CyberPatriot Competition Checklists
Fast reference without blind hardening
Twelve quick-reference checklists for competition workflow, operating systems, networking, forensics, identity, services, documentation, verification, and final-round review.
These support authorized practice and competition preparation. They do not replace scenario instructions or provide live-round answers.
Section Snapshot
What these are
A competition memory aid
Each checklist helps you remember what to inspect, what evidence to preserve, what dependencies to protect, and what to verify before moving on.
What these are not
Not a universal answer sheet
The scenario always overrides a generic checklist. Required accounts, services, remote access, shares, roles, and network behavior may differ from image to image.
Checklist rules
Use the lists without turning them into blind automation
Mission first
The scenario requirements always override a generic checklist.
Inspect before changing
Establish the current state before making configuration changes.
Preserve evidence
Record useful logs, hashes, paths, timestamps, PIDs, service state, ACL counters, and network evidence before remediation.
Make narrow changes
Use the smallest justified correction instead of broad cleanup.
Verify immediately
Repeat the check that revealed the issue and confirm required functionality still works.
Document uncertainty
If evidence is incomplete, record the finding as unresolved instead of guessing.
Checklist library
Twelve competition-ready references
Open any checklist below for a fast competition-ready reference.
Competition Start Checklist
Focus
Read the scenario, identify required services, record approved users, assign platform owners, establish a change log, and capture the initial state before touching configuration.
When to use it
Use during the first 10 to 15 minutes so the team starts from the mission instead of random hardening.
Windows 11 Checklist
Focus
Review accounts, Administrators, Defender, Firewall, updates, services, startup items, scheduled tasks, remote access, processes, listeners, shares, and event evidence.
When to use it
Use as the main workstation review list after reading the image-specific requirements.
Windows Server Checklist
Focus
Review privileged identities, installed roles, required shares, active sessions, services, RDP, firewall state, authentication evidence, and dependencies.
When to use it
Use when securing a server without breaking required organization services.
Linux Ubuntu & Mint Checklist
Focus
Review users, groups, sudo, ownership, permissions, packages, services, SSH, firewall state, cron, systemd timers, processes, listeners, and authentication logs.
When to use it
Use for Ubuntu and Mint while adapting commands to the actual image and mission.
Cisco & Networking Checklist
Focus
Review interface state, VLANs, trunks, access ports, routing, ARP, ACLs, VTY access, SSH, port security, logging, and required reachability.
When to use it
Use to troubleshoot methodically instead of changing configuration by guesswork.
Forensics Checklist
Focus
Preserve hashes, paths, timestamps, authentication evidence, process clues, services, scheduled activity, browser artifacts, and network context before drawing conclusions.
When to use it
Use when a round includes a forensic question or suspicious activity needs evidence-based investigation.
Accounts & Privilege Checklist
Focus
Compare every user and privileged group against the mission, investigate recent account changes, verify administrative rights, and avoid removing approved service or administrator accounts.
When to use it
Use across Windows, Server, and Linux whenever identity or privilege findings appear.
Services & Remote Access Checklist
Focus
Identify required services, investigate unknown services, review SSH and RDP requirements, correlate listeners with processes, and verify that disabling an unneeded service does not break the mission.
When to use it
Use before stopping, disabling, or removing anything network-facing.
Evidence & Change Log Checklist
Focus
Record the original state, commands run, evidence found, exact changes made, reasons, verification results, and unresolved questions.
When to use it
Keep this open throughout the round so the team can coordinate and avoid duplicate or unexplained changes.
Mid-Round Verification Checklist
Focus
Re-check required services, core security controls, privileged access, network reachability, active listeners, scheduled activity, and high-risk findings already remediated.
When to use it
Run after the main hardening pass to catch accidental breakage before the final minutes.
Final 15-Minute Checklist
Focus
Stop risky experimentation, verify mission-critical functionality, review unresolved high-impact findings, confirm persistence and remote access state, save approved network configuration, and perform a final handoff.
When to use it
Use when the round is almost over and stability matters more than broad last-second changes.
Team Lead Handoff Checklist
Focus
Collect platform status, unresolved findings, verified changes, required-service checks, forensic notes, and final priorities from each teammate before the round ends.
When to use it
Use by the team lead to maintain one clear picture of the environment.
Round flow
Where the checklists fit during a competition
Read
Identify required services, approved users, restrictions, and image-specific instructions.
Baseline
Capture accounts, services, processes, network state, security controls, and logs.
Prioritize
Handle active suspicious behavior, privilege exposure, disabled security controls, and broken mission services first.
Remediate
Make one narrow, justified change at a time and record it.
Verify
Confirm the change worked and did not break required users, services, shares, routes, or management access.
Re-sweep
Use the mid-round and final checklists to catch persistence, regression, and unfinished high-impact findings.
Final standard
A checklist item is complete only when it is verified
Required users, services, shares, roles, and network paths still work.
Core security controls remain enabled and healthy.
Privileged access matches the mission.
Unneeded remote access is disabled only when the scenario supports that decision.
High-impact findings are backed by evidence and verified after remediation.
Important logs and forensic artifacts were preserved before state-changing actions.
Every major change has a reason and a verification result.
The team can explain what remains unresolved and why.
Start here
Begin with the Competition Start Checklist
Start with the opening-round checklist, then use the platform and verification references whenever they fit the competition phase.
Start Checklist 01 →