Handoff Package
Definition
The bundle of information an analyst prepares before transferring an incident to a higher tier. Contents include incident ID, timeline, severity, containment actions taken, evidence collected, affected assets, and running SLA timers. Incomplete handoffs force the receiving analyst to reconstruct context already captured.
- Purpose
- Transfer incident context between analyst tiers
- Includes
- Incident ID, timeline, severity
- Also includes
- Containment actions, evidence collected, affected assets
- Also tracks
- Running SLA timers
Common questions
Why does a handoff package need to carry SLA timer status specifically?+
Escalation and resolution service levels typically run from the initial incident open time, so the receiving analyst needs to know how much time has already elapsed to prioritise correctly rather than restarting a mental clock at zero.
What is the practical cost of a poorly assembled handoff package?+
The receiving tier loses time re-deriving the timeline and containment status from raw logs, which delays response during exactly the phase of an incident where speed matters most.
Is a handoff package only used when escalating to a higher tier?+
It is most associated with tier escalation, but the same structured content is useful whenever an incident changes hands, including shift changes or handoffs to an external responder.
Related terms
- Contact Tree
- A structured list of individuals and teams to notify during an incident, showing the order of contact and the conditions under which...
- Escalation Criteria
- The documented conditions that require an analyst to transfer an incident to a higher tier or to external stakeholders. Examples include: severity...
- P1/P2/P3/P4 Severity Tiers
- A common four-level severity classification used in SLA structures. P1 (Critical) carries the shortest time windows; P4 (Low) carries the longest. The...
- Service-Level Agreement (SLA)
- A policy or contractual commitment defining how quickly the SOC must perform specific actions (acknowledge, escalate, contain, resolve) for incidents of each...
- SLA Breach
- An instance where a required action was not completed before its SLA timer expired. Each breach is recorded against the incident ticket...