The finding
A crisis has a shape. It climbs, it peaks, and then it is supposed to end. Teams rehearse the climb until it is reflex. The part where someone has to say it is over gets left to assumption.
In its 2025 resilience exercise series, published in March 2026, Health-ISAC ran seven tabletop exercises with member healthcare organizations and recorded twelve observations.
Two of them sit on the same nerve. The first names a tension in recovery, between restoring operations and meeting forensic and regulatory obligations. The instinct to get back to normal runs straight into the requirement to preserve. The second finds that clear incident-declaration processes are what make a response coordinated in the first place.
Put them together and a gap opens. Declaration runs in both directions. Teams rehearse declaring a crisis on. Almost no one rehearses declaring it off. And the recovery, where that second declaration lives, is the phase most exercises never reach, because the clock runs out at the peak.
It is not a story about a hard call made wrong. It is a story about a call nobody was assigned to make.
A crisis is not over when the pressure drops. It is over when someone owns saying so.
Coming down from a crisis is not the absence of work. It is a different set of choices, and most of them have never been made out loud.
Who declares the incident over. What comes back first, and in what order. What stays frozen because a forensic team or a regulator needs it untouched. When, and how, the outside is told it is finished.
Here is why they go unmade. On the way up, roles are obvious. The pressure assigns them, and command exists because the situation demands one. On the way down, the pressure lifts, and the thing that was assigning the roles lifts with it.
Operations waits for leadership to call it. Leadership assumes operations already has. That gap is where a response drifts to a stop instead of ending, and it is the failure cinten was built to surface. Not whether the plan lists a recovery phase, but whether anyone in the room knows the phase is now theirs.
The plan says recovery follows response. It does not say who owns the moment between them, or whether anyone believes it is theirs. That only shows when the exercise keeps running past the peak, into the part the script usually skips.
This is diagnostic, not predictive. cinten does not forecast who will hesitate on the day. It shows, decision by decision, whether anyone around the recovery knows the call is now theirs to make. On the record, not as a feeling in the room.
The change is small, and almost nobody makes it. Do not call time at the worst moment. Keep the exercise running until someone has to say it is over, and then keep it running into what saying so costs.
cinten does not stop the scenario at the peak. It carries the exercise into the recovery, where the decisions actually go unclaimed.
Assign the all-clear before the exercise starts. Give the recovery a person, not a paragraph.
The moment a response starts thinning without a decision becomes visible, and so does who, if anyone, calls it.
Practice declaring the crisis off until it is reflex, the same way the team already rehearses declaring it on.
Teams rehearse declaring a crisis on. Almost no one rehearses declaring it off.
Book a demo and see how cinten runs an exercise past the peak, surfaces the moment a response thins without a decision, and reads whether anyone in the room knows the stand-down is theirs to call.
One short essay a month on decision-making under pressure. No promotional emails, no recycled posts.