Why a provider transition splits the handoff history
A containment handoff is the moment one person or team passes an open incident to another: night shift to day shift, provider analyst to internal responder, or one provider to the next. The history of that handoff lives in at least three places, and a provider transition gives each place a different end date.
Containment itself produces records the company can usually see. CISA's response playbooks list containment actions such as blocking unauthorized access and rotating credentials where compromise is suspected, and treat confirming remediation as part of recovery before an incident is closed. Each action leaves an admin log entry, an approval somewhere and, ideally, a verification note.
Ownership leaves records too. In Microsoft Sentinel, the SecurityIncident table carries an Owner field for the user the incident is assigned to and a LastModifiedTime for the modification each row describes, and a new row is added every time an incident is created or updated. Where the company runs its own Sentinel workspace, those rows show who held the incident at each handoff, and they stay with the company. Where the provider ran the case in its own portal, the equivalent history may leave with the provider.
The result is that one incident's story ends at different times: the company's logs stay, shared chat follows the chat plan's retention, and the provider's analyst notes and handover notes close with the contract.
What should be inventoried before a response service transition affects incident containment handoffs history?
Inventory where each part of the handoff history lives and when that access ends. Keep it at metadata level.
- In the company's tools: its own case or ticket records, internal chat channels, endpoint and identity admin logs, change tickets, the incident response plan and its revisions.
- In the outgoing provider's tools: the provider's case portal, its analysts' notes, shift handover notes, and any reports delivered under the contract.
- In both: shared chat channels, email threads and bridge-call notes.
For each class, write down the first and last year, the system name, the owner, and the date access ends. Provider portals often close at the end of the contract term; chat retention can be shorter than case retention. Chat is easy to overlook: on Slack's Business+ plan, Workspace Owners and Admins can export public channels, while private channels and direct messages need a separate export tool that the company has to apply and be approved for. Incident channels are often private, so the inventory should say which kind they are.
SlackDo not suggest exporting or keeping records for a licensing conversation. Retention and export are the company's decisions, made with the required authority and under its contracts and obligations. NIST SP 800-61 Revision 3, finalized in April 2025, frames incident response as part of cybersecurity risk management; the company's own plan, not a partner, decides how its incident records are handled.
A handoff history map for the transition
Illustrative. This is the map an incident response director at a fictional 600-person logistics company might sketch, with its retainer ending at the end of the quarter. Every value is metadata.
| Record class | Held by | System | Years held | Access after contract end |
|---|---|---|---|---|
| Case records and ownership changes | Company | Own SIEM case queue | 2020 to 2026 | Unchanged |
| Endpoint and identity admin logs | Company | Endpoint and identity consoles | Rolling retention | Unchanged, per retention setting |
| Containment approvals | Both | Private incident channels | 2021 to 2026 | Per chat plan; private export needs approval |
| Analyst notes and shift handover notes | Provider | Provider portal | 2021 to 2026 | Portal closes at contract end |
| Delivered incident reports | Company | Document store | 2021 to 2026 | Unchanged |
| Bridge-call notes | Both | Email and shared drive | Patchy | Unclear, no owner named |
The rows to raise are the provider portal and the private channels. They hold the handoff notes and approvals that explain why each containment step happened when it did, and both can become unreadable on a date the company has not written down.
Questions for the incident response director
- Which incident records are in the company's own tools, and which only in the provider's portal?
- What does the services agreement say about records the provider created, and about access after termination?
- Are incident channels public or private, and what is the chat plan's retention setting?
- When exactly does portal access end, and is a read-only period offered?
- Who, above the director, decides whether these records are discussed with an outside party?
Does the company qualify, and what stays unknown?
The introduced company needs 50+ full-time employees at peak (contractors excluded), a documented operating history, rights to license the records, and an authorized contact. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English.
Unknown until SourceX reviews it: which records the company holds rights to (provider-held notes may not be among them), what must be removed or generalized, whether buyers want this record type, and any offer. If the company is itself a security provider, the cybersecurity services fit page explains why client-linked incident details are usually excluded. A related security workflow is covered in false-positive investigation closure.
On the reward, an illustrative case: if a qualifying completed handoff led SourceX to pay the company $400,000, the default reward would reach the $100,000 cap, and later agreements with the same company would add nothing because the cap is cumulative per company. That is arithmetic, not a forecast or a quote. A reward becomes payable after SourceX has paid the referred company under its signed agreement and the payout conditions in the program terms are met, including finance approval and your tax and payment details.
Go deeper on incident containment handoffs
- Incident containment handoff exception examples: worked cases showing which records explain how a handoff gap was caught and closed.
- Reconstructing containment handoffs across systems: a system map of the IDs and timestamps that join case tools, chat and admin logs.
- Who can license incident containment records: a short answer on which security and executive roles to introduce.
- Incident containment referral brief template: a fill-in template for the one-page introduction.
Next step
Refer a company. Earn up to $100,000. Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.
If a client is changing response providers and its containment handoffs can still be traced from approval to check, register as a partner, confirm the company against who qualifies, and read the program terms before you send the one-page handoff. Other sectors are on the industries hub.