Competition Day Guide · Guide 06 · Baseline & Priority
Baseline & Priority Board
A baseline tells the team what existed before major changes. A priority board turns findings into controlled work instead of a race to fix everything at once.
The strongest teams know both the current system state and the reason one task deserves attention before another.
Operating Goal
Baseline rule
Capture enough original state to explain and verify what changes
A baseline is not endless documentation. It is a practical record of the identities, services, persistence, network state, evidence, and mission functions that matter to later decisions.
Baseline areas
Know the starting state that matters
Identity
Services & Remote Access
Persistence
Network
Evidence
Mission Health
Priority factors
Rank work using more than suspicion
Mission Impact
Could this issue break a required service, approved access path, or scoring-sensitive function?
Security Impact
Does this issue create meaningful unauthorized access, privilege, persistence, exposure, or evidence risk?
Evidence Confidence
Do we have enough evidence to justify the conclusion and the remediation?
Change Risk
Could the proposed action create a larger problem than the one we are trying to solve?
Reversibility
Can we safely undo the change if verification fails?
Time Cost
Is the likely value worth the investigation and remediation time right now?
P1-P4 model
Give the team a shared meaning for urgency
P1
Immediate
Mission-breaking failure, dangerous unauthorized privilege, major persistence, or critical network/service problem with strong evidence.
P2
High Value
Confirmed security issue with meaningful impact, understood remediation, and a safe verification path.
P3
Useful
Hardening or cleanup that improves security but is less urgent than confirmed access, privilege, persistence, or mission problems.
P4
Low Confidence / Low Value
Weak evidence, small likely benefit, cosmetic cleanup, or a risky change that is not justified by current information.
Priority board
Track the information needed to make safe decisions
Finding
Short description of the issue or question.
Platform
Windows, Server, Linux, Cisco, Forensics, or shared operations.
Owner
One person responsible for the current state of the item.
Priority
P1, P2, P3, or P4 based on mission, security, evidence, and risk.
Evidence
What supports the finding before remediation.
Status
Investigating, Changed, Verified, Unresolved, or Do Not Touch.
Verification
How the team will prove both security improvement and mission health.
Notes
Dependencies, rollback information, and handoff details.
Example findings
Think about evidence and mission impact together
P1 or P2
Unknown local administrator
Potential unauthorized privilege. Confirm identity and mission context before removal.
P1
Required service stopped
Mission impact is immediate. Verify expected role and restore only with evidence-backed reasoning.
P2
Unfamiliar scheduled task
Potential persistence. Preserve task details and related evidence before remediation.
P4
Cosmetic desktop setting
Little security value compared with identity, persistence, service, and network work.
P2
Broad remote-management exposure
Meaningful exposure, but changes must preserve approved administration requirements.
Investigate first
Package or service that is merely unfamiliar
Unknown does not equal malicious. Gather dependency and mission evidence before changing it.
Weak habit vs better habit
Replace random task selection with visible priorities
Weak habit
Make a giant checklist and work top to bottom.
Better habit
Build a live priority board and reorder work as stronger evidence or mission problems appear.
Weak habit
Everything suspicious is urgent.
Better habit
Separate confirmed high-impact issues from low-confidence findings.
Weak habit
Baseline means taking screenshots of everything.
Better habit
Capture the state that will help explain later changes, verify mission health, and preserve evidence.
Weak habit
The first person who sees an issue should fix it.
Better habit
Assign an owner, record evidence, rank priority, then remediate with a verification plan.
Weak habit
Once an issue is fixed, remove it from the board.
Better habit
Keep the item visible as Verified so the team preserves history and avoids duplicate work.
Weak habit
Low-priority means ignore forever.
Better habit
Defer low-value work until higher-risk items are controlled, then reassess if time allows.
Re-prioritize when
The board should change when the environment changes
A required service stops working.
A new privileged account is discovered.
A suspicious persistence mechanism is confirmed.
Network reachability changes unexpectedly.
A teammate makes a high-impact change.
New evidence changes confidence in an earlier conclusion.
A platform owner hands work to another teammate.
The round enters the final 30 minutes.
Final questions
Check whether the team is working from the same picture
Can the team explain the current baseline of every platform?
Are required services and remote-access paths documented?
Are privileged identities and service accounts classified?
Does every major finding have an owner?
Are P1 and P2 issues clearly separated from lower-value work?
Does each high-impact change have a verification plan?
Are low-confidence findings marked as unresolved rather than guessed at?
Can the team identify the single highest-value next action?
Baseline & Priority final checklist
Know the starting state and the highest-value next action
Baseline covers identity, services, persistence, network, evidence, and mission health.
Required functions are recorded before major changes.
Priority board is visible to the team.
Every active item has one owner.
P1 issues represent true mission or critical security risk.
P2 issues have meaningful impact and strong evidence.
P3 work waits behind higher-value findings.
P4 work does not distract the team early.
Evidence is recorded before remediation.
Verification is defined before risky changes.
Verified work remains visible in the team record.
Priorities are rechecked when conditions change.