Play
Eleven games and three pages that are not a resume
Everything here runs in your browser and saves nothing anywhere else. Each one takes under five minutes, which is less than the meeting about the finding.
Games
Quick hits
Quizzes, a bingo card, and a few toys. One coffee break each.
GRC Bingo
Twenty-four things you will hear in an audit. Tap a square when it happens.
How to play: tap squares, five in a row wins. Two minutes.
Decision treeIs it a finding?
Five yes-or-no questions in the order an assessor asks them. Get a verdict and a template.
How to play: answer honestly. Copy the template at the end.
Quiz · 13 emailsReal or Phish?
Thirteen emails in a fake inbox. Hover the links to see where they really go, then call it.
How to play: read the headers, hover the links, pick Real or Phish. No clicking required.
Quiz · 14 scenariosMap That Control
Fourteen scenarios, one NIST 800-53 Rev 5 base control each. No enhancements, no partial credit.
How to play: read the scenario, pick the control. Fourteen questions.
Heat map gameRisk Register Roulette
Spin for a risk, rate it on the 5×5 heat map, pick a treatment, see how you compare with the analyst.
How to play: spin, click a cell, pick a treatment, submit. Bullseyes are ten points.
LabPassword Strength Lab
Type a throwaway password and see how long it survives three kinds of attacker, and what gives it away.
How to use: type something like your password, never the real one. Nothing leaves the page.
GeneratorThe Audit Excuse Generator
Fifty-two lines heard in evidence-request meetings. The evidence will be right over, promise.
How to use: press the button, copy the line, do not use it.
CipherNautical Flag Cipher
Your message as a flag hoist from the International Code of Signals, or decode a security tip run up the halyard.
How to play: Encode to write, Decode to guess. Hints cost two points.
Games
Longer quests
Two text adventures and an RPG. Bring the second coffee.
GRC Quest
A text adventure. Thirty days to an assessment, a d20, and a coffee.
How to play: pick an option. Higher rolls beat the difficulty. Keep readiness and credibility up.
Text adventurePOA&M Dungeon
A text adventure through eight open findings. Thirty days, four coffees, one ATO review.
How to play: pick an option. Spend coffee and goodwill carefully.
Browser RPGGRC Quest Online
The sequel to GRC Quest, now with a world chat and tall grass that hides monsters.
How to play: arrows or WASD to move, Space to talk, number keys in battles.
Not games
Tools and reading
The useful ones. No score, unless you count readiness.
CMMC checklist
The serious one. Score 64 items, get a readiness read, print it.
How to use: mark Met, Partial, or Not met. Your answers stay in this browser.
Essay + checklistReading the Water
What teaching open-water sailing taught me about risk, with a nine-item readiness check at the end.
Read it, then tick the nine boxes. The forecast updates as you go.
Page · datedNow
What I am working on, studying, building, and looking for, with a countdown to December 2026.
Read it before the intro call. It is dated.
There are also a few things on this site that are not listed anywhere. Old gamers know the code.