Short answer: Use one parent incident ticket for the shared facts, decisions, owner, and status. Create child tickets only for distinct workstreams that need their own owner, evidence, or deadline, and keep every child linked to the parent.
When child tickets help
Child tickets are useful when one incident creates parallel work such as endpoint investigation, identity review, supplier coordination, customer communication, or recovery. They are not useful for every small action or as a way to hide the main incident record.
Keep the parent focused
The parent should contain the incident summary, scope, current severity, incident owner, affected services, key decisions, overall status, related alerts, communication state, and closure decision. It should answer what is happening without requiring someone to open every child.
Make each child specific
Give each child a single workstream, accountable owner, next action, target time, relevant context, evidence links, and completion condition. Avoid copying the entire parent into every child. Link back to the shared record when context changes.
Synchronise status and closure
The incident owner decides which child statuses affect the parent. Do not close the parent while material work is unresolved. If a child is intentionally deferred, record the reason, residual risk, owner, and follow-up date in the parent.
Protect communication and evidence
Keep customer or regulatory communication in the appropriate controlled record and link its status to the parent. Store sensitive evidence with the right access controls. The child structure should make work clearer, not widen access to the whole incident.
Practical example
For a suspected account takeover, the parent record holds the timeline, scope, severity, decisions, and communications. Child work items cover identity investigation, endpoint checks, customer notification, and recovery. Each child has an owner and links its findings back to the parent.
FAQ
When should an incident have child tickets?
Use child tickets for distinct workstreams with separate owners, evidence, deadlines, or permissions. Keep shared facts and decisions on the parent.
What must stay on the parent ticket?
The current scope, severity, incident owner, timeline, major decisions, status, communications, and links to child work should remain visible on the parent.
Sources and further reading
- NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations
- NIST Cybersecurity Framework 2.0