Without limiting the rights under copyright, no part of this document may be
reproduced, stored in or introduced into a retrieval system, or transmitted in any form
or by any means (electronic, mechanical, photocopying, recording, or otherwise) or for any purpose, without the express written permission of Synergycentric Sdn Bhd. Synergycentric may have patents, patents applications, trademarks, copyrights, or other intellectual property rights covering subect matter in this document. !xcept as expressly provided in any written license agreement Synergycentric, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. Standard Operating Procedure: Incident Management Prepared for: Synergycentric Sdn. Bhd. Prepared by: Tradewinds Malaysia IT Outsourcing Project Transition Team ate: ! ST October "#!$ %ersion: ! Standard Operating Procedure (SOP) TRADEWINDS Incident Management Incident Management Release 1 1 st October 2014 Release and Reision Record "he following information is being used to control and track modi#cations made to the document. Revision Date Section( s) Versio n Page Number( s) Summary of Changes(s) $ st %ctober &'$( )ll $ $* +nitial ,raft & Synergycentric Sdn Bhd' (ersion ! Page " of !) Incident Management Release 1 1 st October 2014 Document !ontrol Author )bdul -a#. )ri/n File Name &(01*&2*3.doc Created Wednesday, $ st %ctober &'$( ast !dited Wednesday, $ st %ctober &'$( D"S#R"$%#"&N $. Synergycentric Sdn. Bhd. #RAD!'"NDS "# &%#S&%RC"N( PR&)!C# #RANS"#"&N #!A* )bdul -a#. )ri/n Service )ssurance Specialist 4ee Boon 5hong Service ,elivery 6anager PR!PAR!D $+ R!V"!'!D $+ S+N!R(+C!N#R"C SDN, $-D, 4ee Boon 5hong Service ,elivery 6anager ACC!P#!D $+ & Synergycentric Sdn Bhd' (ersion ! Page * of !) Incident Management Release 1 1 st October 2014 TA"#E O$ !ONTENT ., "N#!N#"&N &F #-! S&P,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,/ .,. "ntention of the S&P,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,/ 0, Princi1les,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,/ 0,. Princi1les,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,/ 2, Res1onsibilities,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,/ 2,. Res1onsibilities,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,/ 3, Re4uirements,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,5 3,. Re4uirements,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,5 6, Procedure,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,7 6,. Procedure,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,7 8, References,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,.8 8,. References,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,.8 /, &ther S&P9 document9 la:s and rules to consider,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,.8 /,. &ther S&P9 document9 la:s and rules to consider,,,,,,,,,,,,,,,,,,,,,,,,.8 5, ;ey %sers,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,.8 5,. ;ey %sers,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,.8 7, #raining < "m1lementation Plan,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,./ 7,. #raining < "m1lementation Plan,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,./ .=, A11endices,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,./ .=,. A11endi> . ? Service evel Agreement,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,./ & Synergycentric Sdn Bhd' (ersion ! Page $ of !) Incident Management Release 1 1 st October 2014 #IST O$ TA"#E 7% ")B4! %8 8+9:;!S !7";+!S 8%:7,. #IST O$ $I%&RE Figure .? "ncident *anagement Process Flo:,,,,,,,,,,,,,,,,,,,,,,,7 ., ., "ntention of the S&P "ntention of the S&P .,."ntention of the S&P & Synergycentric Sdn Bhd' (ersion ! Page + of !) Incident Management Release 1 1 st October 2014 "he intention of this S%< is to describe +ncident 6anagement process. 0, 0, Princi1les Princi1les 0,.Princi1les "he goal of the +ncident 6anagement process is to restore a normal service operation as =uickly as possible > with permanent solutions or temporary workarounds ? in order to minimi.e the impact on business operations. "his is to ensure that the best possible levels of service =uality and availability are maintained. )ll incidents should be solved within the pre>de#ned Service 4evel )greement (S4)) to maintain service =uality. 2, 2, Res1onsibilities Res1onsibilities 2,.Res1onsibilities !nd %sers ;aise incident with "radewinds +" ,epartment when an issue being encountered %btain an incident log reference or ticket number for ease of future reference Synergycentric -el1des@ (First evel) <rovides a single contact point for "radewinds +" for escalation @erify end users support entitlement 4og, track, and close issues raised by end users <rovide initial support and assign priority 5on#rm with end users on resolution !scalation of incident to the +ncident 6anagement team & Synergycentric Sdn Bhd' (ersion ! Page , of !) Incident Management Release 1 1 st October 2014 <rovide regular and time performance report (weekly, and monthly) Princi1al Su11ort (Second evel) <erform second troubleshooting on incident and veri#ed with end>user on the resolution "o validate the types of incident and escalate to the respective support group or vendor if failed to resolve the incident at the second level Su11ort !ngineer (including Des@to1 Su11ort) "he role of Support !ngineer is to resolve all the incident 4og in an incident ticket if re=uired in the event that there is issue with the +" infrastructure that aAected the services 8ul#ll the delivery re=uest "ncident *anagement #eam !scalation of incident to the +" %peration "eam %wn and track the progress of the incident until resolved !scalation to third party vendor or principle support ? if re=uired +nitiate <roblem 6anagement ? if re=uired 3, 3, Re4uirements Re4uirements 3,.Re4uirements Service ,esk software, which if available. +f not, at least -elpdesk software. 7oteB 5urrently Synergycentric is using :lysses 5;6Cs +ntegrated Service 6onitoring & Synergycentric Sdn Bhd' (ersion ! Page ) of !) Incident Management Release 1 1 st October 2014 6, 6, Procedure Procedure "his chapter would describe in detailed what are the processes re=uired and how they are being used in +ncident 6anagement to manage the incidents logged. 6,.Procedure Figure .? "ncident *anagement Process Flo: & Synergycentric Sdn Bhd' (ersion ! Page - of !) Incident Management Release 1 1 st October 2014 ., Raise "ncident "radewinds +" or end user contacts Service ,esk ? via phone D email > to raise an incident Note? besides end users, +" %perations team may also raise incident for the issues that they encountered during operation, e.g. when server team observed one of the hard disk is defunct during daily morning health check. 0, !scalate to 0 nd evel Su11ort +" %peration "eam or end user contacts helpdesk to raise an incident and will be escalated to Synergycentric 2, Create #ic@et 9ather information ? based on input re=uirement of the -elpdesk software > from the end user in order to create a ticket. )ssign appropriate classi#cation to the ticket based on categori.ation and problem type. )ssign appropriate priority to the ticket based on the Service 4evel )greement (S4)). 3, #roubleshooting "roubleshooting activity will be done to resolve the issue. & Synergycentric Sdn Bhd' (ersion ! Page . of !) Incident Management Release 1 1 st October 2014 6ay involve multiple groups to investigate the root cause and identify an action plan 6ay involve many steps in order to get the incident closed within the S4). 6, "ncident ResolvedA +f the incident can be resolved, con#rm the resolution with the end user to see whether the incident can be closed or not +f the incident could not be resolved, escalate the incident to Service ,esk (second level) team for further troubleshooting. 8, Princi1al !scalation +f 3rd party support is re=uired, proceed by escalating to respective vendorDprinciple. :pdate the incident ticket with information on what actions have been taken so far in providing onsite troubleshooting for that particular incident. /, ConBrm Resolution :ith %ser Service ,esk software sends an email to the end user re=uesting the user to acknowledge the email if the incident is con#rmed resolved and can be closed "he con#rmation can also be obtained from the end user over the phone by the Service ,esk and update in the Service ,esk software 5, Close "ncident & Synergycentric Sdn Bhd' (ersion ! Page !# of !) Incident Management Release 1 1 st October 2014 :pdate information ? based on input re=uirement of the Service ,esk software > in order to close the ticket 5lose the incident 7, #roubleshoot and reconBrm :ith user Service ,esk (second level) would call back the +" %peration "eam or the end user perform further troubleshooting and recon#rmed with user on resolution .=, "ncident ResolvedA +f the incident can be resolved, con#rm the resolution with the end user and close the incident +f the incident could not be resolved, check if the incident is a desktop issue or not 8, 8, References References 8,.References "he input for the development of this document is as followB +" +nfrastructure 4ibrary (+"+4) references "he output for the development of this document is as followB Standard %perating <rocedure, +ncident 6anagement & Synergycentric Sdn Bhd' (ersion ! Page !! of !) Incident Management Release 1 1 st October 2014 /, /, &ther S&P9 document9 la:s and rules to consider &ther S&P9 document9 la:s and rules to consider /,.&ther S&P9 document9 la:s and rules to consider Standard %perating <rocedure, <roblem 6anagement Standard %perating <rocedure, +ncident 6anagement 5, 5, ;ey %sers ;ey %sers 5,.;ey %sers Synergycentric Service ,esk Synergycentric +ncident 6anagement "eam 7, 7, #raining < "m1lementation Plan #raining < "m1lementation Plan 7,.#raining < "m1lementation Plan Eey users listed in 5hapter 1 needs to be briefed on the procedures. .=, .=, A11endices A11endices .=,. A11endi> . ? Service evel Agreement & Synergycentric Sdn Bhd' (ersion ! Page !" of !) Incident Management Release 1 1 st October 2014 .,.,. Severity ClassiBcation and Service Commitments Severity <$ %rgency 5ritical Res1onse #ime $ -our Resolution #ime $& -ours Descri1tion )n +ncident will be assigned as F<riority 4evel $G if the +ncident is characterised by any of the followingB 6aor impact incident aAecting more than or e=uivalent to H' )uthorised :sers preventing them from accessing production business applications. "he aAected environment is production and supports the core business functions of the ";),!W+7,S with many users aAected, and no workaround is available. "here is the potential of a health, safety or security issue in terms of technology to occur or it has already occurred to the Business. "here is the potential of a maor loss of revenue to ";),!W+7,S. ) critical production business system, application or function is completely unavailable, severely corrupted, or severely degraded which aAects multiple departments. Descri1tion of urgency CCriticalD +t is the level that causes huge impact across the enterprise. "hese issues are 6ission 5ritical and damages reputation of the concern. Stakeholders are badly aAected. "hey have greatest #nancial riskIloss. !.g.B> @irus attack ,atabase 5orruption on a Business 5ritical & Synergycentric Sdn Bhd' (ersion ! Page !* of !) Incident Management Release 1 1 st October 2014 )pplication (ie., WBS or ,%) ,B corrupted) 8ailure of S)7 or Server hardware 4)7 failure impacting J H' users 7etwork down on "ier $ site where no network redundancy exists (e.g. Business operations aAecting at 5!% level) 4oss of connectivity to both Business )pplication database nodes Severity <& %rgency -igh Res1onse #ime $ -our Resolution #ime $ Business ,ay Descri1tion )n +ncident will be assigned as F<riority 4evel &G if the +ncident is characterised by any of the followingB +ncident aAecting less than H' )uthorised users and more than $' users, preventing them from accessing production business applications. "he aAected environment is production and supports the core business functions of ";),!W+7,S with many users aAected but workaround is available. )n entire non>business critical department or building is unable to work due to service unavailability. <otential for loss of revenue to ";),!W+7,S. 4oss of redundancy in a maor production system or application, although service to the business area is still available. )Aected user is a @+< user of ";),!W+7,S. & Synergycentric Sdn Bhd' (ersion ! Page !$ of !) Incident Management Release 1 1 st October 2014 Descri1tion of urgency C-ighD +t is the level that aAects the whole high level organi.ation or the core operational department of a speci#c business. !.g.B> ;edundancyDSecondary server of the critical business application crashed Service degradation caused by hardware failure where redundancy exists 4oss of connectivity to one among two Business )pplications database node 7etwork connectivity to a department 9eneral 6anager aAected. Severity <3 %rgency 6edium Res1onse #ime $ -our Resolution #ime 3 Business ,ays Descri1tion ) +ncident will be assigned as F<riority 4evel 3G if the +ncident is characterised by any of the followingB +ncident aAecting less than $' )uthorised users and more than 3 users. "he aAected environment is a production environment which supports non>core business functions and no workaround is available. ) short term backup or bypass has been made available, and the service level is acceptable. ) minimal service impact to users like the performance is impaired. & Synergycentric Sdn Bhd' (ersion ! Page !+ of !) Incident Management Release 1 1 st October 2014 7o ;evenue 4oss to ";),!W+7,S. Descri1tion of urgency C*ediumD +t is the level that aAects a team !.g. ) network disconnects to 3>$' business users and they would not be able to access the applications. ) slow network performance issue which degrades the operations of a particular branch. Severity <( %rgency 4ow Res1onse #ime $ -our Resolution #ime H Business ,ays Descri1tion ) +ncident will be assigned as F<riority 4evel (G if the +ncident is characterised by any of the followingB +ncident aAecting '>3 )uthorised users of ";),!W+7,S. "he aAected environment is a production environment which supports non>core business functions and workaround is available )n alternate solutionDplanDresource etc is available. 7o ;evenue 4oss to ";),!W+7,S. Descri1tion of urgency Co:D +t is the level aAecting individuals !.g.B> )utomation tool error installed on individual & Synergycentric Sdn Bhd' (ersion ! Page !, of !) Incident Management Release 1 1 st October 2014 <5 or 7otebook <roblem with speci#c con#guration of the desktop +ndividual user access issues -ardware 8aulty > work around available e.g. printing problems & Synergycentric Sdn Bhd' (ersion ! Page !) of !)