The work behind the words.

Two teams used different escalation routes during a low-severity account incident.

I assembled a timeline from the incident ticket and the approved handover notes, separating recorded timestamps from participants’ later recollections. At the point where the security team requested an account check, the receiving team had not explicitly accepted ownership. I drafted a checklist requiring a named next owner, an acknowledgement and the next update time. Both teams reviewed the wording. I then facilitated a tabletop replay and recorded where a participant had to ask for clarification. The incident lead retained responsibility for incident classification and closure; I owned the documentation change and the rehearsal notes.

Adding another general incident policy would not fix an ambiguous transfer between two teams. I focused on the handover decision and kept the checklist short enough to use while investigating. I considered automatic reassignment but rejected it for this change because it could move a ticket without anyone acknowledging it. The agreed approach required explicit acceptance and a fallback contact if no acknowledgement arrived. We left the escalation time threshold to the existing incident procedure rather than inventing a competing rule.

During the first tabletop pass, the receiving participant asked whether accepting the task also meant owning the whole incident. I changed the checklist to distinguish task ownership from incident ownership. In the second pass, participants could identify the task owner, incident lead and next update point without that clarification. Both teams accepted the revised wording for a trial. This shows that the checklist could be followed in a rehearsed scenario. No subsequent live incident had been reviewed when I wrote this record, so I cannot claim a reduction in response time.

One low-severity account incident and a tabletop replay. I did not determine whether the original account activity was malicious or direct live containment. The timeline used approved records and omitted identifying details. Participant acceptance was feedback on usability, not independent validation of incident-handling effectiveness.

A document can appear clear to its author and still leave ownership ambiguous. I would use a new participant for the next walkthrough. The next check is to compare the checklist with a real handover, with the incident lead’s permission.