EU Critical Entities Resilience Directive
Module 3 of 5Twelve days after Sara filed her observations on Mateo's 14 March entry. Three contractors are on Priya Bhalla's desk. One of them was on-site that night.
Audit Room , Day +245 , momentary cut
Frau Lindgren. Twelve days after you read Mr Quintana's 14 March entry. Frau Bhalla had three contractors on her desk. One of them was Mr Whitlock.
Yes.
Take me to Frau Bhalla's office on that morning.
Twelve days after Sara read the 14 March entry
It is twelve days after Sara filed her week-three observations on the 14 March entry.
Northgate Facilities has applied to expand its Aqua Vitalis contract. They want to add a permanent on-site SCADA Maintenance Engineer role. Three candidates are in front of you.
From this point until the end of the morning, you are Priya Bhalla.
Sometimes the threat is in the building. Sometimes the threat is the building's last engineer.
The three candidates
Three candidates. Each requires Article 14 vetting because the role gives access to the Beckdale SCADA system.
| Candidate | Years exp. | Last firm | References | Site-access flag |
|---|---|---|---|---|
| Marisol Ortega-Field | 11 | Severn Trent (UK) | 3 , all responsive | Standard |
| G. Whitlock | 16 | Highline Engineering Ltd | 2 , both responsive | CV does not list Northgate Facilities; gap 2018-2020; HSE register: lapsed engineering licence 2018, restored 2020 |
| Daniel Whitehouse | 7 | Yorkshire Water | 3 , all responsive | Standard |
Marisol's file is clean. Daniel's file is clean. Whitlock's file has a gap, and the HSE register notes a lapsed-and-restored engineering licence from 2018.
Decision 1 of 2
Article 14 obligates a background check proportionate to role sensitivity. The directive does not script the depth. Your scoping decision shapes everything that follows. Disclosed convictions, role sensitivity, and proportionality are the three axes you weigh.
Decision 1 outcome
You decide to calibrate to role sensitivity. Marisol's file is clean, standard checks. Daniel's file is clean, standard checks. Whitlock's file has the licence event and the CV gap; those are the two threads you will pull on.
Personnel +6. Documentation +2. Trust-with-Regulator +2.
Article 14 Paragraph 1 requires the depth to match the sensitivity. Calibrated scoping is the directive's intent.
The directive does not script the depth, it sets the floor and asks the entity to set the ceiling appropriately. Proportionate calibration is the read that an auditor respects.
Decision 1 outcome
You run the literal checks. Whitlock's references both come back responsive. The CV gap is not interrogated. The lapsed-licence detail is logged and accepted.
Personnel -4. Documentation -1. Trust-with-Regulator -2.
Article 14 Paragraph 1 expects the depth to match the sensitivity. The minimal-asks read is technically defensible, and the audit-trail records that a candidate with a 2018 licence event passed without an interview.
Minimal-compliance is the answer to "did we do the directive's literal asks." It is a poor answer to "did we do enough." The audit room reads minimal as the floor; the audit room reads proportionate as the work.
Decision 1 outcome
You run maximum checks on all three. Marisol is offended. Daniel is bemused. Whitlock is, calm, oddly calm, given the depth of what you are asking. He provides everything you ask for, faster than anyone else does.
Personnel -2 (paranoia is not the same as protection). Documentation +1. Trust-with-Regulator -3 (the audit-trail records "over-vetting on file" which reads adversarial).
Paranoid scoping is the answer to "did you do enough." It is a poor answer to "did you make the right calls." The directive rewards judgement, not volume. Article 14 Paragraph 1 is not satisfied by paranoid checks, it is satisfied by proportionate ones.
CCTV review
Two CCTV stills of the Beckdale plant foyer, six months apart. Click each difference card you find. Find the three differences.
No score penalty for missed clicks. Completion bonus for catching all of them.
Audit room , interruption
Eckhardt holds the still up.
You answer in character. The choice is not scored. It shapes Eckhardt's tone in the M5 hot-seat.
Frau Lindgren. The figure in the corridor on 14 March. Did Frau Bhalla recognise him in the moment.
Three contractors. Three weighings.
Activity #191 , Background-Check Evidence Weigher. NEW to the catalogue. First implementation here.
For each candidate, choose one of four outcomes that matches the weight of evidence: clear, clear with conditions, refer, or decline.
Asymmetric scoring: false-positive decline (paranoia, declining a clean candidate) is penalised on Trust-with-Regulator. False-negative clear (under-vetting, clearing a flagged candidate) is penalised on Personnel and downstream M4. Both errors cost; they cost different bars.
Weigh the three
For each candidate, click one outcome. Then submit.
The reference call
Highline Engineering Ltd is Geraint's listed current employer. You ring them at 11:42. The receptionist puts you through to Geraint's manager.
The conversation runs for nine minutes. The manager is responsive. He gives you everything you ask for. He gives you nothing you didn't ask for.
Phrase by phrase
Classify each of nine phrases from the manager's reference call. The course is teaching the texture of evasion. Not all evasion is dishonest, but all evasion is a signal.
Tag each phrase as confirmed, evasive, contradictory, or non-answer. Each correct tag scores +1, capped at +5. Each wrong tag scores -1, capped at -3.
Two screens, two registers
Northgate Facilities is a name on the 14 March log. The HVAC crew. The four-minute sign-out variance.
Geraint's CV does not list Northgate.
Geraint Whitlock , CV summary, employer history
2010-2018 , Various process-engineering roles, chemicals and water utilities, Teesside.
2018-2020 , Career break (CV note: "personal").
2020-present , Highline Engineering Ltd, sub-contracted to multiple UK utilities.
11:55
The candidate in front of you was on-site the night of Mateo's 14 March classification.
He came in with the Northgate Facilities HVAC crew. The induction photograph from that visit is in your archive. You did not run a check on him then; induction photographs are kept for site-access purposes only, not for vetting cross-reference. You had no reason to look at it until now.
His CV does not list Northgate. His current manager's reference call mentioned Northgate, then retreated from it.
You sit with the screen for a long moment. You have not yet processed what this means.
Where would we be vulnerable if I am wrong about him.
Priya's office. Twelve fifteen.
I have spent ten years trying to teach people that the question is not is this person safe. The question is, where would we be vulnerable if I am wrong about them.
Those are not the same question. The first one wants reassurance. The second one wants design.
I am about to write a recommendation that has consequences for a man who may not deserve them, OR for an organisation that does not deserve him. I have to choose which kind of error I am willing to live with.
Decision 2 of 2 , the recommendation
You have to write a recommendation. Marisol and Daniel are clear. Whitlock is the question. The CER directive lets you refer, decline, clear with conditions, or clear. Each costs something.
Decision 3 outcome
You file the referral at 14:18. The North Yorkshire Police critical-infrastructure liaison opens an investigation by 16:30. By Friday Geraint's permanent application is paused; by the following Monday the investigation has surfaced two other utilities where Geraint sub-contracted under variant names.
Personnel +8. Documentation +3. Notification +4. Trust-with-Regulator +6. Resilience +4.
Carry-forward to M4: Geraint is NOT on-site at Aqua Vitalis on the Tuesday morning of M4's incident. M4 plays out without him , the alarm fires for an entirely different reason (a genuine maintenance fault, not a coordinated incident). M5's audit room reads M3 as the moment Aqua Vitalis stopped a bigger thing from happening.
Cost: Marisol gets the role. Daniel has a backup-pool letter on file. Geraint's career is paused, possibly permanently. The course does NOT yet tell you whether Geraint was a hostile-state actor, a freelance information-gatherer, or a man with a complicated past. The course leaves it ambiguous.
Article 14 Paragraph 3 provides for referral to law enforcement when vetting surfaces grounds for suspicion. The directive does not require certainty, it requires proportionate reasonable suspicion. The Northgate cross-reference plus CV omission plus reference-call evasion clears that bar comfortably.
Decision 3 outcome
You decline. Marisol gets the role. Geraint is informed; Northgate Facilities is informed. No external referral.
Personnel +4. Documentation +3. Trust-with-Regulator +3. Resilience +2.
Carry-forward to M4: Geraint is NOT on-site at Aqua Vitalis on the Tuesday morning of M4's incident, but he ALSO is not under investigation. He continues to sub-contract elsewhere. M4 plays out without him; M5 surfaces a question (in the audit hot-seat) about whether the decline was sufficient when external referral was available.
The compromise: the candidate's career is not destroyed; the system is protected; the question of whether Geraint should have been referred remains open.
Process-integrity decline is the most common HR outcome at this evidence threshold. The directive does not require referral; it permits it. Article 14 Paragraph 1 is satisfied by the decline. The audit-trail records "declined on documented process grounds" which reads as proportionate.
Decision 3 outcome
You hire Geraint with conditions: 12-month probation, no unsupervised access outside Aqua Vitalis-supervised maintenance windows, quarterly re-vetting. He starts on Monday 17 April. By Tuesday 9 May he has authorised access to the Beckdale SCADA console.
Personnel +2. Documentation +1. Trust-with-Regulator -2.
Carry-forward to M4: Geraint IS on-site on the Tuesday morning of M4's incident. With authorised access this time. The cascade-map activity is harder; the 24-hour notification clock runs for a different reason than the player expects.
Clear-with-conditions is the answer when the evidence is suggestive but not conclusive. It is a defensible read. The audit-trail records "mitigated through structural conditions" which reads as judgement, not refusal. It is the read that ages worst, because in M4 you will be reading the file Whitlock's after-hours-supervised access was specifically designed to prevent.
Decision 3 outcome
You hire Geraint on standard terms. He starts Monday 17 April. By Tuesday 9 May he has unsupervised SCADA access. The audit-trail records "cleared on standard vetting" which is the sentence Eckhardt will read at M5's hot-seat.
Personnel -10. Documentation -3. Trust-with-Regulator -8. Resilience -3.
Carry-forward to M4: Geraint is on-site Tuesday morning with full access. M4's incident is direct rather than oblique. M5's Cover-up Held ending and the Public Failure path both become more likely.
Standard clear is the answer when the file looks clean. The file did not look clean. Article 14 Paragraph 1 expects the depth to match the sensitivity; standard clear at this evidence threshold reads to an auditor as a vetting that did not happen.
End of day
It was the longest day in HR you have had since 2019. The recommendation is filed. Marisol starts on Monday. The Whitlock case is, closed, paused, or open, depending on what you wrote in section 4 of the recommendation form.
Decisions recap
What's next
Five weeks from now there will be an alarm at 06:32 on a Tuesday morning. The shape of that alarm depends on what you wrote in section 4 today.
Carry-forward to M4: Geraint's status (referred, declined, hired-with-conditions, hired-clean) determines whether he is on-site for the M4 incident, and whether the cascade-map activity in M4 has the dramatic-irony layer the player will feel.
Audit Room , momentary cut
Eckhardt closes the M3 sub-folder.
Frau Lindgren. Frau Bhalla wrote section 4.
Yes.
We will hear next from Mr Iyer. The morning of the alarm. Take me to Tuesday the ninth of May. Six thirty-two.
END OF MODULE 3