Your post-intrusion collection requirement is refused on cost by the platform owner - what does the closure document record?

## The situation The intrusion is closed. The write-up says, correctly, that the activity was invisible because a source was never collected, and it carries a scoped collection requirement naming the log, the host set, the events and the retention. The platform owner comes back with a number and a no: the ingest volume is not funded this year. The gap stays open, and the document is not finished. This is where a lot of security functions quietly fail. The requirement is dropped from the final version to avoid conflict, or downgraded to a sentence about `exploring options`, and eighteen months later the same blind spot appears in a worse incident with no record that anyone ever asked. ## What goes on the record Five things, and they are small: 1. **The requirement as raised** - unchanged, in its scoped form, with the cost estimate if you have one. The next reader must be able to see exactly what was asked for. 2. **The decision and its grounds** - declined, and why: volume cost, licence tier, no engineering capacity this cycle. Grounds, not motives. 3. **The decider and the date.** A decision without a name is not a decision; it is an outcome nobody owns. 4. **The residual exposure, in operational terms.** Not `risk remains high`, but: activity of this kind on this host class will not generate an alert, and after the fact it can only be reconstructed from local logs that overwrite within roughly N days, so an investigation reaching back further will not be able to answer when access began. 5. **What you will do instead, and the date this is re-examined.** ## Compensating measures that are honest Record only what you will actually perform and can evidence performing. Realistic options when central ingest is unfunded include a scheduled manual collection of the source's local logs at a defined cadence, a recurring hunt over the pulled copy, raising the local log's maximum size so the rollover window at least covers the review interval, or narrowing who can reach the system at all - a preventive control is sometimes cheaper than the visibility it replaces. Each needs a named performer and a way to show it happened. The failure mode is the compensating measure nobody performs. It is worse than an empty box, because in the document it reads as coverage: the next reader sees a mitigation and stops asking. If you cannot commit to running it, write that the exposure is unmitigated. ## Negotiate scope, not principle A flat no is often a no to the size of the ask. The scoped counter-offer is the professional move: only the two or three event identifiers that carry the behaviour rather than the whole log; ninety days hot and a year in cheap cold storage that is searchable slowly rather than everything indexed; the gateway pool only rather than the fleet. And make the cost case in terms the owner can act on - not `security is important`, but what the blind period cost this time: the analyst-days spent reconstructing by hand, the questions the investigation could not answer, the notification judgement made on an incomplete picture, and how much of the estate the same gap covers. Compare the narrowest ingest that would have answered those questions against that, rather than comparing the incident to the whole logging budget. ## Who accepts the risk The SOC's job is to identify and quantify a gap. Accepting the consequence of leaving it open is a business decision, and it belongs to an owner with the authority to make it - typically the accountable executive for the platform, or the risk function, depending on how the organisation is set up. Escalating is not an act of aggression; it is putting the decision at the level that can actually take it. Where a formal risk register exists, the entry goes there and the closure points at it. What must not happen is the SOC absorbing the acceptance by silence, which leaves the organisation exposed and the security function accountable for a call it never had the authority to make. ## Writing for a reader you have not met Assume an auditor, a customer's assurance team, a regulator or an examiner reads this in three years with no context. Two implications. First, factual register: what was asked, what was decided, by whom, what remains. No characterisation of the platform team, no editorialising, no hinting. Second, and counter-intuitively, the documented refusal **protects** the organisation rather than incriminating it. A named requirement, a named decision-maker and a stated residual exposure describe a process that found a gap and escalated it properly. The version that reads badly is the gap that everyone in the SOC knew about and that appears nowhere at all - because then there is no evidence the organisation ever knew, and an accepted risk becomes indistinguishable from negligence.