After-action review (AAR): process, structure and action plan
What is an after-action review?
An after-action review (AAR) is a debrief with a fixed structure. It evaluates an exercise or a real incident and records what the team changes as a result. The method comes from the military context (US Army, TC 25-20) and is now standard in crisis management and cybersecurity. At its core the team compares target and actual: what was planned, what happened, why, and what do we change? It has little to do with a casual round of “how did it go?”. An AAR is facilitated, follows a fixed sequence and ends with documented actions, each with a responsible person. In IT contingency planning it is firmly anchored: NIST SP 800-84 (Guide to Test, Training, and Exercise Programs) makes the evaluation with an improvement plan a fixed part of every exercise programme.
After-action review or after-action report?
Both are abbreviated AAR but mean two different things. The after-action review is the process, the facilitated evaluation with the team. The after-action report is the document that records the results. The people responsible for actions work with it, it informs management, and it is the evidence you present in the audit. NIST SP 800-84 describes the after-action report as the result of the evaluation phase: it contains background on the exercise (purpose, objectives, participants, scenario), the observations of facilitator and observers, and recommendations for improving the plan that was exercised. The evaluation criteria should be set before the exercise so that the observers know what to look for.
| Dimension | After-action review | After-action report |
|---|---|---|
| What it is | Facilitated session in which the team evaluates | Written result of that session |
| Timing | Hot wash straight after the exercise, formal AAR a few days later | Immediately after the formal AAR |
| Who is involved | Exercise participants, facilitator, observers | Read by action owners, management and auditors |
| Content | The team works through the four guiding questions | Context and objectives, course of events, observations, assessment, action plan |
How do I write an after-action report?
Write the after-action report straight after the formal AAR, while everyone still remembers who said what and when. The basis is the notes of facilitator and observers and the expected responses from the master scenario events list (MSEL). In practice this five-part structure works:
- Summary: half a page for management. Which scenario was exercised, what worked well, where are the biggest gaps, which actions are most urgent?
- Context and exercise objectives: purpose, scenario, date, participants, exercise format and the evaluation criteria set beforehand.
- Course of events and observations: per inject or topic, what was expected and what actually happened. Neutral and with the time.
- Assessment and causes: for every deviation the cause, not just the symptom. Explicitly record what worked well too.
- Action plan and sign-off: every finding as an action with a responsible person, a deadline and an effectiveness check. Management signs off the plan, and the date of the follow-up exercise is already in it.
Write observations as facts that can be checked: “The report to the authority was made after 2.5 hours.” A judgement such as “communication was poor” helps nobody.
Which questions does an after-action review answer?
An AAR answers four guiding questions, in this order:
- What should have happened?
- What actually happened?
- Why were there deviations?
- What do we improve, concretely, and who is responsible?
| Guiding question | Purpose | Example result |
|---|---|---|
| What should have happened? | Name the target state from plan, playbook and MSEL | Report to the authority expected after 30 min. |
| What actually happened? | Record the actual state without judging it | The report only went out after 2.5 hours |
| Why were there deviations? | Find the cause behind the symptom | Only one person knew the reporting path |
| What do we improve, concretely? | Set an action with a responsible person and a deadline | Document the reporting chain, name a deputy |
If the discussion stays on the surface, detail questions help: which information was missing at which point? Who decided what, when, and on what basis? Which assumption in the plan proved wrong? And what worked well and should stay exactly as it is?
AAR or lessons learned: what is the difference?
The two terms are often used interchangeably. The AAR is the session straight after the exercise. Lessons learned are what remains afterwards: written-up findings that are shared and fed into processes.
| Dimension | After-action review | Lessons learned |
|---|---|---|
| Timing | immediately after the exercise or incident | afterwards, written up |
| Form | facilitated session, 4 guiding questions | documented findings and actions |
| Result | observations and action plan | changed processes, plans, training |
| Audience | the team involved | the organisation and future exercises |
How does an after-action review run?
A two-stage approach has proven itself. Straight after the exercise comes a short debrief (hot wash), while all impressions are fresh. A few days later follows the formal AAR. A neutral facilitator leads through the four guiding questions, records observations without judgement and separates symptoms from causes. After a tabletop exercise the yardstick is already there: the MSEL states the expected response for every inject. You measure what the team actually did against that. So you see strengths and gaps in black and white, and every finding becomes an action with a responsible person and a deadline.
How findings become an action plan
In the action plan every finding becomes a task with a responsible person, a deadline and a priority. When you create it, you also define how you will check its effectiveness. Without that last column, nobody later knows whether the gap has been closed. This is what an action plan after a ransomware exercise can look like (example rows):
| Finding | Action | Responsible | Deadline | Priority | Status | Effectiveness check |
|---|---|---|---|---|---|---|
| Reporting path to the authority was known to one person only | Document the reporting chain, name and brief a deputy | ISMS manager | 4 weeks | High | In progress | Follow-up exercise: the deputy triggers the report |
| Escalation to management only after 2 hours | Sharpen the escalation criteria in the incident response plan | Head of information security | 6 weeks | High | Open | Measure the time to escalation in the next exercise |
| Contact list of external service providers out of date | Update the list, set a half-yearly review | IT operations | 2 weeks | Medium | Done | Alerting exercise: check reachability |
- One responsible person per action: a name, not a team.
- Deadline as a date: nobody can track “soon”.
- Priority by risk: what causes the greatest damage in a real incident comes first.
- Track the status: overdue actions belong in the report to management.
- Define the effectiveness check up front: how will you know that the action works?
Phrasing lessons learned properly
A useful lesson learned describes an observed fact, its cause and what follows from it. It does not apportion blame. Nobody can work with a sentence like “communication was poor”, and it cannot be checked either. The examples show the difference:
| Not like this | Better like this |
|---|---|
| “Communication was poor.” | “The situation update reached corporate communications only 90 minutes after escalation because they were not on the crisis team’s distribution list.” |
| “Mr M. reacted too late.” | “No deputy was defined for approving the system shutdown. The decision was delayed until the responsible person could be reached.” |
| “We need to get better at backups.” | “The recovery order of the core systems is not defined in the IT emergency plan. Action: document the order by criticality and check it in the next functional exercise.” |
| “Everything went well.” | “The affected network segment was isolated according to the playbook. Keep the approach and document it as the standard.” |
Rule of thumb: if nobody can derive an action from a lesson, it is too general.
How do you check that actions work?
With a follow-up exercise that tests exactly the gap that was closed. That an action is done only means that someone did something. Whether it holds in a real incident only shows in the next exercise. This is how to go about it:
- Define the test criterion in the action plan already, for example: the deputy triggers the report within the intended deadline.
- Plan an inject in the next exercise that hits exactly this weakness. That can be the same scenario or a variant of it.
- Measure the result and compare it with the previous exercise: how long did the escalation take this time? Does the same finding come up again?
- Close the action only when the criterion is met. Otherwise derive a new action.
That is exactly what ISO/IEC 27001 requires: control A.5.27 (learning from information security incidents) requires using what has been learned to improve the security controls; clause 10.2 (nonconformity and corrective action) requires reviewing the effectiveness of the corrective actions taken.
AAR after a real incident
After a real security incident, the follow-up is just as much part of the process. NIST SP 800-61 Rev. 3 sets out the post-incident activity, that is lessons learned and improvement, as a phase of its own in the incident response cycle. The AAR after an incident follows the same four guiding questions as after an exercise. The results flow back into the incident response plan, the playbooks and the next exercise.
What SecDrills takes off your hands with the after-action report
Anyone who has ever assembled a report from three notepads and a chat history after an exercise knows the effort. In SecDrills the after-action report is produced during the exercise: every assessment and every decision is recorded with role and timestamp. After the last decision the report contains scores per topic, a traffic-light overview (RAG), the mapping to NIS2 and DORA and prioritised actions. You export it as PDF, Word or HTML. Across several exercises a trend emerges with which you show management and auditors that your team is getting better.
An externally facilitated exercise usually costs €5,000 to €15,000. At SecDrills the Drill Pass for €490 includes one exercise in solo mode, and you can export the report for 30 days. For exercises in a team there is the annual package Essentials from €1,490 a year. If you would rather have the exercise and the debrief facilitated, add the Guided Exercise for €3,900: a scoping workshop beforehand, live facilitation, debrief and AAR review by our team. All prices net. The free demo drill shows you the process, but there is no report export in it.
Frequently asked questions
What is an after-action review?
An after-action review (AAR) is the facilitated evaluation after an exercise or an incident. It compares target and actual, finds the causes of the deviations and derives concrete improvement actions, each with a responsible person and a deadline.
What is the difference between an after-action review and an after-action report?
The after-action review is the facilitated session in which the team evaluates an exercise or an incident. The after-action report is the written result. It records context, observations, assessment and action plan and serves as evidence towards management and auditors.
Which questions does an after-action review answer?
Four guiding questions: What should have happened? What actually happened? Why were there deviations? What do we improve, concretely? In SecDrills the report additionally contains scores per topic and a mapping of the results to NIS2 and DORA.
What is the difference between an AAR and lessons learned?
The AAR is the session straight after the exercise or incident in which the team answers the four guiding questions. Lessons learned are what remains from it: findings and actions that are written up, shared and fed into processes and the next plan.
When should an after-action review take place?
As soon as possible, ideally in two steps: as a short debrief straight after the exercise (hot wash) and as a formal AAR within a few days. Then the details are still fresh, and the actions are tackled while the topic still has attention.