1
00:00:00,279 --> 00:00:03,548
Hello, and welcome to another episode of the

2
00:00:03,548 --> 00:00:04,425
prepared Podcast,

3
00:00:04,903 --> 00:00:07,853
I'm your host, Rob Button, and just before

4
00:00:07,853 --> 00:00:10,020
we get started today. Here's a word from

5
00:00:10,020 --> 00:00:11,534
our sponsors un unsolved.

6
00:00:13,047 --> 00:00:15,039
Physical threats such as severe weather,

7
00:00:15,676 --> 00:00:18,305
infrastructure failures and civil unrest are increasing in...

8
00:00:18,638 --> 00:00:20,488
Severity and frequency, forcing

9
00:00:20,941 --> 00:00:23,983
organizations and government agencies alike to prepare for

10
00:00:24,198 --> 00:00:24,595
unpredictability.

11
00:00:25,309 --> 00:00:28,010
That's why only on solve technology is committed

12
00:00:28,010 --> 00:00:30,442
to to helping security and risk professionals

13
00:00:30,981 --> 00:00:33,778
identify threats quickly and manage response holistically.

14
00:00:34,497 --> 00:00:38,579
On unsolved combines artificial intelligence Ai, powered threat

15
00:00:38,579 --> 00:00:41,999
detection, real time and historical, with mass notification,

16
00:00:42,397 --> 00:00:45,260
incident management capabilities, and travel risk management,

17
00:00:45,674 --> 00:00:47,371
to form the industry's most comprehensive

18
00:00:47,749 --> 00:00:48,308
unified platform,

19
00:00:48,946 --> 00:00:51,820
1 that helps organizations identify critical events faster,

20
00:00:52,618 --> 00:00:55,187
analyze risks more accurately, and shorten the time

21
00:00:55,187 --> 00:00:55,746
to respond.

22
00:00:56,783 --> 00:01:00,215
From anticipating risks to detection and recovery, on

23
00:01:00,215 --> 00:01:03,419
soft technology and their experienced team support over

24
00:01:03,419 --> 00:01:04,237
30000

25
00:01:04,451 --> 00:01:07,311
organizations across the globe through every step of

26
00:01:07,311 --> 00:01:08,184
a critical event.

27
00:01:12,890 --> 00:01:15,930
Welcome to the prepared x podcast. Your complete

28
00:01:15,930 --> 00:01:19,530
source for crisis, emergency business continuity and security

29
00:01:19,530 --> 00:01:22,263
preparedness interviews, news, and mud more.

30
00:01:24,736 --> 00:01:27,687
Now your host. He creates chaos for a

31
00:01:27,687 --> 00:01:28,006
living,

32
00:01:28,564 --> 00:01:29,064
Rob.

33
00:01:30,957 --> 00:01:34,498
Welcome to so 139

34
00:01:34,714 --> 00:01:36,806
of the prepaid prepared podcast

35
00:01:37,977 --> 00:01:40,308
titled Cyber defense frontline

36
00:01:40,683 --> 00:01:41,081
Crafting.

37
00:01:41,972 --> 00:01:46,274
The ultimate incident response tabletop top exercises. Welcome

38
00:01:46,274 --> 00:01:49,222
back. Took a short break there over about

39
00:01:49,222 --> 00:01:50,576
a month over the summer here.

40
00:01:51,626 --> 00:01:52,024
To

41
00:01:52,501 --> 00:01:54,411
both work, but also take a couple of

42
00:01:54,411 --> 00:01:56,877
days off with the family. So it's really

43
00:01:56,877 --> 00:01:57,377
good

44
00:01:57,832 --> 00:01:59,662
to be back and back into it and

45
00:01:59,662 --> 00:02:02,006
we'll be going back to our usual 2

46
00:02:02,063 --> 00:02:04,051
podcasts per month is

47
00:02:04,687 --> 00:02:07,152
our usual plan. So looking forward to jumping

48
00:02:07,152 --> 00:02:09,078
back into it. So this 1, it's all

49
00:02:09,078 --> 00:02:11,869
about cyber instant response tabletop exercises I think,

50
00:02:12,428 --> 00:02:14,342
we've been through this before. We follow a

51
00:02:14,342 --> 00:02:16,814
very similar process to our other tabletop top

52
00:02:16,814 --> 00:02:19,537
exercises. Of course, we we move more in

53
00:02:19,537 --> 00:02:21,760
the direction of the incident response as it

54
00:02:21,760 --> 00:02:24,620
relates to instant response planning as it relates

55
00:02:24,620 --> 00:02:28,606
to some elements of technical components of your

56
00:02:28,606 --> 00:02:30,773
cyber response, so we'll touch on

57
00:02:31,147 --> 00:02:33,370
those types of, pieces that we're gonna bring

58
00:02:33,370 --> 00:02:35,752
in to the exercise from your tech teams,

59
00:02:36,483 --> 00:02:37,359
and those components.

60
00:02:37,996 --> 00:02:39,988
Are we gonna make it tech technology heavy?

61
00:02:40,545 --> 00:02:41,979
Depends on the team. Do we need to

62
00:02:41,979 --> 00:02:44,528
add some element of communication in there if

63
00:02:44,528 --> 00:02:46,771
we're bringing in the instant response team from

64
00:02:46,771 --> 00:02:49,474
a com standpoint is a leadership team. What

65
00:02:49,474 --> 00:02:50,985
is the makeup of the team? All those

66
00:02:50,985 --> 00:02:51,724
good things

67
00:02:52,098 --> 00:02:54,166
should come out in your planning stage, which

68
00:02:54,166 --> 00:02:56,094
we're gonna come onto to. So anyway, the

69
00:02:56,094 --> 00:02:58,592
first step and really, most importantly

70
00:02:59,610 --> 00:03:01,688
is really to get organized. And you'll hear

71
00:03:01,688 --> 00:03:03,686
me talk about it in no matter exercise

72
00:03:03,686 --> 00:03:04,665
we plan for

73
00:03:05,536 --> 00:03:07,364
really say in the stage. So what are

74
00:03:07,364 --> 00:03:08,874
we doing? Why are we here? Why are

75
00:03:08,874 --> 00:03:10,805
we ring this instant response tabletop

76
00:03:11,179 --> 00:03:12,928
exercise? You could have a good reason and

77
00:03:12,928 --> 00:03:14,063
often you will

78
00:03:14,613 --> 00:03:16,288
often, you, obviously, if from I'm a if

79
00:03:16,288 --> 00:03:18,123
you're in a regulated environment, you gotta do

80
00:03:18,123 --> 00:03:20,994
it from a a regulatory perspective. Of course,

81
00:03:21,393 --> 00:03:24,596
instant response is essential to your response to

82
00:03:24,596 --> 00:03:27,058
a cyber attack, and so with those organizations,

83
00:03:27,217 --> 00:03:29,226
which is the vast majority of us now

84
00:03:29,600 --> 00:03:32,244
are susceptible in some way shape or form

85
00:03:32,380 --> 00:03:34,696
to to some kind of ransom wear, some

86
00:03:34,696 --> 00:03:37,712
kind of other technical event that may impact

87
00:03:37,712 --> 00:03:39,990
us. And so, you know, preparing for that

88
00:03:40,347 --> 00:03:43,472
scenario planning is essential. So craft those objectives

89
00:03:43,529 --> 00:03:45,279
why are we here? What are we doing?

90
00:03:45,518 --> 00:03:47,920
What are we looking to accomplish with by

91
00:03:47,920 --> 00:03:48,977
going through this

92
00:03:49,352 --> 00:03:52,297
process. So that's really, really important in the

93
00:03:52,297 --> 00:03:54,286
early stages. Part of the planning as well.

94
00:03:54,446 --> 00:03:55,798
And again, you know, we can be broken

95
00:03:55,798 --> 00:03:58,525
down is to a separate component, but, it's

96
00:03:58,525 --> 00:04:00,062
to start to look at those

97
00:04:00,520 --> 00:04:02,435
different issues that you want to look at

98
00:04:02,435 --> 00:04:05,083
specific to the... Your organization. So what of

99
00:04:05,083 --> 00:04:06,918
those scenarios that are gonna impact you the

100
00:04:06,918 --> 00:04:09,071
the most, how are they gonna unfold. So

101
00:04:09,071 --> 00:04:11,145
work with your tech technology teams, not all

102
00:04:11,145 --> 00:04:13,937
of them. If they're participating, work with 1

103
00:04:13,937 --> 00:04:15,544
or 2 of them. And try and find

104
00:04:15,544 --> 00:04:18,009
out how this will start to unfold and

105
00:04:18,009 --> 00:04:19,758
make your day a bad 1 to make

106
00:04:19,758 --> 00:04:22,834
the whole organization's day, a bad 1. So

107
00:04:22,954 --> 00:04:25,044
think about the impacts, think about the systems

108
00:04:25,578 --> 00:04:28,122
that could be, taken down. How would that

109
00:04:28,122 --> 00:04:29,632
happen? What it would it look like to

110
00:04:29,632 --> 00:04:32,336
you what's the general timeline of that happening,

111
00:04:32,907 --> 00:04:34,415
what are the impacts of and what of

112
00:04:34,415 --> 00:04:37,670
your customers seeing potentially, but certainly, what are

113
00:04:37,670 --> 00:04:40,528
your employees experiences as well when these things

114
00:04:40,528 --> 00:04:42,928
start to unfold. So, You can roughly draft

115
00:04:42,928 --> 00:04:45,315
that out in this initial planning stages as

116
00:04:45,315 --> 00:04:45,815
well

117
00:04:46,269 --> 00:04:48,815
before jumping in and adding the details into

118
00:04:48,815 --> 00:04:51,137
the scenario, which we'll talk about now. So

119
00:04:51,137 --> 00:04:53,603
once you've got that draft overview together, what

120
00:04:53,603 --> 00:04:55,194
you want to do is then put some

121
00:04:55,194 --> 00:04:57,422
details around, you know, how this is gonna

122
00:04:57,422 --> 00:04:57,581
unfold.

123
00:04:58,313 --> 00:05:00,068
Usually go... Keep it simple to start off

124
00:05:00,068 --> 00:05:01,924
with, go through the initial unfolding

125
00:05:02,301 --> 00:05:03,896
situation. So that might be the first day,

126
00:05:04,534 --> 00:05:06,688
you're experiencing this or you certainly find out

127
00:05:06,688 --> 00:05:07,565
that you're experiencing this.

128
00:05:08,455 --> 00:05:09,568
And then go on to the next period.

129
00:05:09,807 --> 00:05:11,556
Again, that might be 1 another day, it

130
00:05:11,556 --> 00:05:13,544
may be it's several other days. How how

131
00:05:13,544 --> 00:05:14,975
bad you want to make it. Right? So

132
00:05:14,975 --> 00:05:17,958
think about that, it in terms of your

133
00:05:18,016 --> 00:05:19,849
scenario. So if you wanna make it a

134
00:05:19,849 --> 00:05:21,443
5 day event. So how are we gonna

135
00:05:21,443 --> 00:05:22,877
do that. We need to flush you out

136
00:05:22,877 --> 00:05:23,377
further

137
00:05:23,689 --> 00:05:25,840
in terms of us struggling to get back

138
00:05:25,840 --> 00:05:26,079
online,

139
00:05:26,716 --> 00:05:29,186
you know, the ransom web component to it

140
00:05:29,186 --> 00:05:31,735
obviously bringing in all the other key role

141
00:05:31,735 --> 00:05:34,851
players for the instant risk response standpoint, So

142
00:05:34,851 --> 00:05:36,065
making sure that they're

143
00:05:36,517 --> 00:05:38,977
participating as well. So including that in your

144
00:05:38,977 --> 00:05:39,374
scenario,

145
00:05:39,850 --> 00:05:42,089
you know, all the legal components you know,

146
00:05:42,168 --> 00:05:43,684
the other elements that are gonna,

147
00:05:44,082 --> 00:05:45,598
be, you know, brought to your knees in

148
00:05:45,598 --> 00:05:48,468
terms of a technical component. All the you

149
00:05:48,468 --> 00:05:51,180
know, supporting our organizations are gonna come along

150
00:05:51,180 --> 00:05:52,305
this, critical vendors.

151
00:05:53,098 --> 00:05:54,763
They're gonna come along with support you. Are

152
00:05:54,763 --> 00:05:56,666
they involved in the exercise, or you're just

153
00:05:56,666 --> 00:05:58,568
gonna talk about them in the exercise. So

154
00:05:58,568 --> 00:06:00,575
again, all this can be flushed out when

155
00:06:00,575 --> 00:06:02,411
you are designing your,

156
00:06:03,049 --> 00:06:03,927
scenario. So, again,

157
00:06:04,645 --> 00:06:06,974
making it a difficult day is certainly something

158
00:06:06,974 --> 00:06:08,812
you want today you want to do. Because,

159
00:06:08,972 --> 00:06:11,609
again, this is crisis management. This is instant

160
00:06:11,609 --> 00:06:13,926
response. So, you know, you may... You don't

161
00:06:13,926 --> 00:06:16,338
wanna make it over something overly difficult, of

162
00:06:16,338 --> 00:06:18,495
course, because we want those leaders and we

163
00:06:18,495 --> 00:06:20,572
want those participants to come back and do

164
00:06:20,572 --> 00:06:23,064
further training and exercises in the future. You

165
00:06:23,064 --> 00:06:24,342
need to obviously make it a bad day

166
00:06:24,342 --> 00:06:27,538
that's relevant and realistic to, your environment.

167
00:06:28,657 --> 00:06:30,095
So once you put all that together and

168
00:06:30,095 --> 00:06:32,097
if... Course, we want to deliver, and, hopefully,

169
00:06:32,256 --> 00:06:34,640
you've organized this ahead of time. So in

170
00:06:34,640 --> 00:06:36,229
terms of the delivery, make sure you got

171
00:06:36,229 --> 00:06:39,265
that that's a seasoned of course facilitate to

172
00:06:39,265 --> 00:06:41,651
facilitate that process. That's it's really important, especially

173
00:06:41,651 --> 00:06:43,719
if you've got leaders in the room for

174
00:06:43,719 --> 00:06:45,071
a couple of hours. You don't wanna be

175
00:06:45,071 --> 00:06:47,712
wasting their time, wanna have a professional event

176
00:06:47,712 --> 00:06:49,941
but organized. If there's hand outs, there's hand

177
00:06:49,941 --> 00:06:51,932
outs. If you're breaking the teams down to

178
00:06:51,932 --> 00:06:53,524
different groups where they're gonna go while they're

179
00:06:53,524 --> 00:06:55,451
gonna discuss. You you know, you've got different,

180
00:06:55,930 --> 00:06:57,685
you know, inject for different,

181
00:06:58,403 --> 00:07:00,317
areas of the business, so you got some

182
00:07:00,317 --> 00:07:02,231
legal information for the legal folks. So are

183
00:07:02,231 --> 00:07:03,507
they gonna go and work on it. Are

184
00:07:03,507 --> 00:07:04,799
you gonna keep them in the in room.

185
00:07:05,039 --> 00:07:07,197
So lots of things to think about in

186
00:07:07,197 --> 00:07:09,514
terms of delivery preparing that team as well?

187
00:07:09,834 --> 00:07:11,272
Have you sent them a brief ahead of

188
00:07:11,272 --> 00:07:13,510
time in the planning stages? We usually send

189
00:07:13,510 --> 00:07:14,899
their pre read video

190
00:07:15,272 --> 00:07:18,209
to get those participants ready for the exercise.

191
00:07:18,368 --> 00:07:20,432
So, lot you can been doing there. So

192
00:07:20,432 --> 00:07:22,576
challenging in the delivery, the decision making and

193
00:07:22,576 --> 00:07:22,790
obviously

194
00:07:23,386 --> 00:07:25,057
communications, being a big part of it as

195
00:07:25,057 --> 00:07:26,886
well. And, of course, if it's more technical

196
00:07:26,886 --> 00:07:28,954
focus, you know, we're gonna be talking about

197
00:07:28,954 --> 00:07:29,772
all those technical

198
00:07:30,560 --> 00:07:33,422
components and the different issues that the technical

199
00:07:33,422 --> 00:07:35,330
team's is gonna be faced with as it

200
00:07:35,330 --> 00:07:37,930
relates to the specifics around the scenario. So

201
00:07:38,129 --> 00:07:39,882
Again, you may have both of those scenarios

202
00:07:39,882 --> 00:07:41,316
running. We we have 1 client right now

203
00:07:41,316 --> 00:07:43,547
where we're doing technology on day 1. Either

204
00:07:43,547 --> 00:07:45,300
way we roll it day 2 for the...

205
00:07:45,951 --> 00:07:47,300
Leadership and it works quite well because we're

206
00:07:47,300 --> 00:07:49,045
obviously learn a lot from day 1. We

207
00:07:49,045 --> 00:07:50,077
can adjust slightly.

208
00:07:50,791 --> 00:07:52,457
So this scenario into day 2 and have

209
00:07:52,457 --> 00:07:55,569
those key discussions, on some of those findings.

210
00:07:55,728 --> 00:07:58,351
So lots to do on delivery. A partnered

211
00:07:58,351 --> 00:08:00,894
of delivery as well is that evaluation component

212
00:08:00,894 --> 00:08:01,584
really. So

213
00:08:02,341 --> 00:08:04,887
step 3 here really is the evaluation and

214
00:08:04,887 --> 00:08:06,877
making sure we can pull all that information

215
00:08:06,877 --> 00:08:09,821
in. So as you're having your discussions, how

216
00:08:09,821 --> 00:08:12,305
we we evaluating the x exercise. Is it

217
00:08:12,305 --> 00:08:14,774
based on our plans, our procedures? Is it

218
00:08:14,774 --> 00:08:18,200
based on other elements that we, have, built

219
00:08:18,200 --> 00:08:19,014
into to our,

220
00:08:20,292 --> 00:08:21,271
evaluation, protocols,

221
00:08:21,730 --> 00:08:22,689
our evaluation,

222
00:08:23,408 --> 00:08:24,468
assessment processes,

223
00:08:24,846 --> 00:08:26,500
you know, how are we meeting those

224
00:08:27,178 --> 00:08:28,695
again, you can get into a lot of

225
00:08:28,695 --> 00:08:31,009
detail as it relates to your evaluation. But,

226
00:08:31,089 --> 00:08:33,085
you know, really, it links back to, plans.

227
00:08:33,244 --> 00:08:35,160
And I I use use 1 example,

228
00:08:35,732 --> 00:08:37,664
and let's use it from an instant response

229
00:08:37,880 --> 00:08:39,868
activation of the team. So your plan makes

230
00:08:39,868 --> 00:08:40,823
what say 1 thing,

231
00:08:41,539 --> 00:08:43,686
but from an evaluation standpoint. So, you know,

232
00:08:43,766 --> 00:08:46,247
that... Something else actually happens or is discussed

233
00:08:46,247 --> 00:08:47,838
differently to what's in the plan,

234
00:08:48,475 --> 00:08:50,305
what happens in real life. So again, you

235
00:08:50,305 --> 00:08:52,691
know, that's the evaluation there. It's not matching

236
00:08:52,691 --> 00:08:56,146
up. It in terms of, that process. So

237
00:08:56,202 --> 00:08:57,949
the adjustment would need to take place in

238
00:08:57,949 --> 00:09:00,252
your after actual report afterwards. So... And again,

239
00:09:00,332 --> 00:09:01,523
there are other elements that you want to

240
00:09:01,523 --> 00:09:03,763
test in your plans And again, that links

241
00:09:03,763 --> 00:09:05,218
back to your evaluation

242
00:09:06,388 --> 00:09:06,888
protocols.

243
00:09:08,138 --> 00:09:09,808
So really important that we evaluate. And of

244
00:09:09,808 --> 00:09:11,240
course, at the end of the exercise, we...

245
00:09:11,494 --> 00:09:14,128
Be gathering all the information from all the

246
00:09:14,128 --> 00:09:17,002
participants, and it's really important that's, of, of

247
00:09:17,002 --> 00:09:18,540
course, we put a comprehensive

248
00:09:18,918 --> 00:09:21,567
after action report together, gonna just like we're

249
00:09:21,567 --> 00:09:24,278
doing other exercises is really important that that

250
00:09:24,278 --> 00:09:24,778
report

251
00:09:25,235 --> 00:09:27,548
identifies what everyone's discussed in terms of their

252
00:09:27,548 --> 00:09:30,594
findings. Again, everything comes from the participants. You

253
00:09:30,594 --> 00:09:32,829
know, they find out what's going on, they

254
00:09:32,829 --> 00:09:34,903
find out what's wrong in terms of the...

255
00:09:35,302 --> 00:09:36,920
In in terms of their experiences

256
00:09:37,617 --> 00:09:39,704
in the tabletop topic. Exercise and even in

257
00:09:39,704 --> 00:09:41,319
real life as well. So you're documenting

258
00:09:41,775 --> 00:09:44,164
all of that during the exercise, it's really

259
00:09:44,164 --> 00:09:46,234
important because sometimes when we get together and

260
00:09:46,234 --> 00:09:48,485
have our meetings, in a general setting and

261
00:09:48,485 --> 00:09:50,884
have a general discussion, we really don't identify

262
00:09:50,884 --> 00:09:53,764
opportunities for improvement. That's the main purpose behind

263
00:09:53,764 --> 00:09:57,139
running after running a tabletop top exercises and

264
00:09:57,139 --> 00:09:59,856
put you after action reports together. So gathering

265
00:09:59,856 --> 00:10:01,934
those observations, this is what we found and

266
00:10:01,934 --> 00:10:04,331
then adding a recommendation. This is what we

267
00:10:04,331 --> 00:10:06,975
recommend based on those findings and documenting those

268
00:10:06,975 --> 00:10:09,833
in your after action report really, really important.

269
00:10:09,992 --> 00:10:10,548
And, of course,

270
00:10:11,341 --> 00:10:13,539
part of that as well, is once you've

271
00:10:13,738 --> 00:10:15,965
had that report approved everyone signed off on

272
00:10:15,965 --> 00:10:18,511
it in terms of those findings, then you

273
00:10:18,511 --> 00:10:21,215
put the remediation plan together. So we found

274
00:10:21,215 --> 00:10:22,661
everything and they have to act and report

275
00:10:22,661 --> 00:10:25,304
the observations and recommendations. Now we put those

276
00:10:25,519 --> 00:10:28,615
recommendations into remediation plan. Who's responsible for doing

277
00:10:28,615 --> 00:10:30,997
what bioware when in terms of those improvements,

278
00:10:31,235 --> 00:10:33,089
shouldn't whether it's a a update of a

279
00:10:33,089 --> 00:10:33,570
policy,

280
00:10:34,529 --> 00:10:37,409
update of procedure, like some capability that's missing

281
00:10:37,409 --> 00:10:39,409
that we need to add into the planning,

282
00:10:39,982 --> 00:10:41,887
whatever it may be, that mediation plan needs

283
00:10:41,887 --> 00:10:43,713
to have those details and how you're gonna

284
00:10:43,713 --> 00:10:44,110
accomplish,

285
00:10:44,745 --> 00:10:44,983
you know,

286
00:10:46,412 --> 00:10:48,259
modification of the plan, all those other things

287
00:10:48,259 --> 00:10:49,937
that are in there. So at that plan

288
00:10:49,937 --> 00:10:51,695
that remediation plan needs to be put together,

289
00:10:51,935 --> 00:10:54,892
and again, distributed those individuals who are gonna

290
00:10:54,892 --> 00:10:56,430
be responsible for

291
00:10:57,461 --> 00:10:59,847
you know, for, carrying out the remediation plan.

292
00:11:00,165 --> 00:11:01,676
And that may last 3 months it may

293
00:11:01,676 --> 00:11:03,902
last 6 months depending on how detailed you

294
00:11:03,902 --> 00:11:06,778
get in terms of for, those remediation items.

295
00:11:07,016 --> 00:11:08,603
But again, you know, you need to have

296
00:11:08,603 --> 00:11:10,191
a plan and you need to be to

297
00:11:10,191 --> 00:11:12,573
act on it after the exercise,

298
00:11:13,463 --> 00:11:15,215
So, you know, very high level,

299
00:11:15,852 --> 00:11:18,003
and it went to, not too much detail,

300
00:11:18,083 --> 00:11:20,552
but planning obviously, is the initial part of

301
00:11:20,552 --> 00:11:22,719
it putting your exercise together the object. Tips

302
00:11:22,719 --> 00:11:23,518
all that good stuff,

303
00:11:24,238 --> 00:11:25,617
delivery really important

304
00:11:26,236 --> 00:11:28,553
that we have a facilitator who's done this

305
00:11:28,553 --> 00:11:30,471
before, or you got someone who's confidence standing

306
00:11:30,471 --> 00:11:32,483
for of those leaders to make sure that

307
00:11:32,483 --> 00:11:34,717
we're delivering and we're challenging those decision making

308
00:11:34,717 --> 00:11:38,146
and communication elements. Of course, the evaluation and,

309
00:11:38,545 --> 00:11:41,337
the the report writing and remediation are those

310
00:11:41,337 --> 00:11:42,110
steps that come

311
00:11:42,547 --> 00:11:44,377
you know, after that. So, you know, really,

312
00:11:44,696 --> 00:11:45,093
really

313
00:11:45,571 --> 00:11:47,640
important that you have a thorough process as

314
00:11:47,640 --> 00:11:50,527
you're designing your after... I... All your tabletop

315
00:11:50,823 --> 00:11:51,323
exercises

316
00:11:51,634 --> 00:11:54,127
and you're conducting your after action report and

317
00:11:54,265 --> 00:11:56,998
remediation planning, which is really the main element

318
00:11:57,215 --> 00:12:00,460
at the end of the whole process. So

319
00:12:00,817 --> 00:12:01,931
hope you enjoyed this 1.

320
00:12:02,964 --> 00:12:04,873
Episode 01:39.

321
00:12:05,509 --> 00:12:07,179
If you did, please share it with your

322
00:12:07,179 --> 00:12:09,167
network, and we look forward to seeing you

323
00:12:09,167 --> 00:12:10,383
on the next

324
00:12:11,730 --> 00:12:12,528
podcast. Take care.