Decision 1
What stops today, and what exposure do we buy?
After Inject 3 · timer 3 minutes · held by the CIO
The captain finds the cell (option row, band column), reads the quoted line, does the bracketed board cue (never read aloud), and takes the named chip.
| Option | Full (target met, or automatic) | Partial (1 to 3 below target) | Failure (4 or more below target) |
|---|---|---|---|
| A Dark now (automatic if an owner was named in the first call, else 10+) | "The CTO: 'The research link is dark and every way in we know of is shut. Research that depends on it is paused for now.'" [Set both marks now. Take chip S.] | "The CTO: 'The link is dark and every way in we know of is shut. Part of what research relied on is not working.'" [Set both marks now. Take chip S.] | "The CTO: 'The link is dark, but the shutdown did not finish. More of research is down, and the attacker still has a way in.'" [Marks wait until ED2 resolves. Take chip L.] |
| B Window (10+) | "The CTO: 'The link is open under watch and the temporary link is being built. So far we see nothing beyond what we expected.'" [Marks at Inject 5. Take chip W.] | "The CTO: 'The link is open under watch and the temporary link is being built. We are seeing more activity than we expected.'" [Marks at Inject 5. Take chip W.] | "The CTO: 'The link is open, and the attacker is taking more research data than we expected. The temporary link is behind.'" [Marks are never set on this path. Take chip X.] |
| C Wait (15+) | "The CTO: 'Research is running and the temporary link is being built. The ways in are open, and every hour they stay open the attacker can keep reading.'" [Marks at Inject 5. Take chip H.] | "The CTO: 'Research is running and the temporary link is nearly built. The ways in are open, and the attacker is taking more than we expected.'" [Marks at Inject 5. Take chip H.] | "The CTO: 'The ways in are open and the most valuable research files are now copied. The temporary link is not ready.'" [Marks are never set on this path. Take chip Z.] |
| Expiry (no majority; ignore the band columns) | "The CTO: 'The ways in are open and the most valuable research files are now copied. The temporary link is not ready.'" [Same as C failure. Marks are never set on this path. Take chip Z.] |
[Malware & Management · scaled version]
[Decision card 1]
Decision 2
Whose time and whose money?
After Inject 4 · timer 3 minutes · held by the CFO
3 minutes of discussion and vote on the table timer, inside the room's 8-minute block. After the vote, in this order: 1. resolve the decision; 2. ask once "Does anyone call Restart before certification?"; 3. the consultant offer: ask the CFO once, "Does the table want outside help?"; if no, move on. If the narrator has already called time (an expiry), skip steps 2 and 3. At the narrator's one-minute call, stop and skip whatever is left, the consultant first.
| Option | Full (target met, or automatic) | Partial (1 to 3 below target) | Failure (4 or more below target) |
|---|---|---|---|
| A (automatic: always Full) | "The CTO: 'The integration team is on the response. Once the ways in are shut, certification is expected in hours, not a day. The integration work slips a week.'" [Financial +2 now. No roll. No complication.] | ||
| B (10+) | "The CTO: 'Emergency budget and overtime are approved. Once the ways in are shut, certification is expected in about a day and a half.'" [Financial +1 now. No complication.] | "The CTO: 'Overtime is approved. Certification is running behind.'" [Financial +1 now. The complication is told; no board move.] | "The CTO: 'Certification is now expected in two days.'" [Financial +1 now. Reputational +1, no shield.] |
| C (10+) | "The CTO: 'The internal team is working on it. Once the ways in are shut, certification is expected in more than a day. I cannot call research safe yet.'" [Reputational +1 now. No complication.] | "The CTO: 'Certification is expected in more than a day. A stakeholder is asking when research can be relied on.'" [Reputational +1 now. The complication is told; no board move.] | "The CTO: 'Certification is expected in more than a day. A stakeholder has called the CEO.'" [CEO answers in one sentence, no vote. Reputational +1 now, +1 more, no shield.] |
| Expiry (no majority; ignore the band columns) | "The CTO: 'The internal team is working on it. Certification is expected in more than a day. A stakeholder has called the CEO.'" [Same as C failure, no roll, no triangle effects. Reputational +2. CEO answers in one sentence, no vote. Reset the triangle to 4, 4, 4.] |
[If your Decision 1 chip is L, set both containment marks now.]
Optional, once, by the CFO's tick. "The CTO: 'Outside help is available. It is a new, uncontracted engagement and cannot contribute inside this window.'" The table votes (a strict majority, on the same ladder as an Executive Decision). If yes: Financial one step worse for the rest of the game, no roll, no shield. [CFO ticks the box.] [Skip this first when the narrator calls one minute left. The script puts the offer inside the Decision 2 box; here it runs after the result, ASSUMED.]
[Malware & Management · scaled version]
[Decision card 2]
Decision 3
What do we say, to whom, and when?
After Inject 5 · timer 3 minutes · held by the CISO
3 minutes of discussion and vote on the table timer, inside the room's 5-minute block.
Step 0, before you start the timer: read Counsel's note aloud: "Counsel's note: 'The findings can be shared with the CSIRT with stated confidence. I will not call holding safe.'" Fill in two checkboxes from the earlier cards: CSIRT contact named in the first call: yes / no. Decision 1 option chosen: A / B / C.
| Option | Full (target met, or automatic) | Partial (1 to 3 below target) | Failure (4 or more below target) |
|---|---|---|---|
| A (10+) | "Counsel's note: 'The CSIRT has our full findings with our stated confidence. Stakeholders have been told. The supplier has our demand.'" [Financial +1 now. No complication.] | "Counsel's note: 'The CSIRT has our findings. Part of the scope is still uncertain.'" [Financial +1 now. The complication is told; no board move.] | "Counsel's note: 'The findings have not gone out. Credibility with the CSIRT and stakeholders is at risk.'" [Financial +1 now. Reputational +1, no shield.] |
| B (automatic or 10+) | "Counsel's note: 'The CSIRT has a validated subset. Stakeholders are waiting for a firmer scope. The supplier has been asked for a call.'" [Reputational +1 now. No complication.] | "Counsel's note: 'The CSIRT has a subset, and it is missing something they need.'" [Reputational +1 now. The complication is told; no board move.] | "Counsel's note: 'The subset has not gone out. Other victims stay exposed longer.'" [Reputational +1 now. Security +1, no shield.] |
| C (15+) | "Counsel's note: 'The CSIRT has nothing yet. Stakeholders have been told nothing.'" [Reputational +2 now. No complication.] | "Counsel's note: 'The CSIRT has nothing yet and has asked again in writing.'" [Reputational +2 now. The complication is told; no board move.] | "Counsel's note: 'The CSIRT has escalated its request and is treating us as withholding.'" [Reputational +2 now, +1 more, no shield.] |
| Expiry (no majority; ignore the band columns) | "Counsel's note: 'The CSIRT has escalated its request and is treating us as withholding.'" [Same as C failure, no roll, no triangle effects. Reputational +3, then the deferred Decision 1 cost with no shield. Reset the triangle to 4, 4, 4.] |
After the vote, the triangle and the roll, do the deferred Decision 1 cost (once): if your table chose option A in Decision 1 and did not choose A here, Reputational is one step worse. A Quality arm of 7 or more cancels one Reputational step in total at this decision: if the option's own cost is on Reputational, the arm cancels that first and this deferred cost still applies. On expiry it applies with no shield. [Do this last, never first.]
[Malware & Management · scaled version]
[Decision card 3]
Leadership calls
Three calls that are not Executive Decisions
Held by the CEO
The CEO names the incident lead, the owner of the old system and the CSIRT contact. Any seat can object, which triggers a vote. If nobody at all is named, Security goes one step worse before Decision 1. If only some are named, no penalty: an unnamed old-system owner makes Decision 1 option A a 10+ roll, and an unnamed CSIRT contact makes Decision 3 option B a 10+ roll.
Restart before certification: a leadership call on the CEO's Leadership Calls card. The captain asks once after the Decision 2 result: "Does anyone call Restart before certification?" If a seat calls it, the table votes: a strict majority, on the same ladder as an Executive Decision, 3 of 4, 3 of 5, 4 of 6, 4 of 7, 5 of 8 seats. The CEO rolls against a target of 15+; each other seat whose sentence in the Restart vote names a person, a budget or a deadline adds +1, up to +3.
The CEO writes one name on the Decision Record: who is accountable for fixing what this showed, and by when. It is not a condition of containment. If the room is behind, the name is written in the debrief instead.
[Malware & Management · scaled version]
[Leadership calls card]