Competition Day Guide · Guide 11 · Final 15 Minutes
Final 15 Minutes
The final fifteen minutes are about protecting known-good state. Broad experimentation stops. Verification, stabilization, documentation, and clean team handoffs become the priority.
A small late improvement is not worth creating a regression the team no longer has time to diagnose and recover from.
Final 15 Goal
Final-15 rule
Stabilization is more valuable than one more uncertain change
As recovery time disappears, the threshold for making a change should rise. Prefer verified functionality, known-good state, and clean documentation over low-confidence last-minute hardening.
15-minute timeline
Reduce risk as the clock approaches zero
15-12 minutes
Freeze broad experimentation
Stop low-confidence changes, large configuration rewrites, unnecessary installs, and anything without a fast rollback path.
12-9 minutes
Verify mission functions
Check required services, approved access, network paths, applications, shares, and platform-specific mission requirements.
9-6 minutes
Finish only high-confidence work
Complete small, evidence-backed fixes that can be verified immediately. Defer uncertain or invasive work.
6-4 minutes
Stabilize and save
Preserve known-good state, save verified network configuration, and avoid replacing a working state with an unverified one.
4-2 minutes
Team status sweep
Every owner reports final state, unresolved items, verification status, and any area that should not be touched.
2-0 minutes
Documentation and final check
Confirm the shared record is current, unresolved risks are visible, and no teammate is still making an uncoordinated high-impact change.
Platform sweeps
Verify the systems the team is about to leave in place
Windows 11
Windows Server
Linux
Cisco & Networking
Forensics
Team Operations
Stop doing
Avoid late changes with large blast radius
Bulk account cleanup without confirmed mission context
Large firewall or ACL rewrites
Recursive permission changes
Unplanned package removal
New security-tool installations
Service disablement based only on unfamiliarity
Experimental registry or policy changes
Unnecessary reboots
Deleting evidence before documentation
Changing several variables at once
Reopening already verified issues without new evidence
Making a major change without telling the team
Safer late actions
Spend the remaining time on confidence and stability
Verify required functionality.
Confirm approved users and administrators.
Record unresolved findings.
Finish a small high-confidence remediation.
Re-test a recently changed service.
Confirm network reachability.
Save a verified known-good network configuration.
Update the shared change log.
Hand off remaining risk clearly.
Protect stable systems from unnecessary changes.
Go / No-Go questions
Ask these before any meaningful late change
Do we have strong evidence for this change?
Is the security or mission value high enough to justify it now?
Can we verify the result before time expires?
Can we reverse the change if it fails?
Could it break required functionality?
Does the platform owner know this change is happening?
Is a safer alternative available?
Would leaving the system in its current verified state be lower risk?
Final status report
Every platform owner should leave these fields clear
01
Platform
02
Owner
03
Mission status
04
Last verified change
05
Outstanding risk
06
Unresolved item
07
Do-not-touch area
08
Final recommendation
Weak habit vs better habit
Replace late-round urgency with disciplined stabilization
Weak habit
Use every remaining minute to keep hardening.
Better habit
Shift from discovery and experimentation to verification, stabilization, and only high-confidence fixes.
Weak habit
If a change is probably right, do it before time runs out.
Better habit
Require evidence, mission value, a verification path, and acceptable rollback risk.
Weak habit
Save the network config at the end no matter what.
Better habit
Save only a configuration that has been validated as known-good.
Weak habit
Ignore documentation because time is short.
Better habit
Use concise final notes so unresolved risks and major changes are not lost.
Weak habit
Reboot if something seems strange.
Better habit
Reboot only when clearly justified and when there is still enough time to verify recovery.
Weak habit
Everyone should finish their own tasks independently.
Better habit
Use a final team sync so one late change does not break another platform or required dependency.
Final warning signs
These signals mean the team should stop and protect the current state
A teammate is still making broad changes with only a few minutes left.
A required service has not been re-tested after recent changes.
The network configuration is being saved without verification.
An unresolved high-impact issue has no owner or note.
A reboot is being considered without a clear reason.
The shared log has not been updated recently.
Two teammates disagree about the current state of a platform.
Someone is still experimenting on a stable system.
Final 15 Minutes checklist
Finish stable, verified, documented, and coordinated
Broad experimentation has stopped.
Required services and applications were re-tested.
Approved administrative access still works.
Network reachability is verified.
High-impact changes have verification results.
Known-good network configuration is saved if appropriate.
No unnecessary reboot is pending.
Unresolved findings are documented.
Shared change log is current.
Each platform owner reported final status.
The team lead understands remaining risk.
No last-second uncoordinated change is in progress.