Different records answer different questions
- Event
- A source record describing activity or state at a point in time.
- Finding
- An assessed condition that may require review or correction.
- Alert or detection
- A security signal produced when defined or assessed behavior needs attention.
- Investigation or case
- Owned work that brings evidence, assessment, decisions, and activity together.
- Outcome
- The recorded resolution, accepted risk, supported action, or other reviewed end state.
Keep continuity as work changes hands
- Confirm the affected scope and current owner.
- Keep the triggering evidence and later supporting records attached.
- Record the assessment, uncertainty, and reason for priority.
- State the next decision and who can approve it.
- Record the final outcome without erasing earlier evidence or uncertainty.
Closure should explain what changed
A closed item should state whether the condition was corrected, accepted, found to be expected, transferred, or left with a documented exception. Closing work because a source disappeared or became stale does not prove the condition was resolved.