A case is closed immediately after blocking one malicious address, though the root cause remains unknown. Which approach best fits?

1. Validate eradication, recovery, and remaining exposure before final closure.
2. Use a structured case handoff with current scope and completed-response context.
3. Define severity and escalation criteria with ownership and notification paths.
4. Record root causes, coverage gaps, and owned corrective actions.