Blog
The decision nobody wrote down
A hospital tabletop this week found a call the room had already made and nobody had recorded. How to write plan-says versus room-did, the same way Cyber Storm X will write its after-action.
On 18 September 2026, CISA closed Cyber Storm X: four days, about 2,000 participants, more than 200 organisations, a nation-state scenario against rail, ports, and water systems. The next public artifact is an after-action report that will capture observations, analyses, and recommendations. Not a score. The same day, heise reported a hospital crisis simulation that Fraunhofer SIT ran at a Berlin conference of hospital IT managers: 23 people, 12 roles, injects with real names and networks, organisational rather than technical. Different scale. Same useful finding.
In the hospital room, someone asked about a measure the crisis team had already decided. Nobody had written it down. That is the gap most tabletops hide. The injects post covered how to force the decision. This is how to write what happened next without turning the packet into a grade.
What the hospital room actually found
Sebastian Schinzel and Nico Brüggemann from Fraunhofer SIT put 23 people into a fictional German hospital. The seats were the ones a real night would fill: IT, management, medical directorate, nursing, information security, crisis management. The attack started the way theirs usually do, with open-source research and a phish against an admin, then VPN, then Exchange, then failing hospital information, radiology, and lab systems, then an extortion letter. The exercise was not a restore test. It was a decision exercise with injects, including one that put a reporter at the door asking whether a cyberattack was underway, which systems were affected, and whether care was secured.
The escalation chain from admin through IT and the information security officer to the board, and the two early calls (do not pay, disconnect from the internet), held. What broke was quieter. The crisis team became a one-way street: information flowed in and almost never flowed back out. IT sat in the next room without the decisions. Internal comms got harder once email, chat, and phones were gone. And a decision that already existed could not be found when a senior physician asked for it.
Csilla Imre, playing the information security officer, put the roster finding in one line: it is better if several people start immediately than if everyone waits for the crisis operations manager to arrive. None of that is a pass or a fail. It is plan-says versus room-did.
Steal the after-action stance, not the 2,000-person roster
You will not run Cyber Storm. You can copy how CISA says it will write the result: observations, analyses, recommendations. The hospital run is the size of a company tabletop, and its findings are already in that shape. "The crisis team performed well" would have buried every one of them.
A weak gap reads:
Communication could be improved. The crisis team performed well.
A strong one reads:
Plan says incident command briefs the technical lead every 15 minutes. Room ran 47 minutes with Priya S in the next room and no brief. Isolate billing-db-02 was decided at T+22; at T+41 finance asked whether payroll was still posting, and nobody could find the note. | Dana K. | 2026-10-03
Both sentences can follow the same ninety minutes. Only the second is checkable by someone who was not in the room. The first costs you the finding: an assessor who reads two of those stops trusting the rest of the packet, the one-way street stays, and on a real night finance waits for an answer that already exists in someone else's head.
Four parts, or it is a feeling
Write every gap in the same shape:
- What the plan said. A named step, clock, or seat. If the plan is silent, write that the plan is silent. Silence is a finding about the plan.
- What the room did, with a time. Who spoke, who did not, which choice landed, what was still unknown.
- Who owns the fix. A person, not a team name.
- By when. A date. Follow-up is not a date.
That is the gaps field in our free evidence template, and it sits with three other formats in the template library. The template is built for this comparison because it is the comparison an assessor is trying to make and usually cannot. Give it to them already made. A sample packet shows the finished artifact.
Patterns worth capturing verbatim when they happen, because they are the hospital findings in company clothes:
- The crisis or incident-command room took information in and did not brief the technical lead.
- A decision was spoken and not written; a later inject asked for it and the room could not produce the note.
- The named commander was late, and the room waited instead of starting from the deputies the plan names.
- The room chose to turn everything off when the plan called for targeted isolation, or the other way around.
The scribe is a seat, not a courtesy. If nobody is assigned to minutes and the action list, the packet will be reconstructed from memory, and reconstructed packets are where "the crisis team performed well" comes from. Treat an empty scribe seat the way the invite-list post treats any other empty required seat: write it down and reassign if you must. If the written plan cannot name that seat, the free plan self-check will surface it before you book the room.
A packet that records plan-says versus room-did does not prove the isolate button works, that last night's backup of billing-db-02 restores, or that any reporting rule is satisfied. It proves named people practised a choice and you kept a checkable record of the gap. Keep restore proof on the DR-test path. The record's job is the comparison, not a compliance verdict.
Hand the observations on
CISA will publish its after-action. Fraunhofer SIT writes a final report for the hospital and is recruiting more sites so the findings compound. Your packet does the same job at your scale: scenario, attendance including empty seats, timed decisions, gaps in the plan-says versus room-did shape, follow-ups with owners. No score. No green check.
Hand that record to whoever owns assurance. They decide whether it meets their sampling for the period. That separation is how a 23-person hospital room and a 2,000-person national exercise stay credible: they report what happened, and they leave the grade to someone else.
Bottom line: write what the plan said and what the room did, with a clock and an owner. A feeling about communication is not a finding. An unwritten decision is.