From findings to fixes: closing the loop after a cyber crisis exercise

Why do exercise findings stall?

Findings stall when they belong to everyone. "Communications and legal should agree a holding statement" has two owners and therefore none. They also stall when they live in a document instead of the system where the business tracks work, and when nobody asks about them until the next annual exercise.

How do you turn a finding into an action?

• One action per finding, written as a verb: update, approve, test, train, buy.
• One named owner, not a team.
• A due date that the owner agreed to.
• A definition of done: what will be true when it is closed.
• A link back to the finding and the exercise moment it came from.

Some platforms produce a starting point. Hack The Box ends Crisis Control with an action roadmap, and Reflex Security traces each finding in its report to the moment it came from, which makes the evidence for each action easy to attach.

Where should actions be tracked?

In the same system the organisation uses for other risk or project work, not in a separate spreadsheet that only the exercise owner opens. That way actions show up in the owners' normal reviews and in risk reporting.

Who should see progress?

The executive sponsor of the exercise programme should see open actions, overdue actions and closed actions every month or quarter. If a board or risk committee received the exercise summary, it should receive the follow-up too: a report that lists findings without showing them closed suggests the exercise was for show.

How do you prove a fix worked?

Re-test it. Build the next exercise so that it reaches the same moment again: the same decision, the same handover, the same missing contact. If the fix worked, the decision is faster, clearer or made by the right person. That before and after comparison is the strongest evidence an exercise programme can produce, and it is what auditors and supervisors find most convincing.

What if a fix needs budget?

Some findings need money: a second communications agency on retainer, a tool, extra staff on call. Do not leave them in the action list as open items for a year. Escalate them as risk decisions: state the gap, what it would cost in an incident, and what closing it costs, and let the executive sponsor accept, fund or transfer the risk. A recorded decision to accept a gap is a legitimate outcome; an unrecorded one is not.

How does this connect to incident response more broadly?

NIST SP 800-61 Rev. 3 places lessons learned inside continuous improvement of the organisation's cybersecurity risk management, and NIST SP 800-84 treats exercises as a programme that ends in improvement planning. The same loop applies to real incidents and to exercises: observe, decide what to change, change it, and check that it changed.

A one-page follow-up checklist

1. Draft report within a few days.
2. Actions agreed with owners within two weeks.
3. Actions entered in the business's tracking system.
4. Monthly progress to the executive sponsor.
5. Top three fixes re-tested in the next exercise.