Competition Day Guide · Guide 03 · Team Roles
Team Roles & Communication Plan
Before the round starts, the team should know who owns each platform, who coordinates priorities, how major changes are verified, and how important findings move into the shared record.
Good communication is not constant talking. It is concise, specific, and tied to ownership, evidence, status, and next action.
Team Goal
Team rule
Every important system should have one clear current owner
Multiple teammates can help, but ownership should never become ambiguous. One person should know the current state, recent changes, verification result, and unresolved risk for each platform.
Core roles
Assign responsibilities before the clock starts
Team Lead
Maintains priorities, watches the clock, resolves ownership conflicts, coordinates late-round risk, and keeps the team aligned with the mission.
Platform Owner
Owns the current state of one system or platform, including findings, changes, verification, and handoff.
Verifier
Confirms that high-impact changes achieved the intended security result without breaking required functionality.
Evidence / Log Owner
Keeps the shared record usable and makes sure important evidence does not remain only in private notes.
Communication rules
Keep updates short and actionable
Say what system you are talking about.
Say what you observed, not only what you think happened.
Say what you changed.
Say whether the change was verified.
Say what remains unresolved.
Say what other teammates should avoid touching.
Keep updates short enough that people will actually use them.
Escalate early when a dependency crosses platforms.
Status language
Use shared states
Not Started
Known task, but nobody is actively working it yet.
Investigating
Evidence is being collected and no final remediation decision has been made.
Changed
A remediation was applied but verification is still pending.
Verified
The change was confirmed and required functionality still works.
Unresolved
The team lacks enough evidence, confidence, or time for a safe decision.
Do Not Touch
A known dependency or high-risk area should not be changed without coordination.
Handoff template
Preserve context when ownership changes
01
Platform / system
02
Current owner
03
Current status
04
Important finding
05
Supporting evidence
06
Change made
07
Verification result
08
Known dependency
09
Unresolved item
10
Next recommended action
Strong messages
Replace vague updates with useful context
Too vague
Windows is done.
Better
Windows 11: users, admins, services, Defender, Firewall, tasks, and RDP reviewed. One unauthorized admin removed and verified. No unresolved items.
Too vague
Can someone check Linux?
Better
Linux: sshd is required, but exposure looks broader than expected. Service and firewall state checked. Need a second review of allowed source scope before changing anything.
Too vague
I fixed the network.
Better
Cisco: VLAN 20 was missing from one trunk. Added VLAN 20 only, verified required reachability, and saved the known-good config.
Too vague
Don't touch that account.
Better
Do not change svc-backup yet. It appears to run the scheduled backup task and still needs dependency review.
Escalation
Ask for help without restarting the investigation
What system is affected?
What exact symptom or finding exists?
What evidence supports the concern?
What has already been checked or changed?
What required function could break?
What specific help is needed?
Warning signs
Stop and realign when coordination breaks down
Two teammates are modifying the same system.
Nobody can say who owns a platform.
A major change was made but not verified.
A known dependency exists only in one person's memory.
The shared log is missing recent high-impact work.
An unresolved issue has no owner.
A teammate says a platform is done without evidence.
A risky late change is happening without the team lead knowing.
Final checklist
Start with clear ownership and clean handoffs
Every major platform has a clear owner.
The team lead understands current priorities.
A verifier role is available for high-impact changes.
The shared status method is ready before the round starts.
Status labels mean the same thing to everyone.
Important findings move into the shared record.
Dependencies and do-not-touch items are visible.
Escalations include enough context to avoid repeating discovery work.
Major changes are reported with verification results.
Unresolved items have owners or are clearly documented.
Late-round risky changes require coordination.
Handoffs preserve evidence, change, verification, and next action.