheaper option risks, not only what it saves
  • Remember that spending money is never the goal: you protect the budget, you do not chase it

Questions to drive the game

  1. "What does a day of this cost us?"Without a figure for delay, every option looks free. Make waiting cost something.

  2. "What does each option cost, in cash and in time?"Cost is the second axis of every real decision. Make the table see both axes.

  3. "Whose time are we spending, and what does it pull away from?"People are the real budget in an incident. Pulling them off other work has a price that arrives later.

  4. "What happens to the business if we pay this and it still fails?"Tests the downside, not only the plan.

CEO

Needs your numbers to set what the firm can accept. Give a range and your confidence in it, not a single figure.

CIO

Knows what IT needs in people and tooling. Ask what the minimum viable response is, then price it.

CISO

Knows how bad it could get. Ask what the worst case costs, so you can weigh it against spending now.

Malware & Management · every seat votes, a tie fails, your Incident Master rules the restRole card

Role card · your seat · you vote

CIO

Chief Information Officer

Your archetypeContainment happens in my house. I know what we can do, how fast, and what it will break.

Strengths and bonuses

  • +3Technical reality: Knowing what IT can do and how long it takes
  • +2Impact: Understanding what an action will break on the way
  • +1Ownership: Knowing who owns each system and each dependency

If you proposed the option the table carried and it plays to one of these strengths, add that number to the roll. It stacks with backers.

Focus areas

  • What the technical team is proposing, and why
  • Dependencies that make a clean cut hard
  • How long each option really takes
  • Whether the team has the people and access it needs

When you shine

  • At the briefing you say what IT can do and how long it takes.
  • In the Executive Decisions you give the table the practical side of each option, so the vote is on something real.
  • At the end you explain what the response left behind: what is rebuilt, what is still fragile.
  • The risk to watch for: speaking for the technical team as if you were it. The team proposes, the table chooses.

Role-play tips

  • Describe options by their business effect, not their technology
  • Say what you do not know about your own estate
  • Do not let your seat become the only source of technical facts: ask the CISO for the independent view

Questions to drive the game

  1. "What can the technical team do in an hour, and what does it break?"Speed and side effects are the two numbers every option hides.

  2. "Who owns that system, and who depends on it?"Unowned systems are where incidents hide, and where decisions stall.

  3. "What do we lose if we do this the safe way, and what if we do it the fast way?"Forces the real trade-off into the open.

  4. "What would you need from us to do it better?"Resources are the added value of leadership. Ask what the team is short of.

CEO

Needs to know who owns the response. Tell them what IT needs decided, and by whom.

CFO

Pays for what you ask for. Give them the minimum and the stretch version, with what each buys.

CISO

Shares the technical picture with you, but sees it independently. Compare notes before the table does.

Malware & Management · every seat votes, a tie fails, your Incident Master rules the restRole card

Role card · your seat · you vote

CISO

Chief Information Security Officer

Your archetypeI tell you what we know, what we do not, and what would change our mind. Then we decide.

Strengths and bonuses

  • +3Threat assessment: Separating confirmed, probable and unknown
  • +2The outside line: The relationship with the national CSIRT and other authorities
  • +1Independent view: A second voice on the incident next to the CIO

If you proposed the option the table carried and it plays to one of these strengths, add that number to the roll. It stacks with backers.

Focus areas

  • What is confirmed, what is probable, what is unknown
  • What would change the picture, and how soon
  • What outsiders already know about this
  • How far the incident could still spread

When you shine

  • At the briefing you give the table the first honest picture.
  • Before every vote you give the 30-second summary: what we are deciding, what we know, what we do not.
  • At the end you help the table see what the incident exposed in how the firm is run.
  • The risk to watch for: hiding in caveats. The table needs a clear picture, with the uncertainty labelled, not a refusal to commit.

Role-play tips

  • Say "I do not know yet" and what would tell you
  • Keep the summary to one breath: what we decide, what we know, what we do not
  • Name the thing that would make you change your recommendation

Questions to drive the game

  1. "What would change our mind?"Makes the uncertainty useful: it turns an unknown into something the table can wait for or act without.

  2. "What is confirmed, what is probable, what is unknown?"Three labels, one sentence each. Without them, the table argues from the loudest guess.

  3. "What do we need to know before we call this contained?"Containment is a judgement, not a feeling, and the Incident Master makes it. Ask what has to be true first.

  4. "Who outside this room needs to hear this, and when?"The outside line is yours. Time and wording matter, and the CSIRT and counsel have a view.

CEO

Needs a clear picture to decide. Give them the decision frame first, the detail second.

CFO

Needs the worst case to weigh against spending now. Give a range and what drives it.

CIO

Knows the estate. Agree who tells the table what, so you do not give two versions of the facts.

Malware & Management · every seat votes, a tie fails, your Incident Master rules the restRole card