This decision tree is part of the incident containment handoffs guide. It takes a security operations consultant from the first conversation to the right introduction and marks where the answer stays open until SourceX's rights review. It is general information, not legal advice.
Why the person who knows the handoffs is not the one who signs
The incident response director is the right first conversation. They know whether owner changes are kept as history, whether chat approvals quote the case number and which shifts handed over cleanly. In a tool like Microsoft Sentinel they can see the Owner field on every incident row, so they can describe the handoff record precisely.
Knowledge is not authority. NIST's SP 800-61 Revision 3, finalized in April 2025, frames incident response as part of cybersecurity risk management, which places it under the organization's governance rather than with one team. A decision to discuss those records with an outside party follows the same line: up from the SOC to the executive who answers for company information, with counsel alongside.
The tree: four questions to the signer
Work through the questions in order. Each answer either names a decision-maker or adds a reviewer.
- Where were the handoff records created?
- In the company's own case tool, chat and consoles: go to question 2.
- In an outside provider's portal: the services agreement decides who controls them. The vendor or procurement manager finds the agreement; counsel reads it. Mark these records "unknown" and go to question 2 for the rest.
- Is the company itself a security or managed services provider?
- Yes: most incidents concern its clients, and client contracts govern them. Separate internal incidents from client incidents and go to question 3.
- No: go to question 3.
- Do any incidents carry notification history, regulatory correspondence or a legal hold?
- Yes: general counsel gates those incidents, and some may stay out of any discussion. Go to question 4.
- No or unknown: note it and go to question 4.
- Will the CEO take a short call, with the CISO recommending?
- Yes: introduce the CEO, with the incident response director as sponsor.
- No or unsure: do not submit yet; ask the sponsor to raise it with the CEO.
Most companies with their own SIEM or case tool follow the first branch for the bulk of their records and the provider branch for a smaller slice from an outgoing retainer.
Who owns, who recommends, who approves
| Person | What they bring | Decision role |
|---|---|---|
| Incident response director or SOC lead | Handoff workflow, systems, coverage by year | Starting contact and sponsor |
| SOC analyst or case tool admin | Which fields and history are kept | Informs; no authority |
| IT operations lead | Endpoint, identity and change records | Informs |
| Vendor or procurement manager | The outgoing provider's contract and data handover terms | Informs |
| CISO | Owns the security function's records and their sensitivity | Recommends |
| CEO | Authority over company information | Approves and signs |
| General counsel | Provider and client contracts, notification history, legal holds | Advises; often gates |
If you worry the conversation may strain your client relationship, read whether referring clients hurts the relationship first.
Where legal, provider or client sign-off comes in
The services agreement. Notes written by a provider's analysts may be the provider's records, the company's, or shared, depending on the contract. Counsel answers that before anyone counts them in.
Client contracts. For a security provider, client incident records are usually confidential under client agreements. The cybersecurity services fit page explains why client-linked incident details are usually excluded.
People in the records. Sign-in logs and mailbox records identify employees. Under the EU General Data Protection Regulation, personal data is any information relating to an identified or identifiable natural person, and similar rules exist elsewhere. Mailbox content raises its own questions, set out in whether a company can license its email archive. Why data rights matter explains why these answers come first.
What only SourceX's rights review settles
The tree tells a partner whom to introduce. It leaves these open:
- which record classes the company has the right to license, and whether provider-held notes are among them
- which incidents are excluded because of client terms, notification history or legal holds
- how accounts, hosts and people are de-identified or generalized
- whether there is buyer interest in containment handoff histories, and on what terms
An introduced company needs 50+ full-time employees at peak (contractors excluded), a documented operating history, rights to license and an authorized contact. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English. Partners sign the Channel Partner Agreement before submitting introductions and never ask for cases, logs or logins. The worked overnight-shift case shows what the records contain, the root cause analysis records page covers a related record type, and the referral brief template has a field for the signer.
Next step
Refer a company. Earn up to $100,000. Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.
Once the tree has named the executive who can approve a discussion about the company's incident records, register as a partner, check the company against who qualifies and read the program terms before you make the introduction.