CTF day facilitator checklist for engineering teams

Running an internal CTF comes down to preparation: tested challenges, a working scoreboard, written rules, a hint policy and a plan for what happens afterwards. Use this checklist, which runs from three weeks before the event to the day after it.

Three weeks before

• Decide the format. Jeopardy-style suits most internal events, as covered in our format comparison.
• Set team size. Pairs or teams of three keep everyone involved.
• Pick a date with no release scheduled nearby.
• Choose a scoreboard and flag checker, and test them.
• Assign a second facilitator. One person cannot run infrastructure and help people.

Two weeks before

• Write or select challenges across categories, with a few easy ones so everyone scores early.
• Have a person who did not write each challenge solve it cold, with a timer.
• Check each challenge for unintended solutions, such as flags readable from the file system.
• Write the rules: scope, no attacks on the platform or other teams, no sharing flags, how disputes are settled.
• Write the hint policy, such as free hints at set times or hints that cost points.

One week before

• Send participants setup steps and ask them to confirm access.
• Prepare the lab network so it has no route to production, as described in running vulnerable apps safely.
• Arrange prizes that suit the culture: recognition, a team lunch, a trophy that passes along.
• Brief managers so that people are released from other work.

On the day

• Start with five minutes on rules, scope and where to ask for help.
• Keep the scoreboard visible.
• Watch for stuck teams and offer hints on schedule.
• Log infrastructure problems as they happen, and announce fixes in one place.
• Take a break midway.
• Stop on time and announce the result with some ceremony.

Immediately after

• Hold a 20-minute walkthrough of the hardest challenges, led by teams that solved them.
• Ask each person for one lesson and one thing to improve.
• Shut down every lab host and revoke any temporary accounts.

The day after

• Publish the scoreboard and thank people.
• Turn two or three lessons into tickets or review checklist items.
• Archive challenges, solutions and the infrastructure notes in a repository.
• Schedule the next event.

Safety reminders

All challenges should be isolated, and the rules should state plainly that techniques apply only to the lab. Keep real credentials and real customer data out of every challenge.

Quick check

Last reviewed: 19 October 2026.