Start Building

Lesson 105: Post-Drill Remediation Ledger - Training Attestations and Micro-Drill Schedule After Lesson 104

Direct answer: A post-drill remediation ledger is the append-only workbook that consumes every sub-2 T-score from Lesson 104: each gap gets an owner, a due date, either a tooling change record or a training module id, a signed attestation hash from participants who missed the line, and a micro_drill_at_utc before your next Lesson 98 board slot—so drills become work orders, not embarrassment storage.

Why this matters now (2026 drill-to-fix pressure)

In 2026, teams run tabletop and red-team exercises more frequently, but remediation quality still drops when fixes compete with release deadlines in the same sprint. This lesson matters now because it converts drill outcomes into auditable, time-bound closure work instead of leaving weak scores in deck history.

Maintenance note (May 2026): this refresh clarifies same-sprint remediation pressure, where training completion and tooling changes must both tie to evidence hashes before the next executive readout.

Zoo illustration suggesting many owners each feeding their own enclosure after an inspection

What this lesson solves

Scorecards without follow-up are performance art. This ledger is how you prove you hardened the path red exposed.

Prerequisites: drill_id and scorecard PDF from Lesson 104, access to ticket and LMS exports, governance delegate to sign attestations. Expected time: about seventy minutes including a tabletop on “we will train later.”

What you will build

  1. lesson78_post_drill_remediation_ledger_policy.md (contract below)
  2. lesson78_post_drill_remediation_ledger.csv (one row per gap, not per person)
  3. A micro-drill calendar invite with synthetic DRILL:: fixtures refreshed

Step 1 - Define ledger gate classes

gate fail signal posture
P1 – Orphan score T-score below 2 without ledger row block next Lesson 104 annual run
P2 – Attestation theater LMS shows “completed” but hash mismatch fail audit
P3 – Slipped micro-drill micro_drill_at_utc moves twice without CAB escalate to audit chair
P4 – Duplicate work two rows fix same tool gap merge with supersede id

Step 2 - Author lesson78_post_drill_remediation_ledger_policy.md

Minimum sections:

  1. Purpose – bind findings to evidence of fix and proof of learning.
  2. Eligibility – every T1–T4 score below 2 requires a row; perfect scores still log remediation_kind=none for traceability.
  3. Training – modules must cite exact gate language (K/H/T) the user missed; short-answer quiz with hashed answer sheet.
  4. Tooling – link infra tickets; require staging replay before prod flag.
  5. Micro-drill – thirty to sixty minutes, subset of Lesson 104 scenarios; must produce new drill_evidence_hash.
  6. Linkage – optional capa_id_ref to Lesson 103 if regulator context overlaps.

Step 3 - Author lesson78_post_drill_remediation_ledger.csv

column purpose
remediation_id stable id
drill_id_ref Lesson 104
scenario_id_ref which T gate
score_recorded numeric
remediation_kind tooling / training / process
owner_id human
due_at_utc deadline
training_attestation_hash sha256 over LMS export row or quiz file
micro_drill_at_utc scheduled
micro_drill_drill_id_ref filled after rerun
remediation_evidence_hash sha256 over closure bundle

Step 4 - Operate the ledger (35 minutes)

  1. Import Lesson 104 CSV; filter t1_t4_scores below 2.
  2. Deduplicate tool gaps per P4.
  3. Assign owners with single-threaded accountability.
  4. Ship training; capture hashed completions.
  5. Schedule micro-drill inside forty-five days or before next board—whichever is sooner.
  6. Close rows only after micro-drill passes ≥ 2 on prior weak gates.

Step 5 - Tabletop - “training is optional reading”

Outcome: P2 failure—require proctored micro-quiz with photo-id check for override-capable roles.

Pro tips

  • Pair with analytics if weak T3 correlates with on-call fatigue metrics.
  • Rotate red cell during micro-drill to avoid rehearsed defenses.
  • Archive LMS exports beside Lesson 97 next quarter for continuity proof.

Troubleshooting

symptom likely cause fix
Rows explode scoring at person level aggregate to scenario
Micro-drill keeps failing fix not deployed gate prod release on staging hash
Owners swap re-org delegation row with delegation_evidence_hash

Common mistakes

  • Closing rows when only JIRA moved—need evidence on staging.
  • Skipping micro-drill because annual drill is “soon enough.”
  • Letting Lesson 101 products share one training module without product_code tags.

FAQ

What if the gap is “culture”?

Still open a process row with measurable behaviors (e.g., two-person rule on CMS publish).

Do executives train?

Yes on override paths if they can authorize Lesson 95.

Can we waive micro-drill?

Only with audit chair waiver id logged on the row.

Lesson recap

Remediation without a hash and a rerun is intent, not improvement.

Next lesson teaser

Next: Lesson 106: Escalation Governance Continuity Binder is the executive turnover PDF plus CSV—Lessons 92–105 map, archive URIs, roster deltas, first-week checklist, continuity_evidence_hash.

Related learning

Treat the ledger as warranty work, not punishment.