Competition Checklist · 12 · Team Coordination
Team Lead Handoff Checklist
Collect platform status, required-function verification, unresolved findings, preserved evidence, major changes, and final warnings so the entire team shares one accurate picture of the environment.
A final handoff should be concise enough to use under time pressure, but specific enough that another teammate can understand the state without repeating the investigation.
Quick Use
Handoff rule
A good handoff describes the current state, not the entire history
The team lead needs the information required to make the next decision: what works, what is secure, what remains unresolved, what evidence exists, and what should not be changed.
Status language
Use three clear final states
Verified
The platform owner completed the planned work, required functionality was retested, and the current state is trusted.
Unresolved
A finding remains open, the evidence is incomplete, or the team intentionally deferred the item because the risk of further change was too high.
Do not touch
The current configuration is working and further changes could break required functionality or destroy evidence.
Platform report
Every owner should provide the same seven fields
Current status
State whether the platform is verified, unresolved, or in a do-not-touch state.
Required functionality
Confirm the mission-critical services, shares, applications, remote access, and network paths that were retested.
High-impact findings
List only the most important security or reliability findings, not every minor hardening item.
Changes made
Summarize the meaningful remediations already recorded in the shared change log.
Evidence preserved
Call out important logs, hashes, paths, event IDs, process details, configuration snapshots, or timeline notes.
Open questions
State exactly what remains unknown instead of using vague labels like 'might still be bad.'
Next action
If more work is justified, specify the safest next verification or remediation step.
Platform handoffs
Questions each owner should answer
Windows 11
Do approved users and Administrators membership match the mission?
Are Defender, Firewall, and Windows Update healthy?
Are required services, shares, and applications working?
Does RDP state match the scenario?
Did suspicious tasks, services, processes, or listeners return?
What Windows item, if any, should not be touched again?
Windows Server
Do required roles and services still function?
Are local and domain privileged identities correct?
Do required SMB shares and permissions still work?
Does RDP / WinRM state match the mission?
Did any remediation affect server dependencies?
What server item, if any, remains unresolved?
Linux
Do approved users and sudo rights match the mission?
Are required services and SSH state correct?
Were cron jobs, timers, and persistence re-checked?
Do listeners and firewall state match required services?
Are sensitive permissions still correct?
What Linux item, if any, remains unresolved?
Cisco / Networking
Are required interfaces, VLANs, and trunks operational?
Are required routes present?
Do ACLs enforce the intended policy?
Does approved SSH / VTY access work?
Was required reachability retested end to end?
Was the verified configuration saved?
Forensics
Were important files, logs, paths, hashes, and timestamps preserved?
Are authentication, process, persistence, and network artifacts correlated?
Is the timeline internally consistent?
Are conclusions supported by multiple artifacts where possible?
What remains uncertain?
Did any remediation destroy evidence still needed?
Team lead overview
Confirm four types of health before the round ends
Mission health
Security health
Evidence health
Documentation health
Escalation questions
Use these before approving a late high-impact change
Is the unresolved issue actively dangerous right now?
Could the next change break a required service or lock out the team?
Do we have enough evidence to justify the change?
Can the change be reversed quickly if it fails?
Has the platform owner already verified the current working state?
Would doing nothing be safer than making a speculative last-minute change?
Handoff template
A compact format the team can actually use
Final five minutes
Team lead the clock, not just the technology
5:00-4:00
Collect one concise status report from every platform owner.
4:00-3:00
Confirm mission-critical functionality and any do-not-touch dependencies.
3:00-2:00
Confirm unresolved high-impact findings and decide whether any final action is justified.
2:00-1:00
Ensure the change log, forensic notes, and saved network configuration are complete.
1:00-0:00
No speculative changes. Final team confirmation and stability check only.
Team Lead Handoff final checklist
End with one trusted picture of the environment
Every platform owner gave a final status.
Each platform is marked Verified, Unresolved, or Do not touch.
Mission-critical functionality was confirmed.
Approved user and privilege state was confirmed.
Required remote access still works.
Required network reachability was confirmed.
Core security controls remain enabled.
Suspicious persistence was re-checked.
High-impact evidence was preserved.
Major changes are recorded in the shared change log.
Unresolved findings are clearly described.
Each unresolved issue has a deliberate decision: act, defer, or do not touch.
The verified Cisco configuration was saved.
No teammate is starting a speculative high-impact change.
The team can explain the final state of every platform.