Facilitator manual
How to run a CRA workshop
Everything you need from preparation to debrief. If you are running your first session, read it top to bottom — it takes about ten minutes.
Cyber Risk Assessment is a facilitated card workshop. Players sit at tables — in a room, a video call or both — and work through ten rounds of risks, controls, evidence and events drawn from a deck you prepare beforehand. You keep authority over the run: nothing advances until you move the workshop on.
- Run time: 90 to 150 minutes for the full ten rounds, or about 60 minutes if you stop after stage one.
- Group size: up to 20 participants per session, split across as many tables as you like. Four to six per table works best.
- Roles: each player receives one of CISO, CIO, CEO or CFO, each with a once-per-session ability.
- Insider threat: two insider cards can be dealt secretly, giving those players a single sabotage during the session.
- Outcome: a scored posture per table, a standings board, and an exportable report with a gap analysis against your chosen standard.
You need nothing installed. Players join in a browser with a link and a key — they never create an account.
Still stuck on something?
The FAQ covers the shorter questions, and feedback reaches us directly.