Required fields
| Field | What belongs in it |
|---|---|
| Incident and tenant | Stable ticket ID, client and affected asset/service |
| Business impact | Users or service affected and current severity rationale |
| Evidence | Observations, relevant timestamps and linked action history |
| Action and authority | Completed changes, approvers and current runbook |
| Current state | Restored, mitigated, waiting or unresolved |
| Next decision | A specific action or approval needed |
| Receiving owner | Named accountable role and acceptance time |
| Customer update | Last message, communication owner and next deadline |
| Fallback | Escalation route if acceptance or approval fails |
Keep passwords and raw confidential records in the approved systems. A handoff should refer to controlled evidence rather than duplicating secrets into email. The MSP must decide what the external service is allowed to view and transmit.
Filled illustrative example
Incident AH04 concerns a test client's file service. The overnight team observes failures at 06:10 UTC, opens the incident at 06:12 and applies an approved temporary mitigation at 06:25. Business access is restored, but the underlying capacity issue is unresolved. The next decision is whether the daytime engineer approves a permanent storage change.
The receiving service owner accepts at 07:00 UTC. The last customer update was at 06:30, and the agreed next update is at 07:30. If acceptance fails, the retained on-call owner is contacted and the overnight team keeps coordination until the fallback accepts. These identifiers and times are invented to show a complete record; they are not provider results.
This incident should not be marked permanently resolved merely because the temporary mitigation restored access. Keep the remediation task linked and assign its owner. Make any SLA pause or dependency explicit, including who authorized the pause and what restarts the clock.
Test the calendar seam
Record coverage using a named timezone and the relevant date, not only a fixed UTC offset. Ask how local clock changes and client holidays affect the next receiving shift. Confirm whether the provider observes your client's calendar, its own delivery-center calendar or a negotiated list. Continuous marketing language does not answer that question.
Review and improve
Sample handoffs that were accepted, delayed and rejected. Look for missing next actions, incorrect severity, repeated diagnostic work and late customer updates. Correct the process rather than hiding the failures in an average response time. Use the after-hours guide to define the purchase and the SLA worksheet to separate clocks. Run this handoff in the NOC pilot or desk pilot before expanding coverage.