ITSM - Incident Management

Question 1

Define an ‘incident’

Answer 1

An incident can be defined as an unplanned interruption to an IT service or reduction in the quality of an IT service. Failure of a CI that has not yet affected service is also an incident.

Question 2

Define ‘incident management’

Answer 2

The process that handles all incidents. These may be failures, faults or bugs that are reported by users (generally via a call to the service desk) or technical staff, or that are automatically detected and reported by monitoring tools (as per the event management process)

Question 3

‘Incident management’ - recite basic concepts…

Answer 3

Timescales - agree on times limits and use them as targets in Operational Level Agreements (OLAs) and Underpinning Contracts (UCs)
Incident models - a way of pre-defining steps taken to handle the process of handling a certain incident type)
Impact - The effect of an incident upon business processes.
Urgency - A measure of how long before the incident will have significant impact on business processes.
Priority - A category for the relative importance of an incident (or ‘severity’ as we know it at IBM)
Major incidents - An MI is an incident where the degree of impact on the user community is extreme. MIs require a seperate procedure with shorter timeframes and higher urgency. Agree on what defines an MI.

Question 4

Recite ‘Incident management’ steps…

Answer 4

• Identification - Incident detected/reported
• Registration - Incident record is created (by the service desk)
• Categorisation - Logged by type, status, impact, SLA etc
• Prioritisation - Every incident gets an appropriate prioritisation code to determin how it is handled by tools/staff.
• Diagnosis - Carried out to discover full symptoms.
• Escalation - When the Service Desk cannot resolve the incident itself, the incident is escalated for further support (functional escalation). If incidents are more serious then the appropriate IT managers must be notified (hierachic escalation).
• Investigation and diagnosis - If there is no known solution, the incident is investigated.
• Resolution and recovery - Onc the solution has been found, the issue can be resolved.
• Incident closure - The SD should check that the incident is fully resolved and that the user is satisfied with the solution and that the incident can be closed.

Question 5

[Photo of Incident management flow, page 135]

Answer 5

[Photo of Incident management flow, page 135]

Question 6

List examples what inputs can trigger incidents

Answer 6

Via a call to the service desk
Via a form on a tool or via the intranet
Via event management tools

Question 7

List examples of outputs -

Answer 7

Incident Management reports
RFC
Workarounds
Problem reports
Service level reports
Request