Help
Frequently asked questions
For participants joining a session and facilitators running one.
What is CRA Online?
A facilitated cyber risk assessment workshop played with cards. Participants sit at tables, hold a pool of security controls, and face risks and events over ten rounds. The facilitator drives the room and the session ends with a scored assessment and a written report.
Do participants need an account?
No. Participants join with either a personal seat key sent by their facilitator or the six-character workshop code read out in the room. Nothing to install, no sign-up.
Why can't I get into the session yet?
Scheduled workshops open a lobby before they start. You can normally take your seat 15 minutes before the published start time — the lobby shows a countdown until then.
It says my seat key is already in use.
Seat keys are bound to one device so two people can't share a seat. Ask your facilitator for your own seat key and they can reissue one in seconds.
The workshop code says the room is full.
Facilitators cap how many people can walk in on the shared code (10 by default, up to 20). Ask the facilitator to raise the limit or to send you a personal seat key.
How do facilitators get access?
Facilitators register with an email address and are approved by a Tabletop admin. Each approved facilitator can run 5 workshops on the default tier and can request more.
Can my colleagues help me facilitate?
Yes. Each facilitator can register up to 5 additional people who can open the same facilitator dashboard and help run sessions. They see only your workshops.
Which cards are used?
Every new workshop can start from the full standard deck — 10 roles, 10 risks, 30 controls and 15 events, including the crisis card. You can clone it and edit the copy, or build your own deck from scratch.
How does scoring work?
Controls have a base value modified by the maturity your table assigns them. Risks and events have a capacity or impact; the cover you present reduces it. Peer review nudges maturity, crises and budget cuts take controls away, and the standings board tracks posture per table.
What do we get at the end?
A structured report covering the session, the exposure profile, control maturity, gaps against the standard you mapped, and the treatment discussion — plus a CSV export that can be anonymised.
Is our workshop data private?
Session data is stored to run the workshop and produce the report. Exports are anonymised by default and participant names are only included when the facilitator opts in.
Can we use this commercially?
Not without a written licence. The game, cards, artwork and scoring model are proprietary — see Legal & licence.