Skip to main content

CRA tabletop exercise

The CRA tabletop exercise is a free exercise for the Article 14 reporting process. It is published at /academy/cra-tabletop-exercise. It needs no account.

What the exercise covers​

One scenario. Aurelia Devices B.V., a fictional manufacturer, has an actively exploited vulnerability in the firmware of an industrial gateway. Eight timed injects take the team from the first report to the final report. Each inject ends with one decision.

How to run it​

  1. Name one facilitator. Invite the people who act in the first 24 hours.
  2. Open the page on a shared screen and select Start the exercise.
  3. Read each inject aloud. Let the team discuss. Select one answer and select Record the team decision.
  4. Read the best answer, the reason and the provision. Discuss any missed decision.
  5. At three injects, draft the Single Reporting Platform fields for the stage that is due.
  6. After the last inject, select Build the after-action report. Print the report or copy the summary.

What the report contains​

  • A rating for each of the four objectives. The ratings are Met, Partly met and Not met.
  • The three Article 14 deadlines in scenario time.
  • The decision log with the team answer and the best answer.
  • The drafted fields.
  • An improvement plan with one action for each missed decision.

Data​

The exercise runs in the browser. Answers and drafts are not sent to CVD Portal. Reload the page and the exercise starts again.

Record the date​

Record the exercise date in the Article 14 notification procedure under Settings. The procedure document exports that date.

Enterprise AI tabletop exercise​

The Enterprise plan adds an AI version at /academy/cra-tabletop-exercise/ai. Sign in to open it.

What the AI does​

  • It writes the first inject from your active products, your SBOM components and the role titles in your Article 14 notification procedure.
  • It writes each next inject as a reply to the last team action.
  • It speaks for one outside party per inject. The parties are the coordinator CSIRT, the researcher, a customer, a journalist, the engineering lead and legal counsel.

What the AI does not do​

The code keeps the scenario clock, computes the three Article 14 deadlines and builds the after-action report. The AI never scores the team. When the AI is not available, a scripted inject takes its place and the run continues.

Data sent to the AI​

Product names and classes, up to 15 SBOM components, and role titles. No person's name, no email address, no product description and no report text.

How to run it​

  1. Sign in as an account admin. Other roles can open runs and reports.
  2. Select Start a new run.
  3. Read the inject aloud. Let the team discuss. Select one team action, add an optional note, and select Send the team action.
  4. Repeat until the team files the final report. A run ends after 12 injects at the latest.
  5. Read the after-action report. Select Print or save as PDF to keep a copy.

What a completed run records​

  • The run, with every inject and every team action.
  • The exercise date in the Article 14 notification procedure, under Settings.
  • Two audit events, one when the run starts and one when it completes.

A company can start 10 runs in any 24 hours.