Documentation standards

About 18 min read

Three standards that matter most

Three standards do most of the work, and they fail in different ways. Format failures are visible immediately: a reviewer opens the record and cannot find the timeline. Clarity failures surface later, when the record is read by someone who was not in the room and the ambiguity has nobody left to resolve it. Timeliness failures are the quietest and the most damaging, because the record looks complete; it is simply wrong in the details nobody can check anymore. If the team can enforce only one of the three, enforce timeliness: format and language can be repaired at review, but detail that was never captured is gone.

Format and structure

All documentation should follow a standardized template that gives every reader the same frame of reference, regardless of background or role. This uniformity allows clear, reliable records that can be referenced across cases, departments, or review cycles. Templates must be version-controlled, accessible, and regularly updated.

Two terms keep the rest of this chapter precise. The case record is the living entry in the case-management system, updated at every phase transition. The event report is the closure artifact assembled from it at close. The record is written throughout; the report is what it becomes.

A complete event report opens with a decision header and then carries nine core sections, each with a distinct purpose. They are not equally weighted. The timeline (02) and origin and scope (03) carry the investigation: they are what a future analyst reads when the same adversary comes back. Business impact (05) and lessons learned (07) carry the organization: they are what leadership and auditors actually read, and they are the two sections most often left thin because they are the hardest to write from raw telemetry. The rest exists so those four can be trusted: the overview frames them, actions taken records what was done about them, the indicators and appendices back them with evidence, and the recommendations turn them into work.

A standard has to stay workable mid-incident. One that is too burdensome produces compliance shortcuts and late records; one that is too thin omits what the downstream readers need. The working balance is a structured, validated template with a short list of required fields and clearly optional ones.

Evidence, custody, and discovery

Chain of custody: a brief procedure

Chain of custody is the documented, time-stamped trail of who handled a piece of evidence, when, where, and what they did with it. If a case ever ends up in court, in response to a regulator, or under a legal hold, the chain is what proves the evidence wasn’t tampered with between collection and presentation. Break the chain and the evidence’s credibility is open to attack: in US federal practice under Federal Rule of Evidence 901 (other jurisdictions have analogous authenticity rules), gaps usually go to the weight a court gives the evidence rather than automatic exclusion, but a broken chain invites challenge and can gut the artifact’s value.

In US federal courts, Rule 902(14) lets a copy of electronic data be authenticated by a qualified person’s written certification that its hash matches the original’s (with advance notice to the other side). When the original system has since changed or been reimaged, the hash you recorded at acquisition is what makes that certification possible. For collection procedure, see ISO/IEC 27037, NIST SP 800-86 and RFC 3227.

For triage and the appendix of the event report, the minimum-viable chain captures the following at each transfer:

• Identifier. A stable handle for the artifact: the SHA-256 hash for files, a snapshot ID for disk or memory images, and for log excerpts the exported result set (file) and its SHA-256, plus the query text, time range, execution time (UTC), data source, and tool version that produced it. The query lets someone reproduce the work; only the hashed export is evidence.
• Acquisition. Who collected it, on what device, with what tool, at what timestamp. Tool versions matter (the same EDR export from two product versions may differ).
• Transfers. Every time the artifact moves between custodians or storage locations, log the receiving custodian, the transfer mechanism (case-management upload, encrypted bucket move, USB), the timestamp, and a re-verification of the identifier (re-hash for files).
• Integrity verification. A hash recorded at acquisition, re-verified at each transfer and again before any analysis or presentation. If the hash changes, that’s a break. Record the break and stop using the artifact for evidentiary purposes.
• Access log. Each read or analysis touch by name, purpose, and timestamp. Most case-management systems log this automatically; verify it’s enabled.
• Disposal. When and how the artifact is destroyed at end-of-retention, and never while a legal hold covers it (see Scope’s regulatory page). Inappropriate disposal is its own break.

What constitutes a break: any time you cannot produce a continuous chain from acquisition to the current custodian. The most common silent breaks are pulling evidence into a personal scratch directory, or moving it between stores without logging the transfer. Two neighbouring failures are just as common. One is uncontrolled copies: a screenshot shared in a chat DM becomes an artifact with no provenance, and a discoverable one. The other is evidence loss: an EDR or IdP retention window expires before the underlying records are exported, and once a legal hold applies, that is spoliation. If you’re not sure whether a step counts as a break, log it explicitly with a note. The worst position is one where the gap is discovered later by counsel.

For triage analysts, the practical rule is: if the case might end in escalation to IR or external counsel, treat every artifact as if it’s evidence from acquisition. The cost of treating low-stakes artifacts with chain-of-custody discipline is low. The cost of needing chain of custody on an artifact you didn’t track can be most of its value: the evidence may survive, but every gap becomes a line of attack.

At containment time, the five-field minimum record is on Preserve before you contain.

Writing for discovery

Assume every case record can be read by opposing counsel or a regulator. Incident records are routinely requested in breach litigation, and involving counsel does not by itself shield them: in In re Capital One (E.D. Va. 2020) the court ordered a forensic firm’s report produced, because it would have been prepared in similar form without litigation and had been widely distributed. Three habits follow.

• Facts in full, legal conclusions never. Facts are not privileged, so record them completely, with analysis labeled as analysis. Keep legal conclusions out of the record and out of chat: write “unauthorized access to mailbox content confirmed”, not “breach”, “negligent”, or “non-compliant”. Whether something is a breach is a legal determination that counsel makes.
• Follow counsel once counsel directs. When counsel takes direction of an investigation, follow counsel’s instructions on marking, distribution, and where analysis is written.
• A label is not a privilege. Marking a document “privileged” does not make it so, and broad distribution can waive the protection it does have.

The language card carries the same discipline into calls and chat.

Clarity and precision

Language must be unambiguous, technically accurate, and aligned with the organization’s defined terminology. Reports avoid colloquial expressions, internal slang, or undocumented acronyms. Terminology standardizes across templates and aligns with the team’s controlled vocabulary (the C.L.E.A.R. glossary is a starting point, and the ASSURED verdict vocabulary is the canonical source for verdict values), MITRE ATT&CK MITRE ATT&CK MITRE's public knowledge base of adversary tactics, techniques and procedures observed in real intrusions, with Enterprise, Mobile and ICS matrices. Enterprise v19 (April 2026) split Defense Evasion into Stealth and Defense Impairment. Triage uses it as a shared vocabulary: map what the evidence shows to technique IDs, record the version, and remember that a mapping names behavior without scoring it. See the ATT&CK Tactic, Technique and Procedure entries. for adversary behavior, VERIS (the Vocabulary for Event Recording and Incident Sharing) for incident categorization and metrics, and the relevant regulatory frameworks.

Verdicts use one fixed vocabulary on every template, card, and record. The detection axis asks whether the rule was right: true positive, false positive (logic), or false positive (data). The activity axis asks what the activity was: malicious, policy violation, authorized (benign true positive), benign-confirmed, or undetermined. A correct detection of authorized activity is a benign true positive, never a false positive, and “merged into case” is a status, not a verdict. Platform classifications map onto the two axes without replacing them: Microsoft Sentinel’s True Positive, Benign Positive, and False Positive, and Defender XDR’s True positive, Informational (expected activity), and False positive.

The five habits below share one purpose: they remove the reader’s need to ask the author. Every vague term, unlabeled inference, unsourced claim, or approximate time is a question someone will eventually have to ask, and the author will eventually stop being available to answer it: analysts rotate shifts, change teams, and forget. Precision at write time is cheaper than reconstruction at read time, and it is the only version that still works after the author is gone.

Writing about people

Describe what people did, not what they are: “followed the link at 09:10 UTC”, not “carelessly clicked.” A user whose account or laptop an attacker used is the first victim, not the root cause, and the record says so when it matters. Analysts record observable technical activity. HR-held context reaches the case only through the insider-risk route, and never as analyst-collected notes. Insider, executive, and HR-adjacent cases live in a restricted case with need-to-know access, and their shared versions are sanitized before anyone else reads them.

AI-assisted drafting

An assistant may assemble timelines and draft narrative. The analyst verifies every timestamp and claim against tool output before it enters the record, keeps the citation on every claim, and declares material AI use in the header (“none” included). A gap the model smoothed over is a finding, not formatting (see the AI-assisted triage page).

The confidence rubric

Confidence labels appear throughout the methodology: Subject’s per-entity verdicts, Uncover’s evidence chain, the confidence Risk records beside its impact and likelihood ratings, the handoff packet, attribution claims. This is the single confidence scale all of them use, and the labels only work if every analyst means the same thing by them. It is also what “confirmed” means: an escalation criterion is confirmed when the claim behind it reaches HIGH on this rubric. Below HIGH, the claim is a suspicion, and suspicion refines Scope rather than firing the escalation tripwire.

Three usage rules. Label the claim, not the case: a record usually carries several claims at different confidence levels, and flattening them into one label hides exactly the information the next reader needs. When a claim sits between two levels, round down: an overstated “high” costs more at review than an understated “medium”. Rounding down changes the confidence label, never the likelihood rating: likelihood (how probable it is that the activity is malicious or unauthorized) is a separate estimative judgment on the Risk scale, recorded beside confidence, and a matrix cell at P1 or P2 escalates whatever the confidence label says. For a claim that activity is malicious, record what kept it from HIGH as an open question and close that gap first: it is the difference between a suspicion and a confirmed criterion. And unknown is not low: evidence that could not be examined means low confidence, never low likelihood.

Timeliness

Documentation must be initiated at the earliest stages of investigation and maintained continuously. Information is logged in real time as observations are confirmed, actions performed, and decisions made. Delaying documentation until after resolution leads to inaccuracies, lost detail, and incomplete timeline reconstruction.

Timeliness is the standard that cannot be retrofitted, which is why it outranks the other two when they conflict. A badly formatted note written at 09:12 can be restructured at close; a beautifully formatted reconstruction written at 17:00 is a memory exercise wearing a template. The four payoffs below all flow from the same property: a record written during the event is evidence; a record written after it is recollection. (The distinction has a concrete legal basis. In US federal courts, a record made at or near the time by someone with knowledge, as a regular practice of the activity, can come in under the business-records exception, Federal Rule of Evidence 803(6); other jurisdictions have analogous rules. A reconstruction written long after the fact loses that footing and is far easier to challenge.)

Amending a locked record

At handoff, or at the Escalation decision for a closed case, the investigative entries are locked: nobody edits what triage wrote. Documentation adds the closure sections as timestamped, attributed addenda, and any later correction or reopening follows the same rule: append with author, time, and reason; never overwrite. A reopened case keeps its original verdict line and adds the new one beneath it, with the trigger that reopened it.

The closure review checklist

Every Level 2 record, and every P1, P2 or escalated-then-closed case, ends in a per-case closure review; Level 0 and Level 1 closes are reviewed through the weekly QA sample instead. A review only calibrates the team if every reviewer checks the same things. The reviewer accepts the record, requests clarification, or flags it as a training case, against this list. The same ten checks ship as a fill-in closure review checklist (Markdown), with room for findings and the outcome:

• The decision header is complete: verdict on both axes in the fixed vocabulary, the Escalation decision with who made it and when, priority with its matrix cell or override, and a bottom line a non-technical reader can follow.
• Every factual claim cites its source: a query and time range, a log record ID, or an artifact hash.
• Confidence is labeled per claim on the shared rubric, not once for the case.
• Negative findings are recorded with what was examined, not just “nothing found.”
• The timeline is in UTC with the date, and each entry has an actor, rationale, and outcome.
• Every open question from the handoff packet is resolved in 02 or 03, or carried into 08.
• Every indicator and observable has a disposition (malicious, suspicious, or known-good).
• Shared and training versions are sanitized, and people are written about neutrally.
• Material AI use is declared, “none” included.
• Benign and authorized closes state their reopen conditions.