Back to Quest Board
🔷

The Vanishing Citadel

Loss of Access to Cloud Services
P1 — Critical

The ethereal towers that house your realm's most vital operations have vanished into the mist. Your cloud fortress — once thought impervious — has become unreachable. Whether by sabotage, sorcery, or the failings of a distant ally, your kingdom's ability to function hangs by a thread as the fog refuses to lift.

45 minutes
DC 14
3 Injects
4–12 Players

Compliance Frameworks

NIST CSF ID.AM ISO 27001 A.14 FCA Cloud Guidance DORA Art.28

🛡️ Roles & Party Members

War Chief Required
Incident Commander

Leads the response team, coordinates business continuity decisions

Arcane Engineer Required
IT Operations Lead

Assesses technical impact, manages failover procedures, liaises with cloud provider

Keeper of the Contingency Required
Business Continuity Manager

Activates business continuity plans, manages manual workarounds and fallback procedures

Keeper of the Codex Required
Compliance / DPO

Assesses regulatory impact, manages FCA and PRA notification obligations

Herald of the Realm Optional
Client Relations

Manages client communication, handles complaints, coordinates service updates

Alliance Keeper Optional
Vendor / Procurement Lead

Manages cloud provider relationship, reviews SLA commitments, escalates through contractual channels

High Council Elder Optional
Senior Management

Provides executive decision authority, manages board communication and strategic risk

⚡ Inject Timeline

1
The Fog Descends — Services Unreachable
T+0 Minutes

It is 08:00 UTC on a Wednesday morning. Staff begin reporting that they cannot access core business applications. The bank's primary cloud-hosted services — including Microsoft 365 (email, Teams, Sh...

6 Discussion Prompts 1 Dice Events 4 Possible Complications
2
The Prolonged Siege — Hours Without Resolution
T+20 Minutes

Four hours have passed. The cloud provider has upgraded the incident to a 'major outage' but still provides no estimated time to recovery. Their latest communication states: 'We have identified the ro...

6 Discussion Prompts 1 Dice Events 4 Possible Complications
3
The Aftermath — Recovery and Reckoning
T+35 Minutes

After 14 hours, cloud services are fully restored. The immediate crisis is over, but the aftermath presents its own challenges. The cloud provider has issued a preliminary root cause analysis: a rout...

6 Discussion Prompts 1 Dice Events 4 Possible Complications

📋 Debrief Questions

Post-Battle Assessment
  1. Were business continuity plans adequate for an extended cloud outage?
  2. Were failover and disaster recovery capabilities tested and functional?
  3. Were regulatory notification obligations understood and met?
  4. How effective was client communication during the outage?
  5. What changes to the cloud strategy and third-party risk management are needed?
  6. Were staff adequately prepared to operate without cloud services?