After-action reports from the last two tabletop exercises identified the same escalation gaps, yet the incident response plan has not changed since. What is the BEST action for the security manager?
Select an answer to reveal the explanation.
Short Explanation
An after-action report that nobody acts on is just a diary entry. You found the same hole twice, so the fix is owners, deadlines and a plan update, not another round of finding it. Watch for answers that keep testing instead of fixing.
Full Explanation
The purpose of testing is improvement: an exercise identifies weaknesses, and the after-action report must feed a corrective action process that updates the plan, procedures and training. When identical gaps recur, the failure is in follow-through rather than in detection, so the remedy is accountability. Assigning an owner and due date to each finding, updating the incident response plan accordingly and tracking actions to closure converts findings into change and gives management visibility of progress. Repeating the same exercise more frequently would likely surface the same gap a third time, because nothing in the plan or process has been altered. Switching to a full interruption test adds disruption and cost without addressing why known issues remain open; the format is not the problem. An independent audit assessment may be useful later, but the deficiency is already known and documented, so commissioning another assessment delays the fix and shifts attention away from management ownership. Exam caveat: when a stem says findings were identified but not acted on, look for the answer that closes the loop rather than the one that generates more findings. Operational check: confirm every finding has an owner, a target date and a status reported to management until verified as closed.