Competition Checklist · 11 · Competition Finish
Final 15-Minute Checklist
Shift from broad hardening to stability, verification, high-confidence remediation, documentation, configuration saving, and team handoff.
The final minutes are not the time to chase every remaining weakness. Protect the mission, verify the highest-impact work, and avoid introducing a problem that cannot be recovered.
Quick Use
Final-round rule
Stability matters more than one more speculative fix
A verified system with one documented low-priority weakness is better than a broken required service caused by an untested last-second change.
First priorities
What to do when the final 15 minutes begin
Stop broad experimentation.
The final minutes are for stability, verification, and high-confidence fixes, not large configuration changes with unknown side effects.
Retest mission-critical functionality first.
Required services, shares, remote access, applications, and network paths must still work before anything else matters.
Review only unresolved high-impact findings.
Focus on privilege, suspicious persistence, disabled security controls, or broken required services instead of low-value cosmetic hardening.
Confirm persistence and remote-access state.
Scheduled tasks, cron jobs, services, RDP, SSH, VTY, and listeners can reintroduce risk if they are not checked again.
Save validated network configuration.
A working Cisco configuration should be saved only after required reachability and policy are verified.
Complete the team handoff.
Everyone should know what is finished, what remains unresolved, and what should not be touched in the final moments.
15-minute timeline
Use the remaining time deliberately
15-12 min
Team sync
Each owner reports current status, unresolved high-impact findings, and any mission-critical function that needs retesting.
12-8 min
Mission verification
Retest required services, shares, applications, remote access, and network paths.
8-5 min
Security re-sweep
Re-check privilege, persistence, listeners, security controls, and the most important remediations.
5-3 min
Documentation
Finish the change log, unresolved findings, and forensic notes.
3-0 min
Stability only
Avoid new risky changes. Save validated network configuration and perform the final handoff.
Platform final sweep
Retest the essentials on each system
Windows 11
Approved users and Administrators membership match the mission.
Defender and Firewall remain enabled and healthy.
Windows Update remains available.
Required services are running.
RDP state matches the scenario.
Scheduled tasks and startup entries were re-checked.
Suspicious listeners or processes did not return.
Required shares and applications still work.
Windows Server
Required roles and features remain installed.
Approved local and domain privilege is correct.
Required SMB shares still work.
Share and NTFS permissions remain correct.
RDP / WinRM state matches the mission.
Required services are running.
No remediation broke server dependencies.
Important authentication and service evidence is preserved.
Linux
Approved users and sudo rights are correct.
Required services remain active.
SSH state matches the mission.
Cron jobs and systemd timers were re-checked.
Sensitive permissions remain correct.
Listeners and active connections were reviewed.
Firewall state supports required services.
Authentication and journal evidence is preserved.
Cisco / Networking
Required interfaces are up.
VLAN and trunk state is correct.
Required routes are present.
ACL order, placement, and direction match the policy.
Approved SSH / VTY management still works.
Port-security state is understood.
Required reachability was retested.
The verified configuration was saved.
Forensics
Open forensic questions have enough evidence to answer or are clearly marked unresolved.
Important files have paths, timestamps, and hashes where practical.
Authentication, process, service, persistence, and network evidence is preserved.
Timeline notes use consistent time-zone context.
Major conclusions are supported by multiple artifacts when possible.
Observation and interpretation remain separated.
High-risk final actions
Avoid changes that are difficult to recover
Bulk disabling services
A late service sweep can break dependencies and leave no time to recover.
Large firewall or ACL rewrites
A broad policy change can break required traffic and be difficult to troubleshoot quickly.
Deleting unknown accounts without validation
A legitimate service or administrator identity may be removed.
Recursive permission changes
Broad ownership or ACL edits can break applications, shares, or system behavior.
Unverified package or role removal
Required functionality can disappear with little time to restore it.
Restarting systems without a clear reason
A reboot can introduce new problems, destroy transient evidence, or consume valuable time.
Final decision questions
Ask these before approving another major change
What required function would hurt us most if it were broken right now?
Which unresolved finding has the highest security impact?
Which change would be hardest to reverse if it goes wrong?
Did any suspicious persistence return?
Did any approved account lose access?
Are the security controls still enabled?
Has required network reachability been retested?
Is every major change documented and verified?
Save & handoff
End with a state the next person can trust
Windows / Linux
Do not make new high-impact changes unless they address a confirmed critical issue. Keep required services stable.
Cisco
Save the configuration only after reachability, ACL behavior, VLANs, trunks, and management access are verified.
Forensics
Preserve the final evidence notes and mark unanswered questions clearly instead of guessing.
Team lead
Collect one final status from every owner: verified, unresolved, or do not touch.
Final 15-Minute checklist
Finish with verification, documentation, and stability
The team stopped broad experimentation.
Mission-critical services were retested.
Approved users and privilege were re-checked.
Core security controls remain enabled.
RDP, SSH, WinRM, and VTY state match the mission.
Suspicious persistence was re-checked.
Listeners and active connections were reviewed.
Required shares and applications still work.
Required VLANs, trunks, routes, and ACL behavior were verified.
Required network reachability was retested.
The verified Cisco configuration was saved.
Important forensic evidence is preserved.
The change log is current.
Unresolved findings are clearly marked.
Each platform owner gave a final status.
No new risky change is being started in the final moments.