workflow Team Workflow & Time Budget Guide

• Confirm in advance (coach/team lead) how many images this round will include and what platforms they are — CyberPatriot rounds commonly ship 2-3 images per round (some mix of Windows client, Windows Server, and Linux), but this varies by round and division. Don't assume; check the round announcement.
• Decide role assignments before the round starts, not after images are unlocked — the first 5 minutes of a round are expensive to lose to "okay, who's doing what?"
• Make sure every teammate has the right document open and ready: Beginner Guide for anyone newer to that platform, Master Checklist + Speed Reference for anyone experienced.

Adjust based on actual image count, but as a starting template for 6 people:

If the round has 3 images (e.g., 1 Windows Client + 1 Windows Server + 1 Linux):

Within each pair: one drives, one navigates. The navigator reads the checklist aloud/ahead and watches for README requirements and mistakes; the driver executes. Swap roles every hour so both people stay sharp and neither burns out from typing non-stop.

If the round has 2 images: Split into two groups of 3 instead of three groups of 2 — a trio on one box can parallelize further (e.g., one person runs the account/password audit while another handles services/firewall while a third handles forensics questions and the README), which is faster than a pair working strictly sequentially through a single checklist.

If the round has only 1 image: Don't put all 6 people on one keyboard. Split the checklist itself across the team — e.g., two people on accounts/passwords/policy, two on services/firewall/malware, two on forensics questions + final sweep — and merge periodically. Six people staring at one screen is much slower than six people working six sections in parallel and syncing every 20-30 minutes.

Regardless of split — always designate one person as the floater/lead:

• Watches the live scoring report across all images (not just one), and redirects people toward whichever box is most behind or has the easiest unclaimed points.
• Owns the forensics-question answer sheet across the whole team, so answers don't end up scattered across different people's notes.
• Is the point of contact if something breaks badly (a lockout, a service that won't restart, a snapshot revert needed) so the two people on that box don't have to stop and figure it out alone.

These are starting points, not hard rules — adjust based on how many images you have and how the round is actually going, and re-prioritize off the live scoring report rather than following this rigidly once real data is in.

The single most common team time-management mistake: spending the first 30-45 minutes on the hardest, most advanced item on the checklist because it's the most interesting, while the easy high-yield items (password policy, firewall, obvious prohibited files) sit undone. Do the fast, certain points first — always.

• Short verbal check-ins every 30-60 minutes per pair/trio, not constant narration — "we finished accounts and firewall, starting services" is enough.
• If someone finds something that might apply to another image too (a technique, a suspicious pattern, a README clarification), say it out loud immediately — don't wait for the next sync. The same planted vulnerability sometimes appears on more than one image in a round.
• If a change breaks something (a service won't come back, a login stops working), say so immediately rather than quietly trying to fix it alone for 20 minutes — that's exactly what the snapshot is for, and the floater/lead should know sooner rather than later.

• Nobody watching the scoring report. With 6 people heads-down on 2-3 images, it's easy for the live score to go unchecked for an hour. Assign this explicitly (the floater role above) rather than assuming "someone" is doing it.
• Duplicate work. Two people on the same pair independently re-checking the same section because they didn't coordinate. The driver/navigator split above exists specifically to prevent this.
• Skipping forensics questions under time pressure. These are usually fast points once you know the answer, but the answer can become unfindable if someone's already hardened the box. Front-load them, always.
• One box finished early, its pair sits idle. Once a pair's box looks solid on the scoring report, don't let them just wait — send them to help whichever box the floater has flagged as behind, or have them start the "Things to try / extra points" pass others haven't gotten to yet.
• No one owns the final 10 minutes. Designate in advance who does the final snapshot + final sweep confirmation on each image, so it doesn't get forgotten in the closing rush.