Somewhere on a shared drive there is a folder called Exercises. Inside it is the report from your last OT tabletop, and nobody has opened it since the afternoon it was saved.
Here is how that sounds when someone finally admits it:
We ran the tabletop in March. Good day. People argued about the right things. Someone wrote it up in April and saved it as AAR_FINAL_v2. Last week I opened the year before's report to borrow its layout, and finding three was the same finding in nearly the same words: nobody on nights could reach the integrator after hours. We had found it twice. We had fixed it zero times.
Nobody sent us that paragraph. It is a composite, written in the voice of whoever runs exercises at a plant. If that is you, you could probably have written it yourself, with your own file name in it.
The exercise did its job. It found the gap, twice. What failed is the part after the room empties, and it failed for a structural reason, not a personal one: the report was written as a record of a day, when it needed to be a list of jobs. Records get filed. Jobs get chased.
This post is for whoever ran the last OT tabletop or drill at their site and is now expected to make something happen because of it. The fix is smaller than it sounds: a table about five rows long, and one rule about which column you fill in first.
The rule is not ours. FEMA's Homeland Security Exercise and Evaluation Program, HSEEP, sets out a common approach to designing, running, evaluating and improving exercises, and anyone can use it. Its 2020 doctrine puts the whole problem in two sentences:
"Corrective actions captured in the AAR/IP should be tracked and continually reported on until completion. [...] Stakeholders should also ensure a system is in place to validate previous corrective actions that were successfully implemented."
AAR/IP is FEMA's shorthand for the after-action report with its improvement plan attached. Read the second sentence again. HSEEP expects you to test the fix, and that is the step almost every filed report skips.
Four rows from a plant that does not exist
The site below is fictional: a chemical blending plant that ran a ransomware tabletop in September 2026. The format follows the Improvement Plan Row Template in our book's OT IR Field Kit, which takes FEMA's Improvement Plan columns and adds a closure-evidence column that FEMA's template does not have. Here it is the re-test.
| Finding (cause, not symptom) | Corrective action | Owner, by role | Due | Re-test that closes it |
|---|---|---|---|---|
| An unexplained setpoint change was reported at 01:10; the incident was declared at 02:35. The plan says escalate "when it looks serious", so nobody on nights felt entitled to call it. | Write three declaration triggers into the plan: unexplained setpoint change, loss of view on more than one HMI, unknown remote session. Brief every shift at handover. | OT security lead drafts; operations manager approves | 27 Nov 2026 | Next tabletop opens with a setpoint inject on nights. Pass: declared within 15 minutes of the first report. |
| Nobody knew where the current PLC project files for the blending line were. The newest copy was on one engineer's laptop, 14 months old. | Back up every controller project on the line to offline media after each change, and log each copy with its date. | Controls engineering lead | 29 Jan 2027 | Bench restore of one project from the offline copy, by someone other than whoever made it, timed. Pass: it loads, and the time is recorded. |
| The integrator's after-hours number reached a general switchboard. The support contract has no night response clause. | Interim: a named after-hours escalation contact, in writing. Permanent: a response-time clause at contract renewal. | Maintenance manager, with procurement | Interim 13 Nov 2026; clause at renewal, 31 Mar 2027 | Call the after-hours route for real during the next drill. Pass: a qualified engineer on the phone within the time the plan assumes. |
| Isolating the plant network took 50 minutes: only one administrator can make the firewall change, and replacing the firewall needs a shutdown. | Interim: a written manual isolation step at a named, labelled switch port that a shift lead can perform. Permanent: new firewall at the spring turnaround. | OT network lead | Interim 20 Nov 2026; permanent at the spring 2027 turnaround | A shift lead isolates in a drill with the administrator unreachable. Pass: under 10 minutes. Re-run after the turnaround. |
Writing the re-test first does two jobs. It forces the finding down to a cause, because nobody can write a pass condition for "communication was poor". And it makes the action specific, because the action now has a target.
Two more details carry weight.
- The finding is a cause, not a symptom. FEMA's 2020 AAR/IP template (this copy is hosted by Missouri's emergency management agency) gives every area for improvement a "Reference" line for the plan it was measured against and an "Analysis" line for the root cause, and says the observation "should not include a recommendation or corrective action, as those will be documented in the Improvement Plan."
- The owner is a role here so the example travels. In your tracker it is one named person. A department owns nothing. The doctrine says the After-Action Meeting should reach consensus on "concrete deadlines, and owners/assignees." In practice, the owner agrees to the row in the room, and does not learn about it from an email a month later.
"We were in the room. We know what went wrong."
Honestly, we all sat through it. Everyone knows escalation was slow and the backups were a mess. Writing a report is a week of my life that fixes nothing. I would rather just go fix things.
Partly right. If the fix happens this week, go and fix it. Most do not, and being in the room gives you the symptom, not the cause. Everyone at the fictional plant remembered "escalation was slow". Only writing the row turned that into "the plan never says what counts as an incident", which is a two-paragraph edit, not another round of training.
Nor does the report have to be a week of typing. The doctrine says "the length, format, and development timeframe of the AAR/IP depend on the exercise type and scope." For a ten-minute call-list check, the whole report can be one row.
A quick check: without looking, can you name the one person who owns the top finding from your last exercise, and its due date? If you can, this section is not your problem, and the next one may be.
"There is no budget for fixes this year"
I cannot fund half of this. Putting a list of things we will not pay for on paper just makes the site look worse, and it will sit there red until someone asks me about it.
Count the money in the four rows. Row one is a plan edit. Row two is offline media and a bench afternoon. Row three is a phone call and a clause at a renewal already scheduled. Only row four costs real money, and it was always going to wait for the turnaround.
The doctrine points the same way. Its questions for writing corrective actions ask about changes to plans and procedures, organisational structures and management processes before they reach equipment. Access, phone numbers and vague sentences in a plan need no capital.
For the rows that do, the table makes the budget conversation easier. "We need a new firewall" is a wish. "Isolation took 50 minutes, the interim step gets it under 10 by November, and the permanent fix is dated to the spring turnaround" is a decision a manager can sign. One habit keeps it honest: a row that slips its date twice goes to the manager who sets that owner's priorities, because two slips usually mean a priority conflict, not forgetfulness.
"The auditor only checks that the report exists"
Our auditor wants to see that we tested the plan and wrote down what we learned. A filed report ticks that box. Re-tests are extra work nobody asked for, and I do not want a list of open weaknesses in a file outsiders can request.
Read what the requirement says first. For NERC-registered entities, CIP-008-6 requirement R3.1 sets a 90-day window after each response plan test. Inside it you record what the test taught you, change the plan to match, and tell the people the plan names about the change. A filed report shows the first of the three. A dated improvement plan, with rows that changed the plan and a note of who was told, shows the other two.
The re-test is the column an auditor is least likely to ask about, which is why it belongs to you. An auditor reads records. Only a drill tells you whether row one's trigger gets an incident declared at 01:25 instead of 02:35.
On writing weaknesses down: FEMA's template carries a placeholder for a protective marking at the top of every page. Agree with your legal and security teams how exercise reports are marked, stored and shared before the first one is written, not after a request arrives.
The folder can stay closed
Go back to the unopened report. That nobody opened it was never the real failure; plenty of good programs have reports that are read once. Finding three came back because it had no person, no date and no test attached, so nothing anywhere was waiting for it to be fixed.
Write the re-test first, and the report becomes a short list of jobs, each with a person, a date and a scene in next year's exercise. A fix that holds moves into the strengths column. A fix that fails reopens its row with a better root cause, which is the program working.
Sources: FEMA, Homeland Security Exercise and Evaluation Program | FEMA, HSEEP Doctrine, 2020 Revision 2 | FEMA, After-Action Report/Improvement Plan template, Rev. 2020 (Missouri SEMA copy) | NERC, Reliability Standard CIP-008-6
