Exercise After-Action Report Template
Reports what was tested, what held, what failed and the agreed improvements in a form management can approve.
Available soon
- Format
- Word
- Size
- 66 KB
- Length
- 21 pages
- Version
- 1.1
- Updated
What's inside
What changed
- 1.1
DORA Article 11(6) quoted in full: the yearly test covers ICT systems supporting all functions.
- 1.0
Published.
Preview
The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.
How to use this template
Use this template to report an exercise to the people who must approve what it found. It says what was tested, how each objective went on the evaluation scale, what held, what failed, and the improvement actions agreed, each with one owner and a due date. The exercise sponsor approves it; the actions then live in the Exercise Observations & Improvement Tracker until they close.
The after-action report must be approved by the sponsor within [[10]] working days of the exercise, with every objective rated on the evaluation scale (EX-09). The rules are in the Tabletop Exercise Design Methodology; the Exercise Planning & Facilitation Procedure sets how the exercise runs and when the report is drafted.
When the report is written
The report follows the exercise on a fixed timeline, in working days from the exercise day.
Working day | Step | Who |
|---|---|---|
Exercise day | Exercise and hot debrief (EX-08) | Facilitator |
Day 2 | Observers' written notes in (EX-08) | Observers |
Day 7 | Draft after-action report to the sponsor | Exercise lead |
Day 10 | After-action report approved; actions entered in the tracker (EX-09, EX-10) | Exercise sponsor |
The evaluation scale
Every objective gets one of four ratings, in words. There is no score out of 100.
Rating | What it means |
|---|---|
Met | The right person took the decision the rule requires, within its time and for sound reasons, without a prompt from the facilitator. |
Partly met | The decision was right in substance but late, taken by the wrong person, or reached only after a prompt; or part of it was missed. |
Not met | The decision was wrong or not taken, or would have broken a rule, a legal clock or a decision right. |
Not tested | The exercise did not reach the decision: time ran out or the discussion went another way. Carried to the next exercise, and never counted as met. |
Results are compared by objective category and audience, as counts: Met, Partly met and Not met out of the objectives tested. Not tested is shown on its own line and never counted as met. A category rated Not met at two exercises in a row for the same audience is reported to executive management as a finding in its own right.
Finding priority and due dates
Each finding gets a priority. The priority sets how long its action has, in calendar days from the day the report is approved.
Priority | When | Action due within |
|---|---|---|
High | An objective Not met; or a gap that would break a legal clock, a decision right or a Severity 1 or 2 step | 30 days |
Medium | An objective Partly met; or a gap that would slow the response | 90 days |
Low | An improvement that would make the response easier | 180 days |
An action carries one status at a time:
Status | Meaning |
|---|---|
Open | Agreed, not started. |
In progress | Work started; due date unchanged. |
Done | The change is made. Where its objective was Partly met or Not met, it waits for its re-test (EX-11). |
Closed | Done, and re-tested where EX-11 requires it. |
Withdrawn | Dropped, with the sponsor's recorded reason. |
Steps
- At the hot debrief, the facilitator reads back the likely findings and the date the report is due (agree and close).
- Observers send their written notes within 2 working days (EX-08). The exercise lead enters each observation in the Exercise Observations & Improvement Tracker.
- The exercise lead fills Part A and rates each objective in Part B against its success measure, from the observations and the scribe's log.
- Parts C and D record what held and what failed. Each gap that needs a change becomes a finding, with a priority.
- Each finding gets one action in Part E, with one owner, and the document or control it changes (EX-10). Parts F and G plan the re-tests and the changes to the plan and playbooks.
- The draft goes to the exercise sponsor by day 7. The exercise sponsor approves it by day 10 (EX-09), and the actions and due dates are entered in the tracker.
- Part I is updated at each quarterly report until every action is closed. The measures go to executive management with the incident measures (EX-12).
Guidance — delete before approval
Rate against the success measure the sponsor approved, not against how the room felt. A decision reached only after the facilitator prompted it is Partly met.
An objective the exercise never reached is Not tested. It is carried to the next exercise, and never counted as met.
Findings are reported without names. What people say in the room stays there. Write roles, not names, in every part of the report.
Field guidance
Part | What a good answer looks like | Common reason a report is sent back |
|---|---|---|
A Exercise and scope | The risk or incident behind the scenario, the audiences by ID, the plan and playbook tested. | No reason given for the scenario. |
B Objectives and results | Each rating tied to observation IDs, and the success measure quoted. | "Went well" with no rating, or a score out of 100. |
C What held | The decision that was right, and what to keep so it stays right. | A list of praise with no link to an objective. |
D Findings | A condition that can be changed, with the exercise time and the inject. | A person's name, or "people need more awareness". |
E Actions | One change each, one owner by role, a due date from the priority. | "Review the plan" with no section or date. |
F Re-tests | The audience that takes the decision, and the latest date for the re-test. | Re-test left out because the action is "obvious". |
G Plan changes | Every document the exercise tested, changed or not, with the reason. | Only the documents that changed are listed. |
The report
Guidance — delete before approval
Replace the placeholders when you use the report, or leave them as prompts. Keep the ratings, priorities and due dates the same as the Tabletop Exercise Design Methodology and the Exercise Observations & Improvement Tracker set them.
Part A — The exercise and its scope
A1 Exercise | |||
Exercise ID | [[EX-YYYY-nn]] | Date | [[YYYY-MM-DD]] |
Type and length | [[Tabletop / Board session / Drill, minutes]] | ||
Scenario and the deck used | [[SC-nn title (deck)]] | ||
Audiences from the audience table | [[AU-nn audience; …]] | ||
Why this scenario a top risk or a recent incident (EX-05) | [[Risk R-nn or incident INC-YYYY-nnn, and why now]] | ||
Plan and playbooks tested | [[Incident response plan; playbook]] | ||
Suppliers taking part | [[Supplier (reference); … or none]] | ||
A2 Who took part | roles, not names | |||
Sponsor approves this report | [[e.g. Chief Operating Officer, usually the executive incident lead]] | ||
Facilitator takes no decisions (EX-06) | [[Role]] | ||
Observers at least one independent (EX-06) | [[Role (independent); role]] | ||
Scribe | [[Role]] | ||
Participants and deputies | [[Role; role; …]] | ||
A3 Timing | |||
Hot debrief the same day (EX-08) | [[YYYY-MM-DD]] | Observers' notes in at most 2 working days (EX-08) | [[YYYY-MM-DD: n working days]] |
Report approved at most 10 working days (EX-09) | [[YYYY-MM-DD: n working days]] | ||
A4 Summary for approval | |||
Summary what was tested, the results, the main gaps and the actions, in four or five sentences | [[What was rehearsed and by whom; the results on the scale; what held; what failed; how many actions, by priority]] | ||
Part B — Objectives and results
Each objective, as the sponsor approved it before the scenario was written (EX-04), with its rating on the evaluation scale (Met / Partly met / Not met / Not tested). The evidence is the observation IDs from the Exercise Observations & Improvement Tracker.
ID | Objective, and what success looks like | Category | Rating | Evidence |
|---|---|---|---|---|
O1 | [[Title]] [[The decision, who takes it, the time and the rule it is judged against]] | [[OC-nn name]] | [[Met / Partly met / Not met / Not tested]] | [[OB-nn, …]] |
O2 | [[…]] | [[…]] | [[…]] | [[…]] |
O3 | [[…]] | [[…]] | [[…]] | [[…]] |
The results, counted as the Tabletop Exercise Design Methodology compares them: by objective category and audience, out of the objectives tested.
Met | Partly met | Not met | Tested | Not tested | Compared with the last exercise of these audiences |
|---|---|---|---|---|---|
[[n]] | [[n]] | [[n]] | [[n]] | [[n]] | [[Category by category: same, better or worse. Any category Not met at two exercises in a row is a finding in its own right]] |
Part C — What held
Objectives met, and strengths the observers recorded. Say what to keep, so a later change does not undo it.
Objective | What held | Evidence | Keep it by |
|---|---|---|---|
[[On title]] | [[The decision that was right, in time, by the right person]] | [[OB-nn]] | [[What must not change]] |
[[…]] | [[…]] | [[…]] | [[…]] |
Part D — What failed: the findings
Each gap confirmed at the hot debrief or in this report, written as fact with the exercise time. Its priority (High / Medium / Low) sets the due date of its action.
Finding | Objective | Inject | What happened | Priority, and why |
|---|---|---|---|---|
OB-[[nn]] | [[On, or General]] | [[In, scenario time, minute]] | [[Fact, with the time. No names]] | [[High / Medium / Low]] [[The case in the priority table it meets]] |
OB-[[nn]] | [[…]] | [[…]] | [[…]] | [[…]] |
Part E — Improvement actions
Every finding must have an improvement action with one owner, a due date set by its priority, and the document or control it changes. Actions are tracked until closed (EX-10). Due dates count from the day this report is approved. Enter every action in the Exercise Observations & Improvement Tracker.
Action | What will change | Changes | Owner | Priority and due | Status |
|---|---|---|---|---|---|
EA-[[nn]] (OB-[[nn]]) | [[One change]] | [[Document and section, playbook step or control]] | [[One role]] | [[Priority]] [[YYYY-MM-DD]] | Open |
EA-[[nn]] (OB-[[nn]]) | [[…]] | [[…]] | [[…]] | [[…]] | [[…]] |
Part F — Re-tests
An objective rated Partly met or Not met must be re-tested within [[6]] months of its improvement action being done, and its finding stays open until then. A live incident can serve as the re-test when its post-incident review rates the same decision (EX-11). Plan each re-test here: the next exercise or drill of the audience that takes the decision, after the action is done.
Objective | Rating | Action | Who takes the decision | Re-test due |
|---|---|---|---|---|
[[On title]] | [[Partly met / Not met]] | EA-[[nn]] | [[AU-nn audience]] | [[Within 6 months of the action being done; the planned exercise, drill or date]] |
Objectives not tested: [[On, or none]]. Each is carried to the next exercise of the same audience and is never counted as met.
Part G — Changes to the plan and playbooks
The plan and the playbooks an exercise tested must be reviewed after it (EX-12). List each document the exercise tested, and what changes in it, or why nothing does.
Document | Change | Action |
|---|---|---|
Incident Response Plan, [[section]] | [[Change, or no change: why]] | EA-[[nn]] |
[[Playbook, section]] | [[…]] | [[…]] |
Part H — Approval
H1 Approval | |||
Exercise sponsor approves the report and every action in it | [[Role, signature, date]] | ||
Working days after the exercise EX-09: at most 10 | [[n]] | ||
Actions entered in the Exercise Observations & Improvement Tracker by | [[Role, date]] | ||
Distribution | [[e.g. executive management, participants, observers]] | ||
Measures EXM-02 to the quarterly report (EX-12) | [[n met, n partly met, n not met, of n tested]] | ||
Part I — Follow-up
Completed from the Exercise Observations & Improvement Tracker at each quarterly report, until every action is closed. An action is Closed only once it is done and, where its objective was Partly met or Not met, re-tested (EX-11). Open actions past their due date count in EXM-03; re-tests awaited count in EXM-04.
Action | Status at [[YYYY-MM-DD]] | Re-test | Result |
|---|---|---|---|
EA-[[nn]] | [[Open / In progress / Done / Closed / Withdrawn]] | [[Exercise or incident, date / not needed: why]] | [[Met / Partly met / Not met / Not tested / Due]] |
Worked example — the report on a ransomware tabletop
This is the after-action report on EX-2026-01, the ransomware tabletop held on 18 Mar 2026 by a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. It is the exercise the Security Incident Management pack counts as the plan's last exercise before its ransomware incident of 12 Aug 2026. The organisation, roles and dates are fictional; replace them with your own.
Guidance — delete before approval
Parts A to H are the report as the exercise sponsor approved it on 31 Mar 2026, so every action shows as Open. Part I shows the same actions as at 30 Sep 2026, the example's quarter end.
Delete this worked example from your adopted template.
Part A — The exercise and its scope
A1 Exercise — EXAMPLE | |||
Exercise ID | EX-2026-01 | Date | 18 Mar 2026 |
Type and length | Tabletop, 180 minutes | ||
Scenario and the deck used | SC-01 Ransomware encryption of core systems (Tabletop Scenario — Ransomware Encryption of Core Systems) | ||
Audiences from the audience table | AU-02 Executive management and the crisis team; AU-03 Incident response team; AU-04 Technical responders | ||
Why this scenario a top risk or a recent incident (EX-05) | R-01 and R-04: the two ransomware risks in the register | ||
Plan and playbooks tested | Incident Response Plan (P09); Ransomware Response Playbook (P09) | ||
Suppliers taking part | Managed IT service provider (SUP-001); Security monitoring provider (SUP-006) | ||
A2 Who took part | roles, not names — EXAMPLE | |||
Sponsor approves this report | Chief Operating Officer (executive incident lead) | ||
Facilitator takes no decisions (EX-06) | Head of Information Security; their own role was played by their deputy | ||
Observers at least one independent (EX-06) | Internal Audit Manager (independent); Quality and Compliance Manager (not a participant) | ||
Scribe | Security analyst | ||
Participants and deputies | Chief Operating Officer; Information Security Manager (incident manager); Deputy incident manager; Head of IT; Data Protection Officer; Legal counsel; Head of Marketing and Communications; Head of Logistics; Managed IT provider (SUP-001); Security monitoring provider (SUP-006) | ||
A3 Timing — EXAMPLE | |||
Hot debrief the same day (EX-08) | 18 Mar 2026, the same day | Observers' notes in at most 2 working days (EX-08) | 20 Mar 2026: 2 working days |
Report approved at most 10 working days (EX-09) | 31 Mar 2026: 9 working days | ||
A4 Summary for approval — EXAMPLE | |||
Summary what was tested, the results, the main gaps and the actions, in four or five sentences | The executive, crisis and incident response teams and the technical responders rehearsed a ransomware attack on the core business system (SC-01) for 180 minutes. Of 6 objectives tested, 2 were met, 3 partly met and 1 not met. The ransom decision went to the board at once. The out-of-hours alert could not reach the incident manager, isolation waited on a debate about who may decide it, and nobody knew when a restore was last checked. The report agrees 6 improvement actions (2 High, 3 Medium, 1 Low) and re-tests 4 decisions once their actions are done. | ||
Part B — Objectives and results
Each objective, as the sponsor approved it before the scenario was written (EX-04), with its rating on the evaluation scale (Met / Partly met / Not met / Not tested). The evidence is the observation IDs from the Exercise Observations & Improvement Tracker.
ID | Objective, and what success looks like | Category | Rating | Evidence |
|---|---|---|---|---|
O1 | Isolate without waiting The incident manager decides to isolate the affected systems within [[30]] minutes of declaration, without waiting for the executive (IM-08). | Containment decisions | Partly met | OB-01 |
O2 | Declare and escalate, in and out of hours Declared Severity 1; the executive incident lead told within 30 minutes, the crisis team within 1 hour, the board chair within 4 hours (IM-05). The out-of-hours alert reaches the incident manager directly. | Detection and escalation | Not met | OB-03 |
O3 | Screen the reporting duties The reporting screen is complete within 4 hours of declaration, with the NIS2 early warning planned inside its 24 hours and the GDPR decision and its reasons recorded (IM-06). | Reporting duties | Met | OB-02 |
O4 | Restore in the right order, safely The recovery order is set on business priority. Nothing is restored before the backups are checked and the route in is closed (IM-10). | Recovery priorities | Partly met | OB-04 |
O5 | Put the extortion demand to the right people The executive team takes the demand to the board or its equivalent, the only people who may decide it, having first obtained legal advice, the insurer's view and a crime report (IM-08). | Decision rights and governance | Met | OB-07 |
O6 | Speak with one voice Staff, customer and media messages come from the approved templates and are approved within [[60]] minutes of the need arising. Nobody else speaks outside (IM-09). | Communication | Partly met | OB-05 |
The results, counted as the Tabletop Exercise Design Methodology compares them: by objective category and audience, out of the objectives tested.
Met | Partly met | Not met | Tested | Not tested | Compared with the last exercise of these audiences |
|---|---|---|---|---|---|
2 | 3 | 1 | 6 | 0 | None to compare: the first exercise of these audiences in the programme. These results are the baseline. |
Part C — What held
Objectives met, and strengths the observers recorded. Say what to keep, so a later change does not undo it.
Objective | What held | Evidence | Keep it by |
|---|---|---|---|
O3 Screen the reporting duties | The reporting screen was finished within its 4 hours of declaration, with the NIS2 early warning planned inside its deadline. | OB-02 | Keep the reporting screen as the first-hour step it is. EA-02 makes it depend on the plan rather than on one person. |
O5 Put the extortion demand to the right people | The Chief Operating Officer refused to discuss paying and asked for the board chair, Legal and the insurer within ten minutes of the demand. | OB-07 | Keep the ransom decision with the board, as the plan says (IM-08). The board meets it again at its own exercise. |
Part D — What failed: the findings
Each gap confirmed at the hot debrief or in this report, written as fact with the exercise time. Its priority (High / Medium / Low) sets the due date of its action.
Finding | Objective | Inject | What happened | Priority, and why |
|---|---|---|---|---|
OB-01 | O1 Isolate without waiting | I2 Day 1, 07:10 minute 30 | Isolation was agreed 40 minutes after declaration, after a debate over whether the incident manager could stop dispatch without the Chief Operating Officer. | High The incident manager's right to isolate without waiting was in doubt: a gap that would break a decision right on a Severity 1 step |
OB-02 | O3 Screen the reporting duties | I4 Day 1, 10:00 minute 65 | The screen was finished in time, but only after Legal looked up whether the firm is an important entity under NIS2. Nobody else knew. | Medium Only Legal knew the firm's NIS2 status, so the screen depends on one person: a gap that would slow the response |
OB-03 | O2 Declare and escalate, in and out of hours | I1 Day 1, 06:40 minute 15 | The monitoring provider's out-of-hours analyst could reach only the IT service desk, which then had to find the incident manager: 25 minutes lost before anyone could declare. | High Objective O2 was Not met: the alert could not reach the person who declares |
OB-04 | O4 Restore in the right order, safely | I5 Day 1, 13:00 minute 80 | Nobody could say when a backup of the ordering platform was last restored and checked. | Medium Objective O4 was Partly met: nobody knew whether a restore would work |
OB-05 | O6 Speak with one voice | I7 Day 2, 09:00 minute 110 | The customer notice took 70 minutes to approve, because it was written from scratch. | Medium Objective O6 was Partly met: the notice was right but late |
OB-06 | General | — | Two of the five deputies named in the plan had never taken part in an exercise. | Low An improvement: deputies who have practised can take over without delay when a role holder is away |
Part E — Improvement actions
Every finding must have an improvement action with one owner, a due date set by its priority, and the document or control it changes. Actions are tracked until closed (EX-10). Due dates count from the day this report is approved. Enter every action in the Exercise Observations & Improvement Tracker.
Action | What will change | Changes | Owner | Priority and due | Status |
|---|---|---|---|---|---|
EA-01 (OB-01) | Write into the plan that the incident manager may isolate a system, site or account without waiting for the executive | Incident Response Plan, decision rights | Head of Information Security | High 30 Apr 2026 | Open |
EA-02 (OB-02) | Confirm the firm's NIS2 status in writing and put the three legal questions into the first-hour steps | Incident Triage & First-Hour Assessment Procedure, reporting screen | Head of Information Security | Medium 29 Jun 2026 | Open |
EA-03 (OB-03) | Give the monitoring provider's out-of-hours analysts a direct route to the incident manager or their deputy | Incident Response Plan, contact directory; monitoring contract | Head of Information Security | High 30 Apr 2026 | Open |
EA-04 (OB-04) | Restore and check a backup of the ordering platform every month, with the backup provider | Ransomware Response Playbook, recovery; backup schedule | Head of IT | Medium 29 Jun 2026 | Open |
EA-05 (OB-05) | Pre-approve the customer notice and the media holding statement, with blanks for the facts | Incident Communications Template Set, CT-04 and CT-09 | Head of Marketing and Communications | Medium 29 Jun 2026 | Open |
EA-06 (OB-06) | Bring every deputy named in the plan into an exercise | Exercise programme; invitation lists | Head of Information Security | Low 27 Sep 2026 | Open |
Part F — Re-tests
An objective rated Partly met or Not met must be re-tested within [[6]] months of its improvement action being done, and its finding stays open until then. A live incident can serve as the re-test when its post-incident review rates the same decision (EX-11). Plan each re-test here: the next exercise or drill of the audience that takes the decision, after the action is done.
Objective | Rating | Action | Who takes the decision | Re-test due |
|---|---|---|---|---|
O1 Isolate without waiting | Partly met | EA-01 | AU-03 Incident response team | Within 6 months of EA-01 being done: by 30 Oct 2026 if it is done on its due date |
O2 Declare and escalate, in and out of hours | Not met | EA-03 | AU-03 Incident response team; AU-04 Technical responders | Within 6 months of EA-03 being done: by 30 Oct 2026 if it is done on its due date |
O4 Restore in the right order, safely | Partly met | EA-04 | AU-04 Technical responders | Within 6 months of EA-04 being done: by 29 Dec 2026 if it is done on its due date |
O6 Speak with one voice | Partly met | EA-05 | AU-02 Executive management and the crisis team; AU-03 Incident response team | Within 6 months of EA-05 being done: by 29 Dec 2026 if it is done on its due date |
Objectives not tested: none. Objectives rated Met are not re-tested, even where a finding sits on them (EA-02).
Part G — Changes to the plan and playbooks
The plan and the playbooks an exercise tested must be reviewed after it (EX-12). List each document the exercise tested, and what changes in it, or why nothing does.
Document | Change | Action |
|---|---|---|
Incident Response Plan, decision rights | Write into the plan that the incident manager may isolate a system, site or account without waiting for the executive | EA-01, due 30 Apr 2026 |
Incident Triage & First-Hour Assessment Procedure, reporting screen | Confirm the firm's NIS2 status in writing and put the three legal questions into the first-hour steps | EA-02, due 29 Jun 2026 |
Incident Response Plan, contact directory; monitoring contract | Give the monitoring provider's out-of-hours analysts a direct route to the incident manager or their deputy | EA-03, due 30 Apr 2026 |
Ransomware Response Playbook, recovery; backup schedule | Restore and check a backup of the ordering platform every month, with the backup provider | EA-04, due 29 Jun 2026 |
Incident Communications Template Set, CT-04 and CT-09 | Pre-approve the customer notice and the media holding statement, with blanks for the facts | EA-05, due 29 Jun 2026 |
Exercise programme; invitation lists | Bring every deputy named in the plan into an exercise | EA-06, due 27 Sep 2026 |
Incident Classification, Severity & Escalation Matrix (P09) | Reviewed. No change: the gaps were in who is reached and who decides, not in the severity criteria | — |
Part H — Approval
H1 Approval — EXAMPLE | |||
Exercise sponsor approves the report and every action in it | Chief Operating Officer (executive incident lead): approved 31 Mar 2026 | ||
Working days after the exercise EX-09: at most 10 | 9 working days after the exercise | ||
Actions entered in the Exercise Observations & Improvement Tracker by | Head of Information Security (exercise lead), 31 Mar 2026 | ||
Distribution | Executive management; the participants and observers. No names: the report speaks of roles | ||
Measures EXM-02 to the quarterly report (EX-12) | EXM-02: 2 met, 3 partly met, 1 not met, of 6 tested (18 Mar 2026). Reported with the incident measures at the next quarterly report | ||
Part I — Follow-up
Completed from the Exercise Observations & Improvement Tracker at each quarterly report, until every action is closed. An action is Closed only once it is done and, where its objective was Partly met or Not met, re-tested (EX-11). Open actions past their due date count in EXM-03; re-tests awaited count in EXM-04.
Action | Status at 30 Sep 2026 | Re-test | Result |
|---|---|---|---|
EA-01 | Closed (change made 22 Apr 2026) | INC-2026-014, 12 Aug 2026 | Met |
EA-02 | Closed (change made 8 May 2026) | Not needed: O3 was Met | — |
EA-03 | Done (change made 10 Sep 2026, 133 days late) Waited on a change to the monitoring contract. Still open on 12 Aug; the post-incident review raised the same gap again as PIA-05 | EX-2026-02, 6 Oct 2026 | Due |
EA-04 | Closed (change made 28 May 2026) | INC-2026-014, 13 Aug 2026 | Met |
EA-05 | Done (change made 12 Jun 2026) Not tested in August: no customer service was affected. Re-tested in two parts: the customer notice (CT-04) at EX-2026-02 on 6 Oct 2026, and the media holding statement (CT-09) at EX-2026-03 on 22 Oct 2026. Closed only when both are Met | EX-2026-02, 6 Oct 2026 (CT-04) EX-2026-03, 22 Oct 2026 (CT-09) | Due |
EA-06 | Open, overdue by 3 days (EXM-03) The two deputies are invited to EX-2026-03 on 22 Oct | Not needed: not tied to an objective | — |
On 12 Aug 2026, the ransomware incident INC-2026-014 in the Security Incident Management pack tested some of the same decisions for real. Its post-incident review rated them as below.
Objective | March exercise | August incident | What the incident showed |
|---|---|---|---|
O1 Isolate without waiting | Partly met | Met | Isolation decided by the incident manager 30 minutes after declaration, as EA-01 wrote into the plan. |
O2 Declare and escalate, in and out of hours | Not met | Partly met | Escalation after declaration was on time, but the alert still reached the IT service desk first: EA-03 was still open. The review raised it again as PIA-05. |
O3 Screen the reporting duties | Met | Met | Screen complete inside the 4 hours; early warning 7 hours 15 minutes after declaration. |
O4 Restore in the right order, safely | Partly met | Met | Backups checked before restoring, as EA-04 set up. |
O5 Put the extortion demand to the right people | Met | Not tested | No ransom was demanded. |
O6 Speak with one voice | Partly met | Not tested | No customer service was affected, so no customer notice was needed. |
What followed for the exercise programme (EXAMPLE):
- The post-incident review of the Severity 1 incident also reviewed the plan, as P09 IM-12 requires after every Severity 1 incident.
- EA-03 was still open, and the review raised the same gap again as PIA-05. One change, made on 10 Sep, answers both. Its re-test is the 06:30 drill on 6 Oct.
- The executive exercise moved to payment fraud (SC-05): ransomware was exercised in March and handled for real in August, while payment fraud is outside appetite.
- The live incident did not reset the exercise clock. The incident response team and the technical responders are past their six-month interval, and both are exercised in October.
Related documents
Document | Relationship |
|---|---|
Tabletop Exercise Design Methodology | The rules this report meets (EX-09 to EX-12), the evaluation scale and how results are compared |
Exercise Planning & Facilitation Procedure | The run of show, the hot debrief and the timeline that ends with this report |
Tabletop Scenario — Ransomware Encryption of Core Systems, and the other five scenario decks (A05 to A09) | The objectives, success measures and injects the report rates and cites |
Exercise Observations & Improvement Tracker | Where observations are recorded and actions are tracked until closed; Part I is read from it |
Incident Response Plan (Security Incident Management pack) | The plan the exercise tests, and the document most findings change |
Post-Incident Review Template (Security Incident Management pack) | A live incident's review, which can serve as a re-test when it rates the same decision (EX-11) |
Information Security Risk Register (Information Security Risk Management pack) | The top risks each scenario comes from (EX-05) |
Adapting this template
Guidance — delete before approval
Small organisation: the report can be two or three pages. Keep Parts B, D and E in full: they are what the exercise sponsor approves. Where the exercise lead also facilitated, ask [[a senior manager or an outside adviser]] to read the ratings before approval.
Drill or board session: a drill tests one step, so Part B may have one or two objectives and Part C may be short. A board session's objectives are the decisions only the board takes; its report goes to the board chair as well as the exercise sponsor.
Regulated entity (NIS2, DORA): NIS2 asks for procedures to assess whether risk-management measures work (Article 21(2)(f)); the Implementing Regulation asks the digital providers it binds to test their continuity plans and bring the lessons in (Annex, point 4.1.4). DORA asks financial entities to review their plans in the light of test results (Article 11(6)), and to prioritise, remedy and validate the issues a test reveals (Article 24(5)). Parts D, E and F are that record: keep each approved report for the authority or auditor.
IT run by a service provider: when the exercise tests the provider's service, its staff take part as participants: list them in Part A, and let your own observers record what they did. A provider's staff never observe or rate an exercise of their own service. Actions on a provider are owned by your contract owner for it, and may need a contract change. The ratings and the approval stay with your organisation.
A live incident comes first: if an incident tests a decision before its re-test, its post-incident review can serve as the re-test (EX-11). Record it in Part I as the incident and date. The incident does not count as an exercise for the audience's interval (EX-02).
Delete this section before approval.
Framework references
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR).
Framework | Reference | Supported by |
|---|---|---|
ISO/IEC 27001:2022 | Annex A 5.27 — Learning from information security incidents | Whole report: knowledge from the exercise used to strengthen the response |
ISO/IEC 27001:2022 | Clause 10.2 — Nonconformity and corrective action | Parts D to F and I: gaps found, corrective actions owned, dated, re-tested and followed up |
NIST CSF 2.0 | ID.IM-02 — “Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties” | Parts D and E: improvements identified from exercises, including those with suppliers |
NIST CSF 2.0 | ID.IM-04 — “Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved” | Part G: the plan and playbooks improved after the exercise |
NIS2 — Directive (EU) 2022/2555 | Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures” | Parts B and C: whether the response measures work, assessed |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 4.1.4 — the business continuity and disaster recovery plans are tested, reviewed and, where appropriate, updated at planned intervals and after significant incidents or significant changes, and incorporate lessons learnt from the tests | Parts F and G: plans updated with the lessons from the test, and the changes re-tested |
DORA — Regulation (EU) 2022/2554 | Article 11(6) — test the ICT business continuity plans and the ICT response and recovery plans “in relation to ICT systems supporting all functions at least yearly, as well as in the event of any substantive changes to ICT systems supporting critical or important functions”, and test the crisis communication plans (Article 14); financial entities other than microenterprises include in the testing plans “scenarios of cyber-attacks and switchovers between the primary ICT infrastructure and the redundant capacity, backups and redundant facilities”; the policy and plans are regularly reviewed taking into account test results and recommendations from audit checks or supervisory reviews | Part G: plans reviewed in the light of test results |
DORA — Regulation (EU) 2022/2554 | Article 24(5) — procedures and policies to prioritise, classify and remedy all issues revealed by the tests, and internal validation methodologies to ascertain that all identified weaknesses, deficiencies or gaps are fully addressed | Parts D, E and F: issues prioritised, remedied and validated by re-test |
Definitions
Term | Meaning in this template |
|---|---|
After-action report | The written report of an exercise: what was tested, the result for each objective, what held, what failed and the improvement actions agreed. Approved by the sponsor. |
Evaluation scale | The four ratings every objective is given: Met, Partly met, Not met, Not tested. |
Exercise | A planned rehearsal of the incident response plan on a made-up incident: a discussion of a scenario, a test of one part (a restore, a call tree), or a full simulation. A live incident is not an exercise. |
Finding | An observation, or several, confirmed at the hot debrief or in the after-action report as a gap that needs a change. |
Hot debrief | A short, structured discussion held straight after the exercise, the same day, while memories are fresh. |
Improvement action | The change that closes a finding, with one owner, a due date and the document or control it changes. |
Inject | A new piece of the scenario given to participants at a set time: a fact, a message, a call or a problem. Each inject forces at least one decision. |
Objective | A decision the exercise sets out to test, written before the scenario, with who takes it and the rule it is judged against. |
Observation | Something an observer saw during the exercise, written as fact: what happened, when, and which objective it concerns. It can be a strength or a gap. |
Observer | A person who watches and records against the objectives, and takes no part in the discussion or the decisions. |
Re-test | Testing the same decision again once its improvement action is done, to show the change works. |
Sponsor | The executive who asks for the exercise, approves its objectives and approves the after-action report. |
Tabletop | An exercise held as a discussion. Participants sit together, receive the scenario in stages and say what they would decide and do. Nothing is switched off or restored. |