This template is part of the incident containment handoffs guide. For a wider checklist on incident and on-call records, use the incident records introduction checklist; the client opportunity brief generator drafts a similar note for other record types.
Three rules before you write a word
- Categories and counts, never incidents. No dates of specific attacks, no account names, hostnames, IP addresses, attacker descriptions or screenshots.
- Every estimate has a source. "SOC lead, from the case tool's dashboard" or "director, from memory". SourceX confirms figures with the company later.
- Unknown beats invented. If nobody knows whether owner history is kept, write unknown. Do not ask anyone to run a query to find out.
The blank brief
Copy the fields and fill in the right-hand column with the incident response director.
| Field | What to write | Usually answered by |
|---|---|---|
| Company | Legal name, sector, whether it is itself a security provider | Director |
| Size | Full-time employees at peak, contractors excluded | HR or finance |
| Business task | One sentence on the handoff workflow | Director |
| Record classes | Case timelines, owner history, chat approvals, console action logs, verification and closure notes, plan revisions | Director |
| Years and volume | First and last year; rough case count; share with containment actions | SOC lead |
| Systems | Case tool, chat, identity and endpoint consoles, provider portal, by plain name | Tool administrators |
| History settings | Whether owner changes are kept; whether incident channels are public or private | Tool administrators |
| Open question | The handoff question nobody can yet answer | Director |
| Access deadline | Provider contract end date; chat and console retention settings | Procurement, IT |
| Ownership note | Which records are the company's and which sit with the provider | Procurement, counsel |
| Authorized contact | Name of the CEO, who can approve, plus counsel | Director, CISO |
| Sponsor | The person who checked the brief | Director |
The "History settings" field matters more than it looks. Some case tools write a new row for every update, so each assignee survives; others keep only whoever holds the case now. Chat matters too: a Slack export holds one folder per conversation, with JSON files by date and each message carrying a user ID and a timestamp, and on the Business+ plan private channels and direct messages need a separate export tool the company must apply for. PagerDuty shows a per-incident timeline of statuses, actions and notifications. Ask which pattern applies; do not guess.
Slack
PagerDutyA completed brief (Illustrative)
All values are invented for a fictional company. The level of detail is the target; nothing here is a real opportunity.
| Field | Illustrative entry |
|---|---|
| Company | Regional distributor of building supplies; not a security provider |
| Size | About 900 full-time employees at peak (HR) |
| Business task | Containing incidents and handing them across shifts and between the in-house team and an outside monitoring provider |
| Record classes | Case timelines, owner history, chat approvals, console action logs, verification and closure notes, plan revisions |
| Years and volume | Roughly 1,200 cases over five years, a few dozen with containment actions (SOC lead, estimate) |
| Systems | SIEM case queue, chat, identity console, endpoint console, provider portal |
| History settings | Owner changes kept as rows since year two; incident channels private (tool administrator) |
| Open question | When ownership changed between shifts, can each containment step still be tied to its approval and its check? |
| Access deadline | Provider contract ends at quarter end; chat retention three years |
| Ownership note | Case queue, chat and consoles are the company's; provider analyst notes held under the services agreement |
| Authorized contact | CEO, with general counsel |
| Sponsor | Incident response director |
The open question is the heart of the brief. A company whose records can tie each step to an approval and a check, even when the person on duty changed overnight, has a history worth a conversation; a company that only keeps final reports probably does not. Unknown is still a valid answer here.
Fields partners most often get wrong
- Company. Missing that the client is itself a security provider. Then most incidents belong to its clients, and the cybersecurity services fit page explains why client-linked details are usually excluded.
- Ownership note. Counting the provider's portal as company records. The services agreement decides.
- Systems. Listing only the case tool. Approvals live in chat and actions in the consoles, as the system map shows.
- Authorized contact. Naming the SOC lead or CISO. They sponsor or recommend; the CEO approves. The who-can-license decision tree explains the other roles.
Checks before the brief leaves your hands
The company needs 50+ full-time employees at peak (contractors excluded), a documented operating history, rights to license the records and an authorized contact. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English. Partners sign the Channel Partner Agreement before submitting introductions; the first valid introduction within the 90-day window is credited when the company submits a verified application.
Unknown until SourceX reviews it: buyer interest in this record set, which records the company holds rights to, which incidents are excluded, how accounts, hosts and people are de-identified, the offer and any reward. Sign-in and mailbox records identify employees, and under the EU General Data Protection Regulation personal data is any information relating to an identified or identifiable natural person. The partner field guide covers spotting these companies in the first place, the root cause analysis records page covers a related record type, and every sector is on the industries hub.
Next step
Refer a company. Earn up to $100,000. Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.
When the incident response director has checked the brief and the CEO agrees to a call, register as a partner, confirm the company on who qualifies and keep the program terms beside the brief as you submit it.