Executive AAR
Board-ready after-action review with executive summary, key findings, readiness scores, decision analytics, and strategic recommendations.
The Executive After-Action Review (AAR) is a board-ready document that summarizes exercise outcomes for senior leadership. It distills technical findings into strategic insights and actionable recommendations.
Document Structure
Executive Summary
A one-page overview covering:
- Exercise date, scenario, and participants
- Overall readiness score with benchmark comparison
- Top 3 strengths and top 3 areas for improvement
- Risk-adjusted business impact assessment
Exercise Overview
Details of the exercise configuration:
- Scenario description and threat actor profile
- Objectives and success criteria
- Participant roles and departments represented
- Duration and exercise format (facilitated vs. self-service)
Readiness Assessment
The 8-dimension readiness score presented as a radar chart with:
- Current scores per dimension
- Industry benchmark overlay
- Change from previous exercise (if applicable)
- Dimension-specific prescriptions
Key Findings
Findings are organized by severity and category. Each finding includes:
| Field | Description | |---|---| | Title | Concise description of the finding | | Severity | Critical, High, Medium, or Low | | Category | NIST 800-61 phase where the gap was observed | | Impact | Business impact if the gap persists in a real incident | | Recommendation | Specific remediation action with timeline |
Decision Analytics Summary
A condensed view of team performance:
- Aggregate decision quality scores by category
- Team alignment rating
- Confidence calibration assessment
- Leadership profile highlights (without naming individuals in the executive version)
Compliance Implications
Gaps mapped to relevant compliance frameworks with control references. This section helps leadership understand the regulatory exposure created by identified weaknesses.
Strategic Recommendations
Prioritized recommendations with:
- Estimated effort (low, medium, high)
- Estimated timeline (30, 60, or 90 days)
- Expected readiness score improvement if implemented
- Framework controls addressed
Generation
The Executive AAR is generated from the AAR Editor in the Ops Portal. The editor pre-populates findings, scores, and analytics from the exercise data. The ops team can refine language, adjust recommendations, and add context before publishing.
Export
Available as PDF with professional formatting, branded with the organization's logo. The document is designed for direct presentation to board members and executive committees.