Risks

Critical lines (read once, aloud, when a risk first reaches Critical)

• Security: "The CTO: 'The attacker has reached a new part of the research environment.'"
• Financial: "The CFO: 'We cannot fund the next week of response without going to the board.'" Financial Critical also forces one beat: an emergency board call, one sentence from each seat.
• Reputational: "General Counsel: 'A stakeholder has heard about this from someone other than us.'"

Triangle (mark where you set each arm)

7 or more shields one step on the paired risk. 2 or less adds one step, once. Reset to 4, 4, 4 after every decision.

Containment marks

After each decision, move the board. A risk never goes past Critical (the worst step); steps beyond it are lost, and its Critical line is read once, when it first reaches Critical. If a risk reaches Critical, read its line from the run sheet. If Financial reaches Critical, also run the board call now: one sentence from each seat, once per game.

Closing the game (after Decision 3 and Inject 6)

1. Read your chip's Inject 6 line.
2. Part one of the verdict, from the marks: "Containment reached" if both marks are set (Ways in shut, Leak stopped); otherwise "Containment not yet reached".
3. Part two, one sentence from the board, for example "Security Steady, Financial Serious, Reputational Strained". If containment was reached with any risk at Critical, say "contained, at a cost the business cannot sustain". If containment was not reached, name any risk at Critical in the sentence.
4. The CEO writes one name on the Decision Record: who is accountable for fixing what this showed, and by when. It is not a condition of containment. If the room is behind, the name is written in the debrief instead.