09 / AAR (After-Action Review)

After-action review

Every exercise ends with a report drafted from what actually happened at the table: the timeline, the decisions, the responses and their evaluations. It follows the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-84 approach to evaluation and the Homeland Security Exercise and Evaluation Program (HSEEP) after-action report and improvement plan structure, and corrective actions are scoped to be tracked to closure within 60 days.

How to read this page

Redacted sample

The report below is an anonymized example, not a real exercise. Names, organizations and figures have been replaced. Your own review is generated the moment ENDEX is called and is visible only to the Executive Sponsor and Operator of your organization and exports to a paginated PDF.

Sample report — redacted

Draft — not yet reviewed by legal counsel

This after-action review was drafted by AI from the exercise record the moment ENDEX was called. It gives leadership timely situational awareness while decisions and observations are still fresh. It is a draft: it has not been reviewed by legal counsel and is not the final, fully vetted and verified after-action review. Use it to brief leadership and start corrective actions, then confirm findings, regulatory conclusions and dates with counsel before the report is finalized or shared externally.

01 / Executive summary

Executive summary

REDACTED SAMPLE. [ORGANIZATION] conducted a 180-minute discussion-based tabletop exercise against a ransomware scenario with recovery denial. The crisis team convened within 12 minutes of first alert and protected the payment platform, but the decision to isolate the virtualization layer waited on an owner who was never named in the plan, costing roughly 40 minutes. The materiality determination for Securities and Exchange Commission (SEC) Form 8-K Item 1.05 was still open at ENDEX (end of exercise), and no Form 8-K filing owner had been named. Eight corrective actions are recommended, all scoped for closure within 60 days.

02 / Exercise overview

Exercise overview

Scenario: SAMPLE — Ransomware with recovery denial at a publicly traded financial services company (SEC registrant)
Scope: Discussion-based tabletop, no live systems touched. In scope: [BUSINESS UNIT] payment platform, corporate identity, customer communications. Out of scope: operational technology (OT) environment, physical security.
Planned duration: 180 min
Actual duration: 168 min
ENDEX reason: Objectives met; Operator called ENDEX after the recovery decision
Departments: Information Security (4) · Information Technology (3) · Legal (2) · Communications (2) · Executive (2) · Finance (1)

Training objectives

Exercise the crisis escalation path from detection to executive decision (GV.RR, RS.MA).
Test the materiality determination workflow against SEC 8-K Item 1.05 timing.
Validate recovery sequencing when backups and the hypervisor are suspect (RC.RP).

03 / Timeline of play

Timeline of play

T+	Sim time	Type	Entry	Detail	Dept
T+00:10	09:10	inject	Endpoint detection and response (EDR) alerts on mass file rename in the finance file share	Released to Information Security and Information Technology. Severity HIGH, vector RANSOMWARE.	Information Security
T+00:22	09:22	response	Information Security convenes the crisis team	Containment started on two hosts; scope not yet established.	Information Security
T+00:45	09:45	situation update	Backup catalog unreachable	Operator pushed a mid-exercise update raising recovery uncertainty.	ALL
T+01:05	10:05	decision	Isolate the virtualization management network	Sponsor approved isolation, accepting a four-hour outage on internal apps.	Executive Leadership
T+02:48	11:48	endex	ENDEX called	Recovery sequencing agreed; hotwash held immediately after.	ALL

04 / Inject and decision summaries

Inject and decision summaries

T+00:00Endpoint alerts on virtualization hosts

Security monitoring flagged mass file encryption on two hypervisor hosts shortly after midnight.

Response: The security operations team declared an incident within 11 minutes and paged the crisis team.

T+00:35Backups found encrypted

The infrastructure team discovered that the most recent backup set had also been encrypted.

Response: IT began restoring from offline copies, but isolating the virtualization layer waited on an unnamed owner.

Executive Sponsor decisions

T+00:52Isolate the virtualization layer

Inject: Backups found encrypted

Leadership approved isolation to stop further spread, accepting a temporary outage of non-critical systems.

05 / Objective analysis

Objective analysis

Exercise the crisis escalation path from detection to executive decision.

Met

CSF GV.RR-02CSF RS.MA-01IR-4IR-8T+00:22

Crisis team convened at T+00:22 using the documented bridge. Roles were stated aloud and recorded.

Test the materiality determination workflow against SEC 8-K Item 1.05 timing.

Partially Met

CSF GV.RM-02CSF RS.CO-02IR-6T+01:05

Legal opened the assessment at T+01:05 with no pre-agreed materiality criteria. The team noted that the four-business-day filing clock starts at the determination, but no determination was reached and no filing owner was named.

Validate recovery sequencing when backups and the hypervisor are suspect.

Not Observed

CSF RC.RP-02CSF RC.RP-03CP-10IR-4T+02:48

The exercise ended before a restore order was walked through in detail.

06 / Strengths

Strengths

▸Detection to escalation was fast and disciplined, satisfying the intent of DE.AE-06 handoff to response.T+00:10
▸Communications drafted a holding statement without waiting for full facts, supporting RS.CO-02 timeliness.T+00:45
▸Finance identified the wire-fraud secondary risk unprompted, an ID.RA-03 strength.T+00:22
▸The Sponsor stated risk tolerance explicitly before approving isolation, exercising GV.RM-02.T+01:05

07 / Areas for improvement

Areas for improvement

No named owner for isolating the virtualization management layer, delaying the decision about 40 minutes.

The response plan assigns hypervisor actions to a team, not a role with authority to accept outage. Under time pressure the group deferred upward twice.

National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0 GV.RR-02; Special Publication (SP) 800-61r3 CSF GOVERN and IDENTIFY outcomes; SP 800-53 incident response control IR-8T+01:05

Materiality criteria were not available at the table.

Legal and Finance built them live, and no determination had been reached at ENDEX. SEC rules require the materiality determination to be made without unreasonable delay after discovery; the four-business-day Form 8-K deadline starts only once that determination is made. Building criteria from scratch mid-incident risks a delay the company would have to defend.

SEC 8-K Item 1.05; NIST CSF 2.0 GV.RM-02T+01:05

08 / Regulatory clocks

Regulatory clocks

Regime	Trigger	Deadline	Status
Securities and Exchange Commission (SEC) Form 8-K Item 1.05	Determination that the incident is material	Determine without unreasonable delay after discovery; file within 4 business days of the determination	at risk
General Data Protection Regulation (GDPR) Art. 33	Confirmed exposure of EU customer records	72 hours after awareness	on track

09 / Corrective actions

Corrective actions

Close within 60 days

Action	Owner role	Due	Priority	Reference
Name a single accountable role, with a documented deputy, authorized to isolate the virtualization management network.	Chief Information Security Officer (CISO)	30 d	HIGH	GV.RR-02; incident response control IR-8
Publish a one-page materiality determination aid: quantitative and qualitative criteria, who decides, and a target timeline from discovery to determination.	General Counsel	45 d	HIGH	SEC Form 8-K Item 1.05; GV.RM-02
Run a restore rehearsal from immutable backup for the payment platform.	Information Technology Operations Director	60 d	MED	RC.RP-03; CP-10

10 / Participant feedback prompts

Participant feedback prompts

At what point did you know who was making the containment decision?
Which information did you need that nobody in the room could provide?
What would have changed if the incident had started at 02:00 on a Sunday?
Which single change to the plan would have helped you most today?

11 / Appendices

Appendices

Appendix A — Master scenario events list

T+00:10 [INJECT] Endpoint detection and response alerts on mass file rename | severity HIGH | vector RANSOMWARE | released to Information Security, Information Technology
T+00:45 [SITUATION UPDATE] Backup catalog unreachable | released to ALL
T+01:20 [INJECT] Journalist calls with a leaked ransom note | severity MED | vector RANSOMWARE | released to Communications, Executive

Appendix B — Roster

Information Security — [REDACTED] (Security Operations Lead)
Legal — [REDACTED] (Deputy General Counsel)
Executive — [REDACTED] (Chief Operating Officer)