When should a live-system specialist take over?¶

Hand over when the next action requires volatile acquisition, containment or service knowledge beyond ordinary first response or could affect critical operations.

Escalate complex live decisions¶

Servers, virtual environments, cloud consoles, network appliances and incident platforms may contain memory, active sessions, encryption, malware and remote users. Power, isolation and capture decisions can change several systems at once.

Record applications, accounts, networks, power, time, risks and prior changes. Brief the specialist on what the system is, how found, operational dependencies and the decision deadline.

Preserve accountability through handover¶

Record who assumed control, when, advice given and resulting actions. Technical access does not settle legal authority or third-party ownership, so legal, provider or system-owner coordination may also be needed.

If emergency harm requires action before takeover, use the least destructive effective measure and document why waiting was impossible.