One session, both sides

Setting up and delivering a four-player session across two tables of two, from framework choice to the exported report.

1. T-2 days

   Pick the standard

   Frameworks
   • Open Frameworks and start from a built-in set — for this run, ISO/IEC 27001:2022 Annex A.
   • Skim the clause list; the dropdown next to each clause maps it to a risk or threat. Leave the defaults unless something is clearly wrong for your audience.
   • Optionally add two or three clauses of your own so the gap analysis reflects internal policy too.

   The framework appears in the picker when creating a workshop.

2. T-2 days

   Prepare the deck and dressing

   Decks
   • Keep the standard 65-card deck, or press Author deck to have risks, controls, events and complications rewritten in the chosen standard's vocabulary.
   • Preview the four skins in the gallery — Grimoire (balanced default), Dossier (semi-professional), Artefact (painted tabletop frames), Tavern (wild fantasy).
   • Note which skin suits the audience. For a client executive group, Dossier; for an internal team day, Artefact or Tavern.
3. T-1 day

   Create the workshop

   Workshops → new
   • Title it ("Q3 Risk Table — Platform Team"), attach the ISO 27001 framework and the deck, choose the skin.
   • Set the start time and time zone: 10:00 Australian Eastern. The join window opens 15 minutes before.
   • Create two tables of two: Table A and Table B. Four players total.

   One session is deducted from your allowance. Provisioned / run / remaining is shown on the Facilitators tab.

4. T-1 day

   Onboard the four players

   Workshop page → onboarding panel (top)
   • Either create four seats with names and emails and send each person their own join link, or leave it and read out a single shared code on the day.
   • For this run: use the shared code. Set the join limit to 4 so a leaked code cannot add a fifth person.
   • If you email personal keys, turn on required emails first so the field is mandatory.

   Each key binds to the first device that opens it — a shared link tells the second person the seat is already in use.

5. 09:45

   Doors open

   Workshop page → Lobby
   • Stay in Lobby. Read out the join code and the link.
   • Watch the roster fill: four names arrive, two per table. Drag anyone into the right table if they picked wrong.
   • Once all four are seated, switch the shared code off.

   Live seat count, device bindings, and which table each player landed on.

6. 10:00

   Setup and deal

   Run controls
   • Move from Lobby to Setup. The onboarding panel collapses out of the way.
   • Deal hands: each of the four players receives a role — CISO, CIO, CEO or CFO — with one once-per-session ability.
   • Assign the insider secretly if you want that mechanic in a four-player game (one card is plenty).
   • Explain scoring in two sentences, then narrate the first round slowly.
7. 10:10 – 10:50

   Stage one, rounds 1–5

   Run controls + standings board
   • Open the round, start the timer (5–6 minutes with only two players per table).
   • Let each table place controls and evidence against the risks on their field.
   • Resolve the round. Read the deltas off the standings board and say why Table A scored differently to Table B.
   • Repeat to round 5.

   Posture meters per table, round delta, pass threshold — all updating live.

8. 10:50 – 11:35

   Stage two, rounds 6–10

   Run controls + crisis panel
   • Read each crisis card aloud before opening the round.
   • Apply budget cuts when they land — tables must surrender a control they already own.
   • Let the insider spend their single sabotage; reveal it afterwards for the debrief.
   • Resolve through round 10.
9. 11:35

   Debrief and export

   Review + exports
   • Show the standings board, walk both tables' posture, take commentary.
   • Read the gap analysis: clauses with no control played are real findings.
   • Export CSV for analysis and Word for circulation — choose anonymous or with names.
   • Ask the room to tap the feedback button; comments arrive on your Facilitators tab.