After a tabletop exercise, the report notes the security analyst called the wrong legal contact, the PR lead was not included, and the on-call engineer was not paged until two hours later. The CISO asks what reporting action best improves incident response readiness. Which action should the analyst take?

Tabletop exercise reports exist to convert simulated failures into concrete readiness improvements. When communication and coordination gaps are identified, the reporting action should close the gap by updating incident response playbooks, escalation matrices, contact lists, and notification rules so real incidents follow corrected paths. This is a reporting and communication objective: the report is not merely a record; it drives process change. Escalating findings and requesting a policy exception is wrong because the issue is not a policy conflict requiring an exception, it is an operational communication defect that should be fixed in the response process. Creating a vulnerability management report template is wrong because legal and PR approval timing for remediation tickets belongs to vulnerability management workflow, not incident response coordination gaps from a tabletop. Scheduling another exercise without changing procedures is wrong because repeating the same test without remediation preserves known gaps and does not improve readiness. Exam caveat: choose the action that feeds exercise findings back into response documentation and escalation procedures. Operational check: review the current IR playbook and confirm that legal, PR, on-call engineering, and management contacts are listed with paging criteria and alternate contacts.