An after-action report for a supply chain drill records what you set out to test, what happened, what worked, what did not, and a short list of corrective actions with owners and dates. Keep it to two pages so people read it and act.
Why write one
A drill that ends with "that was useful" changes nothing. HSEEP, the FEMA exercise program, describes documenting strengths, areas for improvement, capability performance and corrective actions in an after action report and improvement plan, then using improvement planning to carry out the fixes. CISA's tabletop packages likewise include an after action report template alongside a post exercise feedback form. The format is old and it works.
The template
1. Header. Exercise name, date, duration, scenario (fictional), facilitator, scribe, participants by role.
2. Objectives. Three or four, written before the session. Examples: find every use of the affected component within 30 minutes, name an owner for each exposed secret type, decide who speaks to customers.
3. Summary. Three sentences. What the scenario was, how the team did overall, and the single biggest gap.
4. Timeline. A table of inject times and when the team made each decision.
| Time | Inject | Decision | Who |
|---|---|---|---|
| 05 | Advisory lists a package you use | Search lockfiles | CI owner |
| 20 | Secrets may be exposed | Rotate cloud keys first | Security lead |
5. Findings. Group by objective. For each: met, partly met, or not met, with the evidence you saw. Add one line on cause, such as "no inventory of repository secrets" or "only one person has registry admin."
6. Corrective actions. The part that matters.
| Action | Owner | Due | Check |
|---|---|---|---|
| Pin third-party actions to commit SHAs | Platform lead | 14 days | Search shows zero mutable tags |
| Publish a contact sheet | Security lead | 7 days | Sheet reviewed by on-call |
7. Open questions. Items the group could not answer. Each gets an owner to find out.
Writing rules that keep it honest
- Describe decisions and systems, not people's mistakes. If someone froze, the finding is that the process leaned on one person.
- Prefer observed facts to impressions. "Lockfile search took 50 minutes" beats "search was slow."
- Cap corrective actions at five to seven. A long list is a wish list.
- Give every action a way to verify it is done.
After the report
Share it with the teams that own the actions, add the actions to your normal tracker, and review progress at the next drill. Fold lessons into your plan: our guide to what goes in a supply chain incident response plan covers where they belong. Track whether repeated findings return, as described in drill metrics worth measuring.
For a real incident rather than a drill, see the zero-day after-action review questions.
Try it yourself
Click through it at your own pace, or open it full screen. See how evidence is mapped to controls, then consider where your drill reports would be filed as evidence.
Safeguard offers compliance and evidence automation, so drill reports and related records can be kept alongside other control evidence.
Quick check
How long should the report take to write?
Plan an hour or two within a week of the drill. Memory fades fast, and the scribe's notes make the first draft quick.
Should the report be shared outside engineering?
Share a summary with leadership and auditors if asked. Keep scenario details and any sensitive gaps to those who need them.
Sources
Last reviewed: 19 October 2026.
