Two-hour exercise agenda
| Elapsed time | Activity |
|---|---|
| 00:00–00:10 | Briefing and role check |
| 00:10–00:45 | Part 1 · Propose and approve security controls |
| 00:45–00:50 | Break and incident release |
| 00:50–01:40 | Part 2 · Investigate, contain, and recover |
| 01:40–02:00 | Close the session, review scores, and debrief |
Create teams and confirm both participants can sign in before the session. The instructor releases the incident and closes the exercise. Each incident checkpoint starts a new timer. At 3, 5 and 7 minutes, the score deduction rises to 10, 20 and 30 points, and the simulated attack escalates.