General Quarters
T+00:00 · MON 06:00 ETBreach command simulator · The Studio

The breachalreadyhappened.

General Quarters is a 96-hour simulator for boards and incident commanders. Two scenarios, two industries: a banking file-transfer breach and a healthcare ransomware attack. You read the exhibits, make six calls, file against four regulator clocks, and watch the consequences land. What gets examined afterwards is what you decided, and when.

Take command Watch two commanders
96 hMon 06:00 to Fri 06:00
6decisions under pressure
18exhibits to read and redline
4regulator clocks
2scenarios: banking and healthcare

Same breach. Two commanders.

Replay · T+00:00

Commander A

Acted on own facts

    Commander B

    Waited for certainty
      02 / THE DEADLINES

      Four clocks.
      Nobody reminds you.

      The notice obligations a US bank actually answers to run on the board while you work. You file each one yourself, at the hour you choose, and the after-action records whether you were inside the window.

      Federal Reserve

      From determining a notification incident. As soon as possible, and no later than 36 hours.

      Computer-Security Incident Notification Rule

      NYDFS

      From determining a cybersecurity incident, including one at a third-party service provider.

      23 NYCRR 500.17(a)

      SEC Form 8-K

      Item 1.05, from determining the incident is material. That determination must come without unreasonable delay.

      Form 8-K Item 1.05

      Extortion payment

      Opens only if a payment is made, with a written justification due within 30 days.

      23 NYCRR 500.17(c)
      The trap

      The clocks run from when examiners say you knew, not from when you declared it. The simulator dates determination from the bridge notes. Holding the word back for two days does not move the deadline.

      EX 1.2 · SOC ticket

      INC-0418833

      Status
      Closed Sun 09:12 by L1 · reopened Mon 06:12
      Volume
      38.2 GB over 41 hours · baseline 3–4 GB per day
      Folders
      /kyc-exchange/ · /statements/staging/
      L1 note
      "Consistent with month-end backlog. No action."
      DISCOVERABLEEX 2.2 · Bridge notes

      Crisis bridge, Monday

      09:02CISO: "That is exfiltration, not backlog."
      11:54Corvid: exfiltration confirmed.
      11:58GC: "Let's not use the word determination on this call."
      DRAFTEX 4.3 · Redline

      Draft Form 8-K, Item 1.05

      The affected data includes names, addresses and account numbers for approximately 2.1 million customers.KEEP
      The Company has found no evidence that any customer information has been misused.STRIKE
      The incident resulted from a sophisticated zero-day that could not reasonably have been prevented.STRIKE
      03 / THE EXHIBIT DESK

      The answers are
      in the documents.

      Every inject lands three documents on your desk. The vendor's notice is evasive. An analyst closed the ticket that mattered. Counsel's caution sits in the bridge notes where an examiner will read it. Players who read the tray make better calls, and the record shows whether they did.

      Two documents are blocking. You mark up the draft 8-K and the customer notice sentence by sentence, then sign. One 8-K sentence is only safe to keep if your own actions made it true.

      Vendor noticeSOC ticketFlow mapForensic readoutBridge notesRansom emailOFAC screenFBI noteBoard pre-readDraft 8-KPress inquiryJoint statementCustomer noticeRoot-cause letterSOC 2 carve-outFourth-party map
      04 / THE DECISIONS

      Six calls.
      In order.

      Each inject arrives with the people at the table pulling in different directions. Earlier choices change what lands later: hold the vendor open and the stolen data set grows; pay the ransom and the data surfaces anyway.


      T+00:45MON 06:45

      First word

      Cut the vendor, or keep 1,900 payrolls moving?

      CISO against COO

      T+06:00MON 12:00

      Scope

      Make the determination now, or wait for certainty?

      Risk against counsel

      T+18:00TUE 00:00

      The note

      $14 million, a 48-hour countdown, an unresolved sanctions nexus.

      CFO against GC

      T+30:00TUE 12:00

      The board

      Material or not? Sign the 8-K before the vote.

      Numbers against judgment

      T+48:00WED 06:00

      Daylight

      The press deadline is 09:00. The vendor wants a joint statement.

      Say first against say nothing

      T+72:00THU 06:00

      The vendor

      Exit, reconnect on terms, or take their word?

      Continuity against control
      05 / THE RECORD

      The after-action
      reads like an exam letter.

      At stand-down you get a board verdict, findings graded the way supervisors grade them, your redline accuracy, the market toll, and a sealed decision record. Each entry is SHA-256 chained to the one before it and exports as studio.evidence.v1.

      33/100
      Commander B · Board verdict

      Unsatisfactory

      MRIAFederal Reserve notice not filed against a deadline of WED 00:00.
      MRIABoard concluded "not material" on quantitative grounds only; the qualitative case was not addressed in the minutes.
      MRADraft 8-K review: 3 of 7 sentences handled correctly; unsupported assurances stayed in the draft.
      MRAPre-existing: a critical vendor overseen through a self-attested questionnaire and a SOC 2 that excluded the failed component.
      CREDITCommander A: containment on internal telemetry within the hour, with payroll preserved on a tested fallback.
      Sealed decision record · sample run
      T+00:45Decision A · sever integration, payroll on SFTP-B
      a41f0c29e7b3…
      T+06:00Decision B · determine now, call both supervisors
      5d92b17ac0e4…
      T+06:00Filed · Federal Reserve notice, on time
      c3e8f6014b2d…
      T+30:00Signed EX 4.3 · 7 of 7 correct
      89ba63ef5922…
      { "schema": "studio.evidence.v1", "product": "GENERAL QUARTERS", "chain": [ { "seq": 0, "prev": "000…", "hash": "…" } ], "head": "89ba63ef59227a663881…" }
      06 / THE PEOPLE

      Built for the people
      who sign things.

      No attack to stop, no keyboard to grab. The skills it exercises are the ones examined afterwards: timing, judgment, disclosure and oversight.

      01 / COMMAND ROLE

      Boards and audit committees

      Practice the materiality call, read a disclosure draft critically, and see what an unminuted decision costs.

      02 / COMMAND ROLE

      Incident and crisis leads

      Run containment on your own telemetry, keep the bridge record clean, and file against clocks that do not wait.

      03 / COMMAND ROLE

      Risk, legal and compliance

      Rehearse determinations, sanctions exposure on extortion, customer notices, and third-party oversight findings.

      About 40 minutesOne run, start to stand-down
      Browser onlyNothing installed. Nothing leaves the page.
      Watch timerOptional 180 seconds per inject
      Evidence packstudio.evidence.v1, hash-chained
      Monday, 05:58 ET. A vendor email arrives.

      Take
      command.

      Ninety-six hours, eighteen exhibits, four clocks. The breach is already done. The record of how you handled it is not.

      Open the simulator