The room schedule (minutes)

Block	Min	What happens
Opening	6	Read-aloud, one brief, opening round
Inject 1 and first call	3	The old system; the CEO names three people
Decision 1 block	5	Inject 3 inside; 3-minute table timer; chips taken
Inject 4	2	"Table captains, read your leak status."
Decision 2 block	8	3-minute table timer, then resolution, Restart call, consultant offer
Inject 5	2	"Table captains, read your leak status."
Decision 3 block	5	Counsel's note first, then a 3-minute table timer
Envelope question pool	6	Three short windows after Inject 1, 4 and 5, inside the gaps
Float	3	Spare
Inject 6 and verdict	3	"Table captains, read your leak status." Then each table's verdict
Debrief	13	Table phase 8 (Decision Record, opening-line check), room phase 5 (readout)
Total	56	On paper. Nothing has been timed

Safety before anything else

Read this sentence to the room, and repeat it to each table captain at the first brief: "This is a fictional company and a fictional incident. Anyone can stop the game at any point with one word. You do not have to say why, and nobody will ask. Please do not describe a real incident, and do not name your employer, your colleagues or a customer." Anyone may stop the game with one word: pause the room clock for that table only, ask the one question, and do what the person asks. The room timer is never used to talk someone out of a stop.

Your three calls in every decision box

• Start. Read the inject, say "start". All tables start their 3-minute timer.
• Half-time. Say "half-time". Captains check they are at the triangle step.
• One minute left, then end. Say "one minute". At the end, say "time": all tables reveal their votes together. A table with no majority takes the printed expiry.

Room readout in the debrief (counts only, never a ranking)

Count the tables that	Tables
went dark (Decision 1, option A)
took the window (option B)
waited (option C)
ran out of time on Decision 1 (chip Z)
reached containment
did not yet reach containment

The first three rows are the readout the format defines. The last three are an addition, ASSUMED.

Opening

"A national CSIRT called your CISO a couple of hours ago with a warning about a campaign against life-sciences companies. BioGenix has seen Chinese threat actors in its network before. That is all the record says. Your technical team has been checking since. At five to one they found that you are part of it. Here is your first brief. You are the executive team. The technical team will tell you what it finds. You decide what it is allowed to do, what it may spend and what you are prepared to say." Rules in 90 seconds, no more: the objective; the three risks; that you will take a small number of big decisions, each against a timer. The triangle, the d20 and containment are explained on a Rules Card the first time they are used, at Decision 1.

Inject 1

An old system that was supposed to be switched off has been sending your research data out. The technical team can prove an attacker is using it. Cutting it off will also cut a research collaboration link, and the CTO needs a name.

Inject 3 (inside Decision 1)

The attacker also still has an open door into your research environment, left over from the old arrangement. The CTO can shut every way in within the hour, but the research collaboration link goes dark with it. VP R&D: "Every day that link is dark, we lose ground we cannot win back, and our stakeholders will ask why." CTO: "Every hour it stays open, the attacker can keep reading." The table is asked how long research is allowed to be exposed, and how long it is allowed to be dark.

Inject 4

Core research data has been leaving for weeks, in small quantities that looked routine and that nothing flagged. The CTO: "My team cannot put its hand on its heart that the research environment is clean for at least a day on our own." General Counsel: "Whether this triggers a duty to notify anyone depends on our sector and jurisdiction. I will have an assessment before you speak to stakeholders. Do not call this 'not notifiable' until I do." The question to the table is about people and money: certification could be much faster if the integration team is pulled off integration, but the integration work slips.

Inject 5

The CSIRT confirms at least three other life-sciences victims in six months and asks BioGenix for its findings so it can warn others.

Inject 6

Say: "Table captains, read your leak status." Then each table gives its verdict (the board and the marks decide it).