During a 06:00 shift handover, the outgoing SOC analyst must pass three open alerts and one active phishing investigation to the incoming analyst. The report includes alert IDs, severity, timestamps, and assigned owner. Which addition most directly reduces loss of incident context?
Select an answer to reveal the explanation.
Short Explanation
Think of a shift handover like passing a flashlight in the dark: if you don't say what you already saw, the next person starts from zero. You want the report to say what was found, what was tried, and what should happen next. Metrics look tidy, but they don't carry the case context forward.
Full Explanation
Shift handover is a continuity control, not a performance report. Its purpose is to transfer the working state of an investigation: what indicators were observed, what evidence has already been collected, what containment or analysis actions were performed, what hypotheses remain open, and what the incoming analyst should do next. Without those elements, the next shift may repeat work, miss containment windows, or lose chain-of-custody context. A response-time metric set is useful for trend analysis and capacity planning, but it does not tell the incoming analyst which alert was already triaged or what artifact needs review. An executive business-impact summary supports leadership communication and prioritization, yet it abstracts away the operational details required to continue an active investigation. A formal root cause analysis and permanent corrective action plan belongs after the incident is closed or after a post-incident review; requiring it during handover delays escalation and presumes facts that may not yet be established. Exam caveat: prioritize continuity of investigative context over formal or strategic reporting language. Operational check: review the handover template to confirm every open case includes current findings, actions taken, evidence locations, pending tasks, and next steps.