Transition to Scope

About 3 min read

On this page

Transition

Subject leaves a defended map of identities. Scope turns that map into the formal boundary of the investigation. This page is the contract between the two.

The handoff contract

Deliverable: The Subject handoff: the seven sections below, under one page. Most of it is structured selection from Subject’s notes, not new writing. The chapter’s four products map onto it: the entity map is section 2, baselines and deviations with their confidence are section 3, the relationship graph is section 2’s classification rings plus the lateral-movement candidates in section 5, and insider indicators are section 6 (insider posture). Template: subject-summary.md.
Close path: Subject closes nothing on its own. A clean verdict on all four dimensions is recorded explicitly and handed to Scope as a narrow recommendation; the close itself happens at the Escalation decision (Case B in the working example).
What Scope asks: Where are the lines? A window per entity, the environmental boundary, the users in scope, and the regulatory flags. Subject’s recommendation is the first draft of each.
Depth: At Level 1, Subject and Scope run as one sweep and the handoff is a few lines in the alert report. At Level 2, write all seven sections. A clean Subject never moves a case back down a level.
You are ready if: Every entity examined is on the map, cleared ones included, and every verdict carries a confidence label. A silent gap is not a verdict.
Insider posture and regulatory flags are recorded, even when the entry is “none observed”.

Live compromise does not wait for the handoff

If Subject confirms a canonical escalation criterion at High confidence (a hijacked session still valid, an active persistence artifact, data leaving), the escalation tripwire fires from Subject: page the IR lead, preserve first, and run only the reversible pre-authorized actions. The handoff becomes scoping support under IR’s clock. Suspicion is different: an unconfirmed signal refines Scope. Case C in the working example shows the pattern.

The handoff itself

Investigation header: case and alert IDs, analyst, timestamp, a two-sentence summary, and whether the tripwire has fired (and who owns the case).
Entity inventory: one row per identity examined, with type (user, service account, host or device, application or OAuth grant, session or token, resource, artifact, network identifier, threat), classification (primary, secondary, downstream, originating threat) and a per-dimension verdict, which may read “examined and cleared”. A non-human identity’s row names the person or pipeline behind it (who is behind this).
Confidence summary: for each implicated entity, the verdict, the baseline behind it and a label on the shared rubric.
Open questions: each one an explicit Uncover target.
Recommended scope parameters: a window per entity anchored to its last known-good point (for a non-human identity, its last credential rotation), the environmental boundary (including what is out), and the lateral-movement candidates.
Insider posture: activity mapped to the Insider Threat Matrix , or “none observed”. Personal context stays with the insider-program owner, HR and legal; it never enters the SOC handoff.
Regulatory flags: Alert’s flag as written (reached, or only reachable), the data classes in reach, and the timestamp of reasonable cause. Some clocks start at awareness, not confirmation; Scope’s regulatory check starts here.

Subject handoff template subject-summary.md · 86 lines · Template version 2.0

Download subject-summary.md JSON Schema

# Subject handoff

<!-- ASSURED Methodology by Timothy Zilber, © Block, Inc., CC BY 4.0
     (https://creativecommons.org/licenses/by/4.0/). Reuse and adapt freely
     with attribution; note any changes you make.
     Template version: 2.0
     ASSURED Subject: the seven-section handoff to Scope
     (https://assured-methodology.vercel.app/docs/subject/transition).
     Under one page, and mostly structured selection from Subject's notes,
     not new writing. At Level 2, write all seven sections. At Level 1,
     Subject and Scope run as one sweep and the handoff is a few lines in the
     alert report. A clean verdict is recorded as carefully as a dirty one,
     and a clean Subject never moves a case back down a level. Subject closes
     nothing on its own: the close happens at the Escalation decision. -->

## 1. Investigation header

- Case ID:
- Alert ID (or every member alert ID, for a grouped case):
- Analyst:
- Prepared at (UTC):
- Summary (two sentences: what the alert claims, and what Subject found):
- Escalation tripwire (not fired / fired: criterion, at UTC), and who owns
  the case (the SOC, or IR once the tripwire has fired):
- Depth level (0 / 1 / 2), and any upward moves with their reason:
- Material AI use (assistant and version, and which sections began as AI
  drafts; "none" if unassisted):

## 2. Entity inventory

<!-- One row per identity examined, cleared ones included: a silent gap is
     not a verdict. Type: user / service account / host or device /
     application or OAuth grant / session or token / resource / artifact /
     network identifier / threat. Classification: primary / secondary / downstream /
     originating threat. Each of the four dimensions reads "anomalous" (with
     one line why), "examined and cleared", or "not examined" (and why). -->

| Entity | Type | Classification | Authentication | Authorization | Behavior | Relationships |
| --- | --- | --- | --- | --- | --- | --- |
|  |  |  |  |  |  |  |

## 3. Confidence summary

<!-- For each implicated entity: the verdict, the baseline behind it, and a
     label on the shared confidence rubric (high / medium / low; between
     levels, round down). Unexamined evidence means low confidence, not a
     clean verdict. -->

| Entity | Verdict | Baseline behind it (source, period) | Confidence (high / medium / low) |
| --- | --- | --- | --- |
|  |  |  |  |

## 4. Open questions

<!-- Each one an explicit Uncover target, phrased so a query can answer it. -->

-

## 5. Recommended scope parameters

<!-- Subject's recommendation is Scope's first draft, not its decision. -->

- Window per entity, anchored to its last known-good point (UTC):
- Environmental boundary, including what is out and why:
- Lateral-movement candidates (hosts, accounts or services the entities can
  reach and that a sweep should cover):

## 6. Insider posture

<!-- Analysts record observable technical activity. HR-held context reaches
     the case only through the insider-risk route, and never as
     analyst-collected notes. Personal context stays with the
     insider-program owner, HR and legal; it never enters this handoff. -->

- Activity mapped to the Insider Threat Matrix, or "none observed":
- Insider-program referral (exists: yes / no; if yes, its holder only):

## 7. Regulatory flags

<!-- Some clocks start at awareness, not at confirmation. Triage records the
     candidate timestamp; the regime's owner decides whether a clock
     started. Scope's regulatory check starts from this section. -->

- Alert's flag as written (data reached, or only reachable):
- Data classes in reach:
- Timestamp of reasonable cause (UTC), and the owner engaged (who, at UTC):

The common failures are silent ones: a secondary identity that never reaches the map, a verdict with no confidence label, adjacent entities left out without a word, and a missing insider-posture line.

Key takeaway

Subject produces the map; Scope draws the lines. The handoff is seven sections of structured selection, scaled to the depth level, and a clean verdict is recorded as carefully as a dirty one. When Subject confirms an escalation criterion, the handoff becomes scoping support under IR’s clock instead of a gate.

Back to Subject overview Take the Subject quiz

Edit this page on GitHub Report a correction