Turning training records into evidence: certificates, scores and after-action reports

Sooner or later someone outside the security team asks for proof: an auditor, the board, an insurer or a regulator. Training produces plenty of records. Turning them into evidence that answers the question being asked takes a little planning.

What does each training type leave behind?

• Labs leave completion records per person and skill, and on some platforms certificates. Cyberbit states that four RangeForce certificate programmes were accredited by ANAB under ANSI/ASTM E2659 in July 2026, each ending in a hands-on capstone and aligned to DoD DCWF work roles.
• Ranges leave team results: what was detected, when, and what was missed. Immersive Labs describes benchmarked evidence of readiness and a Resilience Score.
• Crisis exercises leave an after-action report. Reflex Security describes reports in which every finding traces to the moment in the simulation it came from, mapped to SOC 2, ISO 27001 and DORA, and to MITRE ATT&CK techniques and NIST CSF functions. Hack The Box's Crisis Control ends with a Golden Report, an action roadmap and technical annexes. TryHackMe describes audit-ready reports aligned to NIST and ISO 27035. iluminr describes board-ready dashboards and evidence for frameworks including DORA, ISO 22301 and APRA CPS 230.
• Awareness training leaves completion and phishing simulation results.

What do auditors and boards look for?

Usually three things: that the exercise or training happened, that it found something, and that what it found was fixed. Attendance alone answers the first. The second and third are where most evidence packs fall short.

For US public companies there is a further reason to keep good records. Since the SEC adopted its cybersecurity disclosure rules on 26 July 2023, Regulation S-K Item 106 requires an annual description of cybersecurity risk management processes and board oversight. Exercise records are one of the few artefacts that show those processes being used.

How do you make evidence useful?

Structure every record around a gap, a fix and a retest.

1. The gap: what the exercise or lab showed, in one sentence, with the moment or metric it came from.
2. The fix: what changed, who owns it and by when.
3. The retest: when the gap was exercised again and what happened.

An after-action report that lists twenty observations with no owners is weaker evidence than one that lists five with owners and dates. CISA's free tabletop packages include an after-action report template, which is a reasonable starting structure if your platform does not produce one.

Should evidence map to frameworks?

It helps, as long as the mapping is honest. A finding mapped to the control it affects saves the auditor time. Be wary of mapping everything to everything; a short, accurate mapping is more credible than a long one.

How long should you keep it?

Long enough to show a trend: at least the last few cycles of each training type. A sequence of exercises in which the same gap closes is better evidence than any single report.

What next?

The next lesson asks whether one platform should cover several training types, or whether you should combine specialists.