Skip to main content

CRA tabletop exercise

The CRA tabletop exercise is a free exercise for the Article 14 reporting process. It is published at /academy/cra-tabletop-exercise. It needs no account.

What the exercise covers​

One scenario. Aurelia Devices B.V., a fictional manufacturer, has an actively exploited vulnerability in the firmware of an industrial gateway. Eight timed injects take the team from the first report to the final report. Each inject ends with one decision.

How to run it​

  1. Name one facilitator. Invite the people who act in the first 24 hours.
  2. Open the page on a shared screen and select Start the exercise.
  3. Read each inject aloud. Let the team discuss. Select one answer and select Record the team decision.
  4. Read the best answer, the reason and the provision. Discuss any missed decision.
  5. At three injects, draft the Single Reporting Platform fields for the stage that is due.
  6. After the last inject, select Build the after-action report. Print the report or copy the summary.

What the report contains​

  • A rating for each of the four objectives. The ratings are Met, Partly met and Not met.
  • The three Article 14 deadlines in scenario time.
  • The decision log with the team answer and the best answer.
  • The drafted fields.
  • An improvement plan with one action for each missed decision.

Data​

The exercise runs in the browser. Answers and drafts are not sent to CVD Portal. Reload the page and the exercise starts again.

Record the date​

Record the exercise date in the Article 14 notification procedure under Settings. The procedure document exports that date.