What Debrief means
Debrief is the directive most organisations skip, and it's usually the one that costs them most. An incident or a tabletop exercise happens, everyone's relieved it's over, and the lessons that should reshape the next Decide quietly evaporate. Debrief makes that review a formal, repeatable step: what actually happened, what worked, what didn't, and what specifically will change as a result.
This directive covers both real incidents and simulated ones. A tabletop exercise that never produces a written list of changes isn't training, it's theatre. Genuine resilience comes from treating every test the same way you'd treat a real event — with a debrief that has teeth.
The board question
What your board should be able to answer at this stage
“Did anything actually change after our last incident, or our last test?”
In practice
What good looks like
- Every incident, near-miss, and exercise produces a written record of what changed as a result
- Backup and recovery plans have actually been tested, not just documented
- Business continuity plans reflect how the organisation actually operates today
- Lessons from one incident visibly show up in the next Decide and Direct cycle
Where this shows up