Transition to Documentation
On this page
Documentation is not only the final phase. It is a continuous, embedded practice that spans the entire lifecycle of a security event, and the transition from the Escalation decision to Documentation is the moment the methodology formalizes what has already been recorded throughout.
Six phases complete. The last begins.
Alert through the Escalation decision produced the investigation and the close-or-escalate decision. Documentation captures the full arc as durable institutional knowledge. The transition does not start new investigative work. It formalizes work that has been embedded throughout.
The handoff contract
- Deliverable
- For an escalated case, the handoff packet (handoff-packet.md): case metadata with the receipt, then nine sections. With it, three things the event report needs: the decision rationale (criteria checked, matrix cell, the evidence behind each), the stakeholder record (who was told what, when, on which channel, and what they decided), and the open improvement items (detection gaps, process and tooling limits), each to become a tracked action.
- Close path
- A closed case hands over its closure record instead: the decision header, the closure check with the finding behind each item, the named gaps and reopen triggers. No packet, because nobody inherits the case.
- What the next phase asks
- What did we decide, and what did we learn? Documentation quality-controls the record against the standards and assembles the nine-section event report under its decision header. The packet and the event report are different artifacts (see Standards: format).
- Depth
- A Level 0 close is already complete: the five-field record is the whole record, kept as a pattern-close record. Level 1 hands over the alert report and its closure or escalation lines; Level 2 hands over the full record.
- You are ready if
- a reviewer who has not seen the case could read the decision, its route and its reasoning, and reach the same call;
- every notification sent is in the communication record with its time and channel, and an escalated packet carries a receipt.
Documentation is continuous, not only final
Documentation began at Alert and evolved alongside the investigation: the timeline, the containment record, and the stakeholder communications were captured as they happened, not reconstructed afterwards. Why the methodology insists on that, and what the practice looks like day to day, is the Documentation chapter’s own subject. The case closes only when the record passes that chapter’s quality bar.
Key takeaway
Hand Documentation four things: the packet or closure record, the decision rationale, the stakeholder record, and the improvement items. Documentation is the phase that says “the case is complete,” and it does so by quality-controlling what the rest of the methodology has already captured.