How soon after a tabletop should the after-action report be delivered?

Aim to circulate a draft within one to two weeks while memories are fresh, then hold a short review meeting with the sponsor and key players to agree the improvement plan. Final reports that arrive months later rarely lead to action.

Who should receive the after-action report?

The sponsor, the players and the owners of improvement actions. Because reports describe weaknesses in incident response, treat them as sensitive: mark them with an appropriate classification such as TLP:AMBER, limit distribution and avoid attaching raw notes that could identify individuals.

What is the difference between a hotwash and an after-action report?

The hotwash is the immediate, informal debrief at the end of the exercise. The after-action report is the written, structured analysis produced afterwards, combining hotwash feedback, scribe notes and evaluator ratings into findings, root causes and an improvement plan.

Writing a Tabletop After-Action Report and Improvement Plan

The after-action report (AAR) is where a tabletop pays for itself. The exercise uncovered gaps; the AAR explains them, traces them to root causes and turns them into an improvement plan with owners and due dates. Without it, the same gaps resurface in the next exercise or, worse, in the next real incident.

This guide covers what goes into an AAR, how to write findings that lead to action, how to build and track the improvement plan, and how to re-test. It follows the scoring guide, which produces most of the raw material.

Inputs to the report

Collect these within 24 hours of the exercise:

The scribe's timestamped log of decisions, questions, assumptions and gaps.
Evaluator guides (EEGs) with observations and draft ratings per capability.
The hotwash notes: what players said worked, what didn't and their top fixes.
The parking lot: issues raised but not resolved during play.
Participant feedback forms, if you used them, on realism and the exercise itself.
The MSEL with any changes made on the day (skipped or added injects).

Structure of an AAR

HSEEP uses a combined After-Action Report / Improvement Plan (AAR/IP). The structure below follows the same logic and works well for cyber exercises:

Executive summary: one page. Scope, headline strengths, top three to five areas for improvement, and the ask of leadership.
Exercise overview: name, date, duration, scenario summary, sponsor, participating teams (roles, not names) and objectives.
Analysis by objective or capability: for each, the rating, strengths, areas for improvement and root causes.
Key findings: the most important issues across capabilities, each written as observation, analysis and recommendation.
Improvement plan: a table of corrective actions with owners, due dates and how completion will be verified.
Exercise feedback: what to change in the next exercise design.
Appendices: MSEL, participant roles, glossary. Not the raw notes.

Keep it short. Ten pages that are read beat forty pages that are filed.

Writing findings: observation, analysis, recommendation

Each finding should follow the same three-part pattern.

Observation: what happened, factually and without attribution. Include the inject and exercise time.
Analysis: why it matters and what caused it. Reference the plan, a policy or the expected action from the MSEL.
Recommendation: a specific, testable change with a suggested owner.

A weak finding and a strong one:

	Weak	Strong
Observation	Communication was poor.	At INJ-07 (T+08:00), players could not agree who approves external statements. Legal, communications and the COO each assumed another role held approval authority. The holding statement was not approved before the simulated one-hour media deadline.
Analysis	People need to talk more.	The crisis communication plan lists communications as the drafter but does not name an approver for cyber incidents. The IR plan does not reference the crisis communication plan.
Recommendation	Improve communication.	Amend the crisis communication plan to name the approver (and deputy) for cyber-incident statements; cross-reference it from the IR plan; pre-approve two holding-statement templates. Owner: Head of Communications with General Counsel.

Root causes, not symptoms

For each area for improvement, ask why until you reach something the organisation can change. A useful classification for root causes:

Root-cause category	Typical example	Typical fix
Plan	The plan is silent on who authorises production shutdowns	Update the plan; define decision rights
Organisation / authority	Decision owner exists but is unreachable out of hours	Name deputies; publish an on-call rota
Training / awareness	Players unaware the insurer requires a panel IR firm	Brief the crisis team; add it to the playbook
Resources	No budget for offline backup of the hypervisor configuration	Business case with the sponsor
Tools / technology	No out-of-band communications channel if corporate email is down	Deploy and test a fallback channel
Third parties	Managed service provider contract has no incident-notification SLA	Contract amendment

Classifying root causes also shows patterns across exercises. If most findings are "plan", the plan needs a rewrite; if most are "authority", governance needs attention.

The improvement plan

The improvement plan is a table that turns recommendations into tracked work. Every row needs an owner (a named role, not a team), a due date and a verification method.

ID	Finding	Corrective action	Capability	Owner	Due	Verification
IP-01	Unclear approver for external statements	Name approver and deputy in the crisis comms plan; cross-reference from IR plan	Crisis communications	Head of Communications	30 Nov	Plan v2.1 published; re-tested in next TTX
IP-02	No authority defined for production-wide containment	Add decision-rights table to IR plan, approved by COO	Containment decisions	CISO	15 Dec	Plan approved; decision table used in next exercise
IP-03	Contact list stored only on encrypted file server	Maintain printed and offline copies; store in the out-of-band channel	Escalation	IR lead	31 Oct	Spot-check by internal audit
IP-04	Restore time for ERP unknown	Perform and time a full ERP restore test	Recovery	Infrastructure manager	31 Jan	Test report with measured restore time
IP-05	Panel IR firm requirement unknown to crisis team	Add insurer requirements and claim steps to ransomware playbook	Escalation	Risk manager	30 Nov	Playbook updated; briefed to crisis team

Aim for items that can be completed in weeks to a few months. Large programmes such as "implement a new backup architecture" should be broken into milestones.

A copy-ready AAR template

# After-Action Report / Improvement Plan
Exercise: <name>          Date: <yyyy-mm-dd>        Classification: TLP:AMBER
Sponsor: <role>            Facilitator: <role>        Scenario: <title>

## 1. Executive summary
- Scope and purpose (2–3 sentences)
- Key strengths (2–3 bullets)
- Top areas for improvement (3–5 bullets)
- Decisions requested from leadership

## 2. Exercise overview
- Objectives: OBJ-1 … OBJ-n
- Participating roles:
- Scenario summary:
- Deviations from the MSEL:

## 3. Analysis by objective
### OBJ-1 <text> — Rating: P / S / M / U
Strengths:
Areas for improvement:
  - Observation:
  - Analysis:
  - Root cause: plan | authority | training | resources | tools | third party
  - Recommendation:

## 4. Improvement plan
| ID | Finding | Corrective action | Capability | Owner | Due | Verification |
|----|---------|-------------------|------------|-------|-----|--------------|

## 5. Exercise feedback
- What to keep:
- What to change in the next exercise:

## Appendix A — MSEL
## Appendix B — Participating roles

Review and sign-off

Circulate the draft to the planning team and evaluators first, then to players for factual accuracy. Players should be able to correct facts, not negotiate ratings away. Finally, present the executive summary and improvement plan to the sponsor in a short meeting and get explicit agreement on owners and dates. The sponsor's sign-off is what gives the improvement plan authority.

Tracking to closure

Treat improvement-plan items like any other risk treatment:

Record them in the same tracker you use for audit findings or risk remediation, not in a document that nobody opens.
Review progress monthly with the sponsor or an existing security steering committee.
Require evidence to close an item: an updated plan, a test report, a contract amendment.
Escalate overdue items. A finding that stays open across two exercises is a governance issue.

Re-testing

Closing an action does not prove the capability improved. Re-test it:

Design the next tabletop so that at least one module revisits the previous exercise's weakest capability.
Use a different scenario that stresses the same capability, so players cannot rely on memory. For example, re-test crisis communications found weak in a ransomware exercise with a DDoS scenario.
Compare ratings and timing metrics with the previous exercise and report the trend.

Handling the report securely

An AAR is a map of your incident-response weaknesses. Handle it accordingly:

Classify it, for example with the Traffic Light Protocol (TLP:AMBER is common for internal distribution).
Limit distribution to people who need it and the owners of actions.
Exclude raw notes and anything that attributes statements to individuals.
If legal counsel directed the exercise to obtain legal advice, ask counsel how the report should be labelled and distributed; privilege rules vary by jurisdiction.

How to run a tabletop exercise
Scoring tabletop exercises
Scenario library
Glossary: after-action report, hotwash, HSEEP