80 •• •• •• •• •• ITIL® OPERATIONAL SUPPORT AND ANALYSIS CERTIFICATION KIT BOOK — THIRD EDITION The chronological order these steps should be taken in, with any dependencies or coprocessing defined Responsibilities—who should do what Timescales and thresholds for completion of actions Escalation procedures—who should be contacted and when Any necessary evidence-preservation activities Any service management tools that are used for Event and Incident Management should be utilized with the defined incident models that can automate the handling, management, and escalation of the process. Specialized incidents include those that need routing to particular groups or ITIL® processes.
An example of this is for capacity related incidents, in which the model would define what impact reduction measures could be performed before routing the incident to Capacity Management. Major Incidents For those incidents that result in significant or organization-wide business impact, planning needs to consider how separate procedures should be used with shorter timescales and greater urgency to provide appropriate response and resolution.
The first requirement is to define what constitutes a major incident for the organization and customers, with reference to the incident prioritization mechanisms that are used. The key role of separate major incident procedures is to establish a fast and coordinated response that can manage and resolve the issues at hand.
This may require the establishment of a team with the immediate focus of resolving the incident and reducing the associated business impact.
The Service Desk maintains responsibility throughout the process so that users are kept fully informed of the incident status and progress for resolution. Copyright The Art of Service I Brisbane, Australia I Email: email@example.com Web: http://store.theartofservice.com I eLearning: http://theartofservice.org I Phone: +61 (0) 7 3252 2055 81 Problem Management will usually be involved when major incidents occur, though the focus is not the resolution of the incident.
Instead, Problem Management seeks to identify the root cause of the incident, how this can be removed, and if there are any other areas of the infrastructure where this could occur (eg, replicated infrastructure across multiple locations). Incident Status Tracking Incidents have a beginning and an end.
The beginning typically coincides with the opening of an incident in the Incident Management system, and the end of an incident occurs when the incident record closes.
In between these two events, an incident has its own lifecycle with several states it can be in.
The state of the incident is represented by a status code and allows better management over all incidents.
Examples of these status codes might include [ITIL Service Operation, page 75]: •• •• •• •• Open: An incident has been recognized but not yet assigned to a support resource for resolution In progress: The incident is in the process of being investigated and resolved Resolved: A resolution has been put in place for the incident but normal state service operation has not yet been validated by the business or end user Closed: The user or business has agreed that the incident has been resolved and that normal state operations have been restored Copyright The Art of Service I Brisbane, Australia I Email: firstname.lastname@example.org Web: http://store.theartofservice.com I eLearning: http://theartofservice.org I Phone: +61 (0) 7 3252 2055 82
Read more about Specialized incidents include those that need routing to particular groups or ITIL® processes: