Rules Card
Malware & Management · read once, keep on the table
1 ObjectiveContain a fast-moving malware incident by resourcing, authorising and defending your technical team's response, before it spreads and before the business pays more than it can afford.
2 Executives decideYou always decide. Your Incident Master (IM) rolls a d20 only in doubt, against the target on the option card. Backers add +1 each, up to +3, and the proposing seat adds its specialty, +1 to +3.
3 Three risksSecurity, Financial and Reputational risk sit on a board for everyone to see. The scenario card says which matters most. Time is the clock, not a risk.
4 Executive DecisionsBig calls are Executive Decisions: at most 3 per game, from the menu on the scenario card. A strict majority carries it: 3 of 4, 3 of 5, 4 of 6, 4 of 7, 5 of 8 seats. A tie fails. The IM chairs.
5 Risk triangle12 points: Money, Time and Quality, 4 each. A point is what you protect: Money the budget, Time speed, Quality thoroughness. Money pairs with Financial, Time with Security, Quality with Reputational: 7 or more shields a step, 2 or less adds one.
6 Timer adds pressureEvery Executive Decision runs against a timer, because real incidents do not wait for consensus. Your IM sets the length.
7 Lasting effectsA condition is a card for a lasting effect, tracked by your IM. Some help, some hurt. The panic-hired consultant only costs: bought at most once, inside Decision 2, it makes Financial Risk one step worse to the end of the session, and money cannot shield it away.
8 How it endsYour IM declares containment after the last Executive Decision, and the game ends there. There is no score: the verdict says whether containment was reached and what it cost. If time runs out, your IM calls it. Anything this card does not settle, your IM rules.
The IM is the ruling authorityRules Card
Escalation Card
Operation Silk Harvest · why you are called now
Severity cell
Lower urgency
Higher urgency
Impact, high at top
Assess
ConveneThis incident
Watch
Assess
High impact on a crown-jewel system, with credible spread or data loss

Page rule

The technical lead and the CISO assess. When the cell reaches HIGH, or a decision exceeds their authority (spend, disrupting research, speaking outside), the executive incident lead convenes the executives and counsel. Board notification is a separate step and is not played.

What crossed the line, and when

~11:00The national CSIRT calls the CISO with a warning.12:55The technical team confirms an attacker is inside, with data probably gone.13:00You sit down. The way in is yours to ask about.
Ask "why were we called now?" once, 30 seconds. More goes to the debrief.Escalation Card
cut
Executive Situation Brief
Brief no. ____ · as of ____:____
CISO, 30 seconds, before any vote"We are deciding ______________________ because we know ______________________ and do not know ______________________."

1What happened, and the business impact one sentence

2What we know and what we do not tag each item; an Unknown says what would change it

Item Tag Basis and as-of time What would change it
Conf Prob Unkn
Conf Prob Unkn
Conf Prob Unkn
Conf Prob Unkn
Conf Prob Unkn

3What the technical team is doing now

4The decision two or three options

Option A
Trade-off. Reversible?
Option B
Trade-off. Reversible?
Option C
Trade-off. Reversible?
The technical team recommends
If we wait: by when, and what gets worse

5Proposed owner and deadline the table assigns the owner

7Next update at

One full brief at the start; later injects use the short brief slip. It never explains why it happened.Brief template · draft
Short brief
Operation Silk Harvest · ____:____

What changed

New, and what we do not know

New deadline, and who owns it

About 20 seconds. Read it out, then ask the seat the question.Short brief slip
Short brief
Operation Silk Harvest · ____:____

What changed

New, and what we do not know

New deadline, and who owns it

About 20 seconds. Read it out, then ask the seat the question.Short brief slip
cut
Condition · hurtsLasts to the end
Panic-hired consultant
Financial Risk is one step worse from the moment it is bought to the end of the session. No countdown, no benefit. The triangle is not touched, and Money cannot shield it away. Bought at most once, inside Decision 2, by majority vote.
Bought
Tick the Decision 2 card
Malware & ManagementCondition card
Condition · helpsExample
Reputation shield
An example of a helpful condition: cancels one step on Reputational, until the next Executive Decision resolves. Your IM may change its effect and its length.
Countdown (your IM sets how long and ticks off)
12345
Malware & ManagementCondition card
Condition · helpsBlank
Countdown (your IM sets how long and ticks off)
12345
Malware & ManagementCondition card
Condition · hurtsBlank
Countdown (your IM sets how long and ticks off)
12345
Malware & ManagementCondition card
Risk Board
Malware & Management · the IM moves the markers aloud after each decision
SecurityIs the attacker still in, and how far can they reach?
Steady
Strained
Serious
Critical
FinancialWhat the response is costing, and what the business can afford.
Steady
Strained
Serious
Critical
ReputationalTrust with stakeholders, the CSIRT and the public.
Steady
Strained
Serious
Critical

How the board works

  • Every risk starts at Steady. "One step worse" moves a marker one step toward Critical.
  • The IM moves a marker aloud after each decision and says why.
  • A risk that reaches Critical is announced at once, with something the table can see, for example "the attacker has reached a new system". It is never banked silently.
  • Financial at Critical triggers one emergency board call: each executive answers in one sentence, and play runs on.

The closing verdict, read off this board

  • Containment: reached, or not yet reached if your IM calls time first.
  • The cost: one sentence, for example "Security Steady, Financial Serious, Reputational Strained". If contained with any risk at Critical: "contained, at a cost the business cannot sustain".
Security
Financial
Reputational
Your IM moves the markers and rules the rest.Risk Board