Incident handoff template after containment

Overview

When primary on-call hands off to SOC, IR firm, or another technician, ambiguity causes dropped tasks. Use a structured handoff.

Handoff fields (minimum)

1. Incident ID and customer name, timezone, contract tier.
2. Timeline of first detection → containment actions (with UTC timestamps).
3. Affected systems and user accounts; isolation status.
4. Preserved evidence locations (image hash, MDE incident link, log exports).
5. Open hypotheses and ruled-out lines of inquiry.
6. Customer communication status: who was notified, what was promised, next update time.
7. Legal/insurance touchpoints if applicable.

Verbal + written

Repeat critical facts; paste template into ticket and Teams channel for the receiving team.

Verification

Receiving engineer acknowledges checklist completeness before primary goes off-call.

Post-handoff

Schedule 15-minute overlap for complex ransomware or regulated data cases.