Each clue includes an accepted answer and a short explanation for the reveal.
Security
100: This additional login step requires something besides a password. Answer: Multi-factor authentication. Multi-factor authentication helps protect an account even if a password is exposed.
200: This suspicious message tries to trick someone into revealing information or opening a harmful link. Answer: Phishing. Phishing messages often create urgency or imitate a trusted sender.
300: This password practice uses a different long credential for every account. Answer: Unique passwords. Unique passwords prevent one compromised account from exposing several others.
400: This action should happen immediately when a work device is lost or stolen. Answer: Report it. Prompt reporting lets the security team protect accounts and data quickly.
500: This rule gives a person only the system access required for their job. Answer: Least privilege. Least privilege limits the damage caused by mistakes or compromised accounts.
Privacy
100: This principle means collecting only the personal information required for a defined purpose. Answer: Data minimization. Data minimization reduces privacy risk and unnecessary storage.
200: This action verifies recipients before sending a document containing sensitive information. Answer: Recipient check. A recipient check can prevent accidental disclosure to the wrong person or group.
300: This schedule defines how long different records should be kept and when they should be deleted. Answer: Retention policy. A retention policy helps an organization keep information only as long as needed.
400: This process removes identifying details so information cannot reasonably be linked to one person. Answer: Anonymization. Anonymization can reduce privacy risk when individual identity is not needed.
500: This is the right action when you are uncertain whether information may be shared. Answer: Ask the privacy or security owner. Escalating uncertainty is safer than guessing with sensitive information.
Conduct
100: This workplace expectation requires treating colleagues fairly and without harassment or discrimination. Answer: Respectful conduct. Respectful conduct applies across meetings, chat, email, travel, and informal events.
200: This situation exists when personal interests could improperly influence a work decision. Answer: Conflict of interest. Potential conflicts should be disclosed so the organization can respond appropriately.
300: This feedback approach describes a specific behavior, its impact, and a constructive next step. Answer: Behavior-based feedback. Specific feedback is more actionable than labels about a person's character.
400: This rule protects someone who raises a good-faith concern from punishment for speaking up. Answer: Non-retaliation. Non-retaliation policies support safe reporting and responsible investigation.
500: This decision test asks whether you would be comfortable seeing the action described publicly. Answer: Front-page test. The front-page test is a simple prompt for considering ethics and reputation.
Safety
100: This action addresses a hazard before someone is injured, even if no incident has happened yet. Answer: Report the hazard. Near misses and hazards provide a chance to prevent future harm.
200: This plan explains exits, meeting points, and responsibilities during an emergency. Answer: Emergency action plan. Employees should know where to find the plan before an emergency occurs.
300: This setup reduces strain by adjusting a chair, screen, keyboard, and working position. Answer: Ergonomic setup. Good ergonomics can reduce discomfort and repetitive strain.
400: This practice keeps walkways, exits, and access to safety equipment unobstructed. Answer: Good housekeeping. Simple housekeeping prevents common trips, falls, and emergency-access problems.
500: This is the correct response when a task feels unsafe and the employee lacks appropriate training. Answer: Stop and ask for guidance. Employees should not improvise around unfamiliar safety risks.
Reporting
100: This channel lets an employee raise a concern to a manager, HR, compliance, or another designated contact. Answer: Reporting channel. Organizations should make multiple reporting paths easy to find.
200: This quality means a report includes dates, actions, people involved, and relevant evidence without speculation. Answer: Specificity. Specific facts help the organization understand and investigate the concern.
300: This promise means information is shared only with people who need it to respond, not that secrecy is guaranteed. Answer: Confidentiality. Confidentiality is usually limited by the need to investigate and act responsibly.
400: This report describes a situation that almost caused harm but did not result in an incident. Answer: Near-miss report. Near-miss reporting helps teams address risk before harm occurs.
500: This policy should explain how a concern is received, reviewed, investigated, and closed. Answer: Reporting procedure. A clear procedure sets expectations for both reporters and reviewers.
host guide
Turn the idea into a game that fits the group.
Use these practical recommendations while you customize the board and prepare the room.
How to use this template
Click the board tiles to preview every clue and answer. Open the template in the builder to customize it, choose teams, test one clue, and launch the private host controls.
Remote variation
Share the player display, keep host controls private, and choose device buzzers, chat answers, or one captain per team.
In-person variation
Project the board, place participants into teams, rotate the spokesperson, and prepare one tie-breaker before the event starts.
Make it specific
Replace generalized examples with accurate company details, remove confidential information, and add explanations that reinforce the purpose of the session.
more workplace templates
Compare another complete board.
Work template
New Hire Onboarding
Help new employees learn the people, tools, customer habits, security basics, and first-week routines they need to get started.