Chapter 26 — Threat intelligence and OSINT: operational handoff
Lesson map
Lesson 26 published. Map, example, EX076.
flowchart TD
N0["Learning outcomes"]
N1["26.1 Why handover matters"]
N2["26.2 Handover note"]
N3["26.3 Access"]
N4["26.4 Restricted items"]
N5["26.5 Verbal briefing"]
N6["26.6 Return"]
N7["26.7 Templates"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX076"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["26.1 Why handover matters"]
N2["26.2 Handover note"]
N3["26.3 Access"]
N4["26.4 Restricted items"]
N5["26.5 Verbal briefing"]
N6["26.6 Return"]
N7["26.7 Templates"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX076"]
[Learning outcomes]
|
v
[26.1 Why handover matters]
|
v
[26.2 Handover note]
|
v
[26.3 Access]
|
v
[26.4 Restricted items]
|
v
[26.5 Verbal briefing]
|
v
[26.6 Return]
|
v
[26.7 Templates]
|
v
[Worked example] --> [Exercise EX076]
Learning outcomes
You will (1) hand over CTI duties between shifts or staff; (2) write a handover note; (3) transfer open items and their handling labels; (4) keep continuity during absence.
26.1 Why handover matters
Intelligence work spans days: an advisory awaits a patch, a takedown request awaits a reply, a fraud wave continues. Without handover, items stall when someone is away.
Each of those examples has a next step owned by someone outside the team, such as a hosting provider's reply or a system owner's patch. If Lena is away and nobody tracks them, the takedown request may never be chased; the takedown in the worked example still needed chasing on her return. A good handover keeps each of these items moving and visible.
26.2 Handover note
Open items with status, owner and next step; scheduled jobs and their health; partner commitments such as promised MCX feedback; anything unusual seen this week. Each item keeps its TLP label.
Each heading answers a question the cover person will face. Open items say what to chase, job health says whether the automation is working, partner commitments say what MCX is expecting, and unusual events say what to watch. Keeping TLP labels on each item stops the cover person sharing something more widely than allowed.
26.3 Access
The cover person needs platform access, the ticket queue and MCX portal access approved in advance. Sharing passwords is not handover; individual accounts are.
Approving access in advance means the cover person can work from the first day of the absence, rather than waiting for accounts. Individual accounts mean the platform and MCX portal record who did what, which matters for TLP:AMBER and RED material. A shared password would hide that and break the access rules partners rely on.
26.4 Restricted items
TLP:RED items go only to named recipients. If the cover person is not named, the item is noted as "restricted item pending; supervisor holds details".
TLP:RED limits an item to named recipients, and handover does not change that. Noting the item without its content tells the cover person that something exists and who holds it, so they can direct questions to the supervisor. Lena's handover in the worked example uses exactly this wording. The supervisor decides whether the cover person needs to be added as a named recipient, after asking the original sender.
26.5 Verbal briefing
A fifteen-minute conversation alongside the written note catches nuance: "the parks owner prefers phone calls".
Some things are hard to write down or would look odd in a note, such as an owner's preference for phone calls. The conversation also lets the cover person ask questions about items they do not understand. Fifteen minutes is short enough to fit in before leave and long enough to cover the open items. The cover person writes down anything important from the conversation, so it is not lost if they also hand over later.
26.6 Return
On return, the person reads the cover log and confirms each item's state before resuming.
Items may have changed in ways the cover log records but the returning person does not know. Confirming each item's state before acting avoids repeating a request the cover person already sent or missing one they could not finish. In the worked example, this check showed the takedown request still waiting and needing a chase. The returning person also reads the job-health entries, since a failed job during the absence may have left gaps.
26.7 Templates
A fixed template with the same headings every time speeds writing and reading. Missing sections are visible at a glance.
A fixed template means the cover person knows where to find open items and partner commitments in every handover. An empty heading, such as no entry under partner commitments, prompts the question of whether nothing was due or something was forgotten. Writing the note becomes faster because the headings prompt the content. Lena keeps the template in the team repository, so changes to its headings are reviewed like any other change.
26.8 Long absence
For absences over two weeks, the supervisor reassigns items formally rather than leaving them with temporary cover.
Temporary cover suits a week, but over two weeks items may need decisions the cover person cannot make. Formal reassignment gives each item a named owner with the authority to act. It also stops a returning person facing a backlog of items that waited for them unnecessarily. The supervisor records each reassignment in the ticket queue, so owners and partners know whom to contact. When the original owner returns, items are handed back formally in the same way, with their current state confirmed.
Handover in incidents
During a live incident, handover happens at shift change with the incident lead present. The outgoing person states current hypotheses, pending searches and promised updates, so the incoming person does not repeat work or contradict earlier messages.
Worked example
Before a week's leave, Lena hands over to a colleague: four open items, one awaiting the hosting provider's takedown reply, the weekly scam list due Monday, an MCX feedback form due Friday, and one TLP:RED item noted only as "held by supervisor". On return everything has moved except the takedown, which is chased.
Synthetic case. The items are invented.
Errors and limits
Notes cannot hold everything; the verbal briefing fills gaps.
Exercises
- EX076 — Handover parts. List four sections of a handover note. Rubric: 3 = open items, jobs health, partner commitments, unusual observations; 2 = three; 1 = one; 0 = none.
- EX077 — RED in handover. How should a TLP:RED item appear in a handover to someone not named? Rubric: 3 = noted only as pending, details held by supervisor; 2 = partial; 1 = full details; 0 = none.
- EX078 — Access, not passwords. Why must cover use individual accounts? Rubric: 3 = accountability/audit; password sharing breaches policy; 2 = partial; 1 = sharing fine; 0 = none.
Synthesis
Write structured handovers, keep labels, arrange access properly, brief verbally and check items on return.
Continue studying — chapter 26 of 30
← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →