Rules Sheet
Malware & Management · for every seat at the table
The first-order rules
1
ObjectiveContain a fast-moving malware incident by resourcing, authorising and defending your technical team's response, before it spreads and before the business pays more than it can afford.
2
Executives decideYou always decide. Your Incident Master (IM) rolls a d20 only in doubt, against the target on the option card. Backers add +1 each, up to +3, and the proposing seat adds its specialty, +1 to +3.
3
Three risksSecurity, Financial and Reputational risk sit on a board for everyone to see. The scenario card says which matters most. Time is the clock, not a risk.
4
Executive DecisionsBig calls are Executive Decisions: at most 3 per game, from the menu on the scenario card. A strict majority carries it: 3 of 4, 3 of 5, 4 of 6, 4 of 7, 5 of 8 seats. A tie fails; the table may re-propose once while time remains. The IM chairs.
5
Risk triangle12 points: Money, Time and Quality, 4 each to start. Split the twelve as the table chooses, between 1 and 8 on any one arm. A point is what you protect: Money the budget, Time speed, Quality thoroughness. Money pairs with Financial, Time with Security, Quality with Reputational: 7 or more shields a step, 2 or less adds one, once per decision, and the triangle resets to 4, 4, 4 after each one. The table sets the three arms aloud after the option is carried and before the cards go down, and the IM reads the numbers back.
6
Timer adds pressureEvery Executive Decision runs against a timer, because real incidents do not wait for consensus. Your IM sets the length.
7
Lasting effectsA condition is a card for a lasting effect, tracked by your IM. Some help, some hurt. The panic-hired consultant only costs: bought at most once, inside Decision 2, it makes Financial Risk one step worse to the end of the session, and money cannot shield it away. On a partial result the complication is told as a story beat and moves no marker; a complication's own step lands only on a failure.
8
How it endsYour IM declares containment after the last Executive Decision, and the game ends there. Containment needs both marks, Ways in shut and Leak stopped; the scenario card says which decision sets them. A risk at Critical stays at Critical: announce it once and a further step costs nothing. If a decision's timer runs out, the wait option applies with its printed cost and complication, with no roll. If time runs out, your IM calls it. There is no score: the verdict says whether containment was reached and what it cost, read off the risk board. Anything this sheet does not settle, your IM rules.
How a session runs
Prepare the tableBrief the tableRun each injectDeclare containmentVerdict and debrief
How each inject runs
The table actsPlayers discuss and propose what to do.
VoteOnly for an Executive Decision, against the timer. Strict majority; a tie fails.
DecideThe player decides. It is always theirs.
RollOnly when in doubt, against the printed target.
RuleYour IM rules the outcome aloud.
Move the boardYour IM moves the risk markers aloud, then asks: contained?
The parts are fixed by the rules; the exact order is a walkthrough default, and your IM may run it differently.
What is on the table
Decision CardsFour cards, one per seat. Options and targets printed; the holder ticks votes, triangle, roll and outcome.
Escalation CardWhy you were called now. On the table for the opening.
Executive Situation BriefWhat happened, what we know and do not, and the decision in front of you.
Risk board and condition cardsThree risk markers, and cards for lasting effects.
TimerRuns for every Executive Decision.
Triangle and roll12 points to set; the roll for what a decision leads to.
Your IM is the ruling authority. Where this sheet is silent, your IM rules.Rules Sheet