What is in an after-action report, and what does an underwriter read first?

An after-action report has eight sections: a summary, the scope and scenario, participants and roles, a timeline of the decisions the room made, what worked, findings and gaps, prioritised recommendations, and a signed attestation that the exercise took place. Then an appendix setting out what the report evidences. An underwriter does not read all of it. They read the scope, the participants and the attestation, and they skim the findings to see whether anything was actually stressed. The rest is for you.

What are the eight sections, and what is each one for?

The summary is one page and exists so somebody senior can read it and stop. It says what was run, who was there, and what came out of it.

Scope and scenario says what was tested and, more usefully, what was not. An exercise that covers ransomware and says nothing about a vendor breach is a complete exercise with a stated boundary, which is better than one implying it covered everything.

Participants and roles lists who was in the room by function. This is the section a compliance reader goes to first, because the requirement they are satisfying is usually about who took part.

The timeline of decisions records what the room decided and in what order. Decisions, in sequence. Clock times against each entry are not in the standard report.

What worked comes before the problems, and not out of politeness. It is the section that tells you which parts of the plan to leave alone.

Findings and gaps names what did not hold up.

Recommendations, prioritised, turns each finding into something somebody can do.

The attestation confirms the exercise happened and who ran it. Everything above it is your material, written up. This one is the part you cannot produce for yourself.

What does an underwriter actually read?

Section	What you get from it	What an underwriter checks
Summary	A page you can forward to a board	Whether the exercise was real or a briefing
Scope and scenario	An honest boundary on what was tested	That a specific scenario was run, not a general discussion
Participants and roles	Who showed up, and who did not	That decision-makers were present, not only IT
Timeline of decisions	Where the response actually went	Rarely read in detail. Skimmed for whether decisions were made
What worked	The parts of the plan to keep	Not read
Findings and gaps	The value of the whole exercise	Skimmed. Zero findings is a warning sign, not a good score
Recommendations	Your improvement plan	Whether anything has an owner
Attestation	Nothing you did not already know	Read closely. This is the evidence

That gap is the thing to understand before you commission one. The sections you paid for are mostly not the sections being assessed, and the section being assessed took the least effort to produce. That is not a knock on the document. It is why the whole thing earns its place: you get an improvement plan, and the carrier gets a fact they can rely on.

How does this compare to a government after-action report?

Closely, and deliberately. Public exercise programmes have been formatting these for decades and there is no reason to invent a new shape.

CISA publishes an after-action report template with its tabletop exercise packages. Its improvement plan is a table, and the columns tell you what a serious after-action process is expected to produce: Issue/Area for Improvement, Corrective Action, Primary Responsible Organization, Organization POC, Start Date and Completion Date (CISA, Tabletop Exercise Package After-Action Report / Improvement Plan template, 2020).

Read those columns again. Four of the six are about accountability, not analysis. Who owns it, who to call, when it starts, when it finishes.

The doctrine underneath says the same thing in one line. FEMA’s exercise and evaluation programme requires that Corrective actions should be specific, measurable, achievable, relevant, and time-bound (SMART) (FEMA, Homeland Security Exercise and Evaluation Program doctrine, 2020).

So a finding without an owner and a date is not a finding by any published standard. It is an observation.

Why does that matter more than it sounds?

Because somebody has already documented what happens when you skip it, at national scale.

The US Department of Homeland Security’s Inspector General examined what happened when exercise findings were not tracked. Under a heading recording that exercises had not required corrective action planning, the report states: In the absence of a process to identify and implement corrective actions, problem areas identified during and even prior to the TOPOFF 3 exercise recurred during the response to Hurricane Katrina in 2005, and again in the 2007 TOPOFF 4 exercise (US Department of Homeland Security Office of Inspector General, OIG-09-53, 2009).

The same problems, found in an exercise, unaddressed, then met again in a real emergency, then found again in the next exercise.

That is what a report without owners and dates buys you. The exercise still happened. The finding was still correct. Nothing moved.

The pattern is not unique to government. IBM’s resilience research found that 52 percent of organisations with a security response plan had never reviewed it or had no set period for reviewing or testing it (IBM Security, Cyber Resilient Organization Report, 2020).

What does a finding look like when it is written properly?

Take a real shape of problem. During a ransomware scenario the room decides to engage its external incident response provider. Two people make that call independently, about twenty minutes apart, and give slightly different instructions about whether to isolate a file server.

A weak finding: Communication between executive and technical teams could be improved.

A usable finding: Two participants contacted the external provider separately with conflicting containment instructions. No single point of contact for external parties is named in the incident response plan. Owner: COO. Named in the plan and circulated by 30 November.

The second one is the same observation with three things added: what actually happened, why it happened, and who fixes it by when. That is the entire difference between a report that gets filed and a report that changes something.

This is the most common pattern the exercises behind this template surface, and it is not a technical failure. Accountability stops at the edge of security operations. Inside that team, ownership is clear. Outside it, nobody owns anything in particular, and the join between the executive and technical sides is where things fall through. Executives take reasonable steps without telling their peers, which is exactly how two people end up briefing the same vendor differently.

A room that has never rehearsed does not discover this by reading the plan. The plan looks fine. It discovers it by having two people reach for the phone.

What is not in the standard report?

Three things. They come as a separate add-on, not as a longer version of this document.

The Extended Exercise Record adds clock times against every timeline entry, mapping to MITRE ATT&CK and NIST CSF 2.0, and a plan-versus-behaviour gap analysis comparing what your written plan says against what the room actually did.

Those need a second pair of hands: somebody recording timings during the session, analyst time afterwards, and a read of your own plan before the exercise runs. It suits regulated firms, anyone inside a SOC 2 or ISO 27001 audit, a board asking for framework alignment, and anyone who has already had an incident and expects the file to be read by a regulator or a claims reviewer.

For a renewal, the standard report answers the question. If you want the extended version, it is a conversation and not a download, because whether it is useful depends entirely on who you expect to read it.