The team needs to determine when an investigation should escalate to the incident commander. Which approach best fits?

1. Validate eradication, recovery, and remaining exposure before final closure.
2. Record root causes, coverage gaps, and owned corrective actions.
3. Define severity and escalation criteria with ownership and notification paths.
4. Use a structured case handoff with current scope and completed-response context.