# Contingency Plan After-Action Report

**Template version:** 1.0.0 · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/reports/contingency-plan-after-action-report/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** Write this report after every contingency plan test and every real activation of the plan. Its sections follow the sample after-action reports in [NIST SP 800-84](https://csrc.nist.gov/pubs/sp/800/84/final) (September 2006, current as of September 2026): introduction, scope, objectives, scenario, findings and evaluation results. Assessors look for two things: that findings led to corrective actions, and that the lessons changed the plan, the training or the next test (CP-2g).

| System | Event | Date | Report author | Report date |
| --- | --- | --- | --- | --- |
| [Fill in: system name and identifier] | [Fill in: tabletop exercise, functional exercise or actual activation] | [Fill in: date] | [Fill in: name and title] | [Fill in: date] |

## 1. Introduction

[Fill in: what was tested or what happened, why, and who took part; reference the test plan for a test]

## 2. Scope

[Fill in: the components, sites, teams and plan sections involved]

## 3. Objectives and evaluation results

| Objective | Met? | Observed result |
| --- | --- | --- |
| [Fill in: objective from the test plan] | [Fill in: met, partly met or not met] | [Fill in: what happened, with times against the RTO and RPO where measured] |

## 4. Scenario and timeline

[Fill in: the scenario, or for a real event what happened]

| Time | Event or action |
| --- | --- |
| [Fill in: time] | [Fill in: event or action] |

## 5. Findings

### 5.1 General findings

[Fill in: overall observations, including what worked well]

### 5.2 Specific findings and recommendations

| ID | Finding | Recommendation | Owner | Due date | Tracking reference |
| --- | --- | --- | --- | --- | --- |
| [Fill in: ID] | [Fill in: finding] | [Fill in: recommended action] | [Fill in: role] | [Fill in: date] | [Fill in: plan of action and milestones item or ticket] |

## 6. Plan, training and test changes

The results were reviewed by [Fill in: who] on [Fill in: date] (CP-4b). These changes follow from them (CP-2e, CP-2g, CP-4c):

- **Contingency plan:** [Fill in: sections to update, or "none"]
- **Contingency training:** [Fill in: changes, or "none"]
- **Next test:** [Fill in: what the next test should cover]

## 7. Supporting data

[Fill in: logs, screenshots, restore times, sign-in sheets and other evidence, or where they are kept]

## 8. Approval

| Name | Title | Signature | Date |
| --- | --- | --- | --- |
| [Fill in: name] | [System owner] | | [Fill in: date] |