Incident Management Training

Incident
Management
ISD Division
ITIL
Office of State Finance

Contents
Purpose of Incident Management
Process
Escalation Guidelines
Policy
2
Contents
Purpose of Incident Management
3
Terms (Service Operations)
1 2 3
Incident Problem Service Request
Something is broken or about Underlying “root-cause.” Routine pleas for help – but
to break. nothing is broken. These
Remains open until include items like “can you tell
Repair as quickly as possible. underlying issue is resolved. me Joe Blow’s phone
number”, “can you unlock my
Open incidents are measured Open Problems are not account”, and “will you reset
against SLAs. measured against SLAs. my password.”
Creates “work-arounds.”
ITIL Training
Incident Guidelines
Since an incident is always related to a production

process or product that is not functioning as it once
was, it is critical to perform triage and resolve the most
serious incidents as quickly as possible, leaving the less
serious ones to be resolved as time allows.
Incidents do not need prior approvals to be worked and

resolved. They only need to be prioritized to work the
most critical incidents first.
In most cases incidents should be worked and resolved

before time is allocated to fulfill service requests. High
priority service requests may be worked before low
priority incidents.
5
Incident Prioritization
Before an incident can be prioritized, the impact and severity

must be assessed.
Incident Priority Severity

3-Low 2-Medium 1-High
Impact: People & Service User cannot User cannot perform Major portion of a
perform a portion critical time critical service is
Severity: Time of their duties. sensitive functions unavailable
 One or two personnel
3-Low
 Degraded Service Levels but still

processing within SLA constraints 3-Low 3-Low 2-Medium
 Multiple personnel in one physical

2-Medium
location
Impact
 Degraded Service Levels at or below

SLA constraints 2-Medium 2-Medium 1-High
 Cause of incident falls across multiple
functional areas
 All users of a specific service
 Personnel from multiple agencies are
1-High
affected
 Public facing service is unavailable 1-High 1-High 1-High
 Any item listed in the Crisis Response
tables
6
Incident Service Level Targets
Priority Target
Response Resolve
3 - Low 90% - 24 hours 90% - 7 days*
2 - Medium 90% - 2 hours 90% - 4 hours
1 - High 95% - 15 minutes 90% - 2 hours
Although desirable, it is not always possible to resolve all incidents within the target
time frame. For this reason, for SLA purposes, the success rate to resolve incidents
by the target time frame is not expected to be 100%
7
Contents
Process
8
Process Flow
Incident Management Process Flow
1a- 1b- 1c- 1d-

Source
Event Web User Email

Management Interface Phone Call Technical Staff
9
8 10
2 Request Priority 1 17
Incident Yes Notify Senior
Incident Identification Fulfillment (major) Close Incident
Prioritization Staff
Incident?
Yes No Yes
7
Service Desk
3 5 No 11 16
Relate to existing
Incident Service Initial Customer
open cases and set
Logging Request? Diagnosis Satisfied?
impact appropriately.
No Yes
6
4 12 15
Same issue
Incident Info in Knowledge Verify Resolution with
reported by
Categorization Base? Customer
others?
No
13
14
Continued
Resolution &
Provider
Investigation &
Service
Recovery
Group
Explanation of chart Diagnosis
on following pages Yes
9
Process Flow - Identification
 Service Desk will collect all

available information about the
issue.
 The information will be logged.
 Before continuing the Service
Desk will verify the related
service having the issue and
correlate it with an existing
service and SLA.
 If the case is not actually an
incident, but a service request,
the Service Desk will continue
the case under the Service
Request Process guidelines.
 After incident verification,
Service Desk will attempt to
establish incident severity and
impact which define priority.
10
Process Flow – Analyze &
Resolve
 If this is a major incident, the

Service Desk will notify senior
management immediately.
 Information on how to resolve
many incidents is contained in
the Knowledge Base within
CRM. If the information is
present, the Service Desk will
attempt to resolve.
 The Service Provider Group will
continue the diagnosis until a
solution or workaround is
available and verify solution
with customer.
 If customer is satisfied, the
Service Desk will close the
case.
11
Contents
Escalation Guidelines
12
Purpose of Escalation Process
 By “escalation” we mean:
The Service Desk broadens awareness and status of
incident, particularly to management and customers
Incident
Handling
Service
Desk
Management
& Customers
13
Purpose of Escalation Process
Establish a standard method of

escalation and notification across all
services, platforms, and functions
Restore
Communicate Minimize the
normal
incident adverse
service
status to the impact on
operations as
affected business
quickly as
customer operations
possible
14
Concept
Components of
Incident Escalation
Severity: How
much time can
Incident:
Impact: Users elapse before the
Something is
and/or services incident creates
broken or is
affected a significant
about to break.
business
impediment?
15
Concept – Always an Exception
The following should always be escalated with a

high priority:
 Agency executive level person (or their
representative)
•
Governor’s / Lt. Governor’s office
•
Exec branch of Oklahoma State government
•
Cabinet Secretaries
•
Agency directors (or deputy agency directors
representing the agency director)
The following should always be escalated with a
medium/high priority (CTO and ISD Managers are
notified via email):
 Security breach
16
Escalation Process
17
Time Guidelines
Priority Time Limit before Escalation by

Service Desk
3-Low 3 business days Manager
4 hours Manager
If on-call contact cannot be Manager
reached during non-business
hours
2-Medium If neither on-call contact or their CTO & ISD
manager cannot be reached Mgt
during non-business hours
48 hours CTO & ISD
Mgt
Immediate Manager
1-High
Immediate Senior Mgt
18
Guidelines
Critical starting point!

Log the case with as much detail as is
available.
Notifications
Escalation
(Service Desk)
Log Incident with the

Service Desk!
19
Escalation Notifications
The default mechanism for

notification will be by email
unless otherwise specifically
stated.
Whenever escalation or
notification by phone is
indicated, the Service Desk
will utilize all known
numbers for contact,
leaving voice mail on each
until person is contacted.
20
Senior management notification will include CIO,

CTO, and all functional managers.
Escalation of a case does not remove the assignment

from an individual. The provider group manager will
make certain the right personnel are assigned.
Any time a case is escalated, the case will be

updated to reflect the escalation and the following
notifications will be performed by the Service Desk:
21
Notifications - 2-Medium
Escalation Severity
Priority 3-Low 2-Medium 1-High
3-Low 3-Low 3-Low 2-Medium
Impac
t
2-Medium 2-Medium 2-Medium 1-High
Upon discovery of the incident, the Service Desk will notify the
Director, CTO, and managers of the Information Services Team within
30 minutes by email using CRM’s interested parties function.
The person assigned to the case or the functional manager will update
notes on the case at least once daily.
The customer will be notified via interested parties email of the

current status at least once daily using a case note with visibility set to
“all”.
The managers of all functional groups involved in resolving the case

will be notified each time the case is updated through the CRM
interested parties section.
22
Notifications - 2-Medium
Escalation Severity
Priority 3-Low 2-Medium 1-High
3-Low 3-Low 3-Low 2-Medium
Impac
t
2-Medium 2-Medium 2-Medium 1-High
Upon discovery of the incident, the CTO and managers of the

Information Services Team will be notified within 30 minutes by
email using CRM’s interested parties function.
The case will be updated with resolution status at least once daily
by person assigned to the case or the functional manager.
The customer will be notified via interested parties email of the

current status at least once daily.
The managers of all functional groups involved in resolving the

case will be notified each time the case is updated through the
CRM interested parties section.
23
Notifications – High
Escalation Severity
Priority 3-Low 2- 1-High
Medium
Impact
1-High 1-High 1-High 1-High
Upon discovery of an incident of high priority…Take time to log the

incident in with the Service Desk. The Service Desk will notify the Director
and CTO of the Information Services Division using CRM’s interested parties
function and by phone.
The managers will also be notified by email using CRM’s interested parties
function simultaneously with the Director and CTO email notifications.
Each time the case is updated, the senior management email notification will
be performed, again using the interested parties function of CRM.
24
Notifications – 1-High
Escalation Severity
Priority 3-Low 2- 1-High
Medium
Impact
1-High 1-High 1-High 1-High
Case updates with current status will be made a minimum

of every four hours between 8 AM & 5 PM. CRM will then
forward the updated status to the interested parties on
the case.
If the incident was reported by a customer, the person

reporting the incident will be notified by email or phone as
requested by the customer.
If the incident was not reported by the customer, or if

other agencies are impacted, notification should utilize
the contact information on record at the Service Desk to
notify the potentially impacted customers via method that
is still functional.
25
Update the case!

When new info is discovered, a plan of action is
devised, or resolved, update the case!
Notifications
Escalation
(Service Desk)
Update Incident Case

in CRM
26
Contents
Policy
27
Incident Policy
Incidents must be logged with the Service

Desk before they are worked.
Accept the assignment of the Case from

the Service Desk before working the case.
Update the case notes regularly as new

information is uncovered.
On the case note, set visibility to “All”

and set the note type appropriately.
28
Incident Policy
The case assignee is responsible for updating

the case status on the appropriate schedule.
Escalation notifications to the customer will

be performed by the Service Desk unless
otherwise determined by CTO.
Upon resolution of the incident, all persons

previously notified of an escalation will be
notified by CRM via the interested parties
function.
29
Incident Policy
In the event of a High escalation, all available

means of communication will be used by the
Service Desk to make successful contact with
support personnel and senior management.
Medium and High escalations will occur

regardless of business hours using the
appropriate methods of communication.
The escalation process does not remove the

responsibility from the assigned resource to
seek necessary assistance in resolving an
incident.
30

Incident Management Training

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Incident Management Training

Uploaded by

Copyright:

Available Formats

Incident

Office of State Finance

Purpose of Incident Management

Purpose of Incident Management

Since an incident is always related to a production

Incidents do not need prior approvals to be worked and

In most cases incidents should be worked and resolved

Before an incident can be prioritized, the impact and severity

Incident Priority Severity

 Degraded Service Levels but still

 Multiple personnel in one physical

 Degraded Service Levels at or below

2 - Medium 90% - 2 hours 90% - 4 hours

1 - High 95% - 15 minutes 90% - 2 hours

Incident Management Process Flow

1a- 1b- 1c- 1d-

Event Web User Email

Explanation of chart Diagnosis

on following pages Yes

 Service Desk will collect all

 If this is a major incident, the

Establish a standard method of

The following should always be escalated with a

Priority Time Limit before Escalation by

Critical starting point!

Log Incident with the

The default mechanism for

Senior management notification will include CIO,

Escalation of a case does not remove the assignment

Any time a case is escalated, the case will be

2-Medium 2-Medium 2-Medium 1-High

The customer will be notified via interested parties email of the

The managers of all functional groups involved in resolving the case

2-Medium 2-Medium 2-Medium 1-High

Upon discovery of the incident, the CTO and managers of the

The customer will be notified via interested parties email of the

The managers of all functional groups involved in resolving the

1-High 1-High 1-High 1-High

Upon discovery of an incident of high priority…Take time to log the

1-High 1-High 1-High 1-High

Case updates with current status will be made a minimum

If the incident was reported by a customer, the person

If the incident was not reported by the customer, or if

Update the case!

Update Incident Case

Incidents must be logged with the Service

Accept the assignment of the Case from

Update the case notes regularly as new

On the case note, set visibility to “All”

The case assignee is responsible for updating

Escalation notifications to the customer will

Upon resolution of the incident, all persons

In the event of a High escalation, all available

Medium and High escalations will occur

The escalation process does not remove the

You might also like