Game play
The CLEAR Decision Loop
What each of the five stages asks of you, with a worked example.
Every decision in DECID:R runs through the CLEAR Decision Loop. It's a five-stage rhythm that keeps you from jumping straight to a response before you've understood what's actually happening.
C — Context
What do we know, what's only assumed, and what's still missing? Anchor the facts before reacting.
L — Likelihood and impact
How probable is each outcome, and how badly does it hurt people, operations, reputation and the regulator?
E — Edges and constraints
Laws, contracts, safety limits, capacity, time. The things that rule options out before you weigh them up.
A — Alternatives
Generate at least two real options. A single "obvious" choice is usually a sign you've stopped thinking.
R — Respond and review
Commit to an option, brief the team, then plan how you'll check whether it actually worked.
Worked example
Mid-incident, you spot a ransomware note on a finance workstation. Context: scope unknown, backups age unclear. Likelihood/impact: payroll due Friday, regulator notification clock may already be running. Edges: contract requires customer notice within 72 hours. Alternatives: isolate-and-investigate vs full network shutdown vs targeted segment isolation. Respond: targeted isolation, brief execs, set a 2-hour review.
Was this helpful? If something's missing or unclear, tell us and we'll improve it.
