During initial triage of a ransomware precursor, an SOC analyst must escalate to the incident commander and request forensic and legal support. Which reporting section most effectively justifies the escalation and resource allocation?

In a hybrid SOC, incident severity is a decision-support construct, not just a label. The reporting section that justifies escalation must translate observed indicators into business impact, urgency, and the resources needed to contain and investigate the event. A severity rationale tells the incident commander why the event exceeds normal triage capacity and why forensic or legal support is required, enabling coordinated response and budget or staffing approval. A detailed list of observed MITRE ATT&CK techniques can support investigation, but techniques alone do not communicate why the event matters to the business or what resources are required. A complete vulnerability scan output with CVSS v4 base scores is useful for vulnerability management and remediation prioritization, yet it does not establish incident severity or justify immediate IR resources unless the incident itself is vulnerability-driven. A full packet capture transcript preserves evidence for analysis, but raw evidence without interpretation does not help leadership make escalation and resource decisions. Exam caveat: CompTIA expects analysts to connect severity to response coordination, not merely to technical detail. Operational check: In the escalation summary, state the affected business service, potential impact, containment urgency, and the specific teams or tools needed.