1. Read the organisation's claim.
2. Inspect every evidence item.
3. Choose Effective, Partly Effective, or Not Demonstrated.
4. Read what the evidence proves and what is still missing.

The safest-looking answer is not always correct. Some controls really are demonstrated.

Grades: 6–12. Run time: about 12–16 minutes.

Discussion question: Why is a written policy not the same thing as evidence that a control works?

The game contains fictional controls and evidence only. It contains no real organisations, real incidents, CVEs, exploit detail, personal data, or stored student results.