An analyst hands off an incident to another team but omits affected entities, evidence, and actions already taken. Which approach best fits?

1. Define severity and escalation criteria with ownership and notification paths.
2. Validate eradication, recovery, and remaining exposure before final closure.
3. Record root causes, coverage gaps, and owned corrective actions.
4. Use a structured case handoff with current scope and completed-response context.