Competition Checklist · 10 · Verification
Mid-Round Verification Checklist
Pause the main hardening pass long enough to prove that required services, users, remote access, security controls, persistence, and network paths still match the mission.
The purpose of this sweep is regression detection. It catches accidental breakage before the final minutes become too expensive to troubleshoot.
Quick Use
Verification rule
Do not wait until the last five minutes to discover what broke
Mid-round verification should be short and deliberate. Re-test the functions that matter most, compare the current state with the mission, and fix regressions before continuing.
Core sweep
Six areas to verify before continuing
Required services
Accounts & privilege
Security controls
Persistence
Network state
Evidence & documentation
Platform sweep
Ask each owner to verify the essentials
Windows 11
Windows Server
Linux
Cisco / Networking
Forensics
Regression signals
If one of these appears, investigate the last relevant change first
Required service stopped after hardening
Identify the exact change that caused the regression, restore only the required function, and document the correction.
Approved user lost access
Check group membership, ACLs, sudo, RDP, SSH, and application-specific rights changed earlier in the round.
Suspicious listener returned
Correlate the listener with process, service, task, cron, or timer persistence before containing it again.
Network path broke
Re-check interface state, VLANs, trunks, routes, and ACLs in that order before making another broad change.
Service works locally but not remotely
Check firewall, ACL, listener binding, route, and remote-access restrictions before changing the service itself.
Evidence no longer matches the current state
Keep the original evidence in the case notes and record the remediation time so the timeline still makes sense.
15-minute mid-round sweep
Keep the verification pass short and structured
2 minutes
Team sync
Each owner gives one status line: what is secure, what is broken, and what is unresolved.
4 minutes
Mission-critical verification
Retest required services, shares, remote access, applications, and network reachability.
4 minutes
Security regression sweep
Re-check privilege, listeners, persistence, firewall state, and high-risk findings already remediated.
3 minutes
Evidence and notes
Confirm change-log completeness and preserve anything still needed for open forensic questions.
2 minutes
Prioritize next work
Choose the remaining items that are actually worth spending the final phase on.
Decision questions
Ask these before the team starts the next hardening pass
What critical function have we not retested yet?
Which high-risk finding has not been independently verified?
Did any teammate make a change that another platform depends on?
Which service, route, share, or account is most likely to have been broken accidentally?
Did any suspicious persistence return?
Are all major changes in the change log?
Do we still have any unexplained privileged access?
Are there any open forensic questions that require preserving evidence before the final phase?
Stop doing
Mid-round is where random work should decrease
Stop broad experimentation if required functionality is unstable.
Stop making cosmetic hardening changes while unresolved high-risk findings remain.
Stop changing multiple variables at once when troubleshooting a regression.
Stop deleting evidence before open forensic questions are complete.
Stop making undocumented privilege or network changes.
Stop revisiting already verified low-risk items unless new evidence appears.
Mid-Round Verification final checklist
Continue only after the team trusts the current state
Each platform owner reported current status.
Required services were retested.
Approved user and privilege state was re-checked.
Security controls remain enabled.
Remote-access state matches the mission.
Suspicious persistence was re-checked.
Listeners and active network connections were re-checked.
Required VLAN, route, ACL, and reachability state was verified.
Major remediations were independently verified where practical.
Important forensic evidence is preserved.
The change log is current.
Unresolved findings are clearly prioritized.
The team knows which items are safe to defer.
The final phase will focus on high-value verification instead of random changes.