IC Cards – Large Group Format

Print on A4 portrait. Page 1: briefing cards (hand out before session). Page 2: handover cards (hand out mid-session). Cut along dashed lines.

PAGE 1 — PRE-SESSION BRIEFING (hand out before session starts)

IC #1 — Opening Commander

Hand to IC #1 before the session

Your role: Incident Commander for the first half. You synthesize findings from three teams — you do not investigate yourself.

Your key question: "Are we compromised, and where is the active threat right now?"

What happens:

  • Three teams analyse evidence cards independently
  • After each round, each team lead briefs you (60–90 seconds each)
  • You ask clarifying questions, then synthesize on the whiteboard
  • Whiteboard: Two columns — CONTAINED and OPEN. Move items between columns as decisions are made.
After Round 2, you hand command to IC #2 using the SBAR handover card (page 2). IC #2 has been outside the room and knows nothing you haven't told them.
✂ cut here

IC #2 — Incoming Commander

Hand to IC #2 before they leave the room

Your role: Incident Commander for the second half. You inherit mid-incident from IC #1.

What happens:

  • You leave the room after this briefing
  • IC #1 manages the first rounds (investigation and initial containment)
  • You return only when called for the handover

The handover: IC #1 will brief you using SBAR. Listen without interrupting. When they finish, ask what you need to ask.

You decide when to take command. The transfer is not complete until you say: "I have command." If the briefing was insufficient, ask IC #1 to clarify before you accept.
PAGE 2 — MID-SESSION HANDOVER (hand out at the handover point)

IC #1 — SBAR Handover Briefing

Hand to IC #1 five minutes before handover

Brief IC #2 using SBAR. Speak, don't read — you should know this from the rounds you managed.

  • Situation — What is happening right now?
  • Background — What led to this? What did your teams find?
  • Assessment — What do you think is going on? Where are you confident and where are you uncertain?
  • Recommendation — What should IC #2 focus on first? What decisions are waiting?
When you're done, IC #2 decides when they are ready to take command. The transfer is not complete until IC #2 says it is.
✂ cut here

IC #2 — Assuming Command

Hand to IC #2 when they return to the room

Listen to IC #1's SBAR briefing. Do not interrupt until they finish.

Then ask yourself:

  • What did they leave out?
  • Where are they uncertain?
  • What would you ask if you could only ask one question?
You decide when you are ready to assume command. If you are not satisfied with the briefing, ask IC #1 to clarify before you accept. The transfer is not complete until you say: "I have command."