217557927.

doc

Page 1 of 18

Table of Contents
About this document..................................................................................................................................... 2 Who should use this document?............................................................................................................ 2 Summa ! of changes............................................................................................................................. 2 Cha"te 1. #ncident P ocess.......................................................................................................................... $ 1.1. P ima ! goal.................................................................................................................................... $ 1.2. P ocess %efinition&.......................................................................................................................... $ 1.'. (b)ecti*es + P o*ide a consistent " ocess to t ac, incidents that ensu es& ....................................$ 1.$. %efinitions....................................................................................................................................... $ 1.5. #ncident Sco"e................................................................................................................................ 1.-. #n"uts and (ut"uts ......................................................................................................................... 1.7. .et ics............................................................................................................................................ Cha"te 2. /oles and /es"onsibilities.......................................................................................................... 7 2.1. (S0 #S% Se *ice %es,................................................................................................................... 7 2.2. Se *ice P o*ide 1 ou"................................................................................................................... 7 Cha"te '. #ncident Catego i2ation3 Ta get Times3 P io iti2ation3 and 4scalation..........................................8 '.1. Catego i2ation................................................................................................................................. 8 '.2. P io it! %ete mination..................................................................................................................... 8 '.'. Ta get Times................................................................................................................................... 9 Cha"te $ P ocess 0lo5.............................................................................................................................. 16 $.1. #ncident .anagement P ocess 0lo5 Ste"s...................................................................................11 Cha"te 5. #ncident 4scalation.................................................................................................................... 1' 5.1. 0unctional 4scalation.................................................................................................................... 1' 5.2. 4scalation 7otifications&................................................................................................................ 1' 5.'. #ncident 4scalation P ocess&......................................................................................................... 1$ 5.$. #ncident 4scalation P ocess Ste"s&............................................................................................... 15 Cha"te -. /AC# Cha t................................................................................................................................ 1Cha"te 7. /e"o ts and .eetings............................................................................................................... 17 7.1. /e"o ts......................................................................................................................................... 17 Cha"te 8. #ncident Polic!........................................................................................................................... 18

About this document

This document desc ibes the #ncident P ocess. The P ocess " o*ides a consistent method fo e*e !one to follo5 5hen Agencies e"o t issues ega ding se *ices f om the (ffice of State 0inance #nfo mation Se *ices %i*ision 8(S0 #S%9.

Who should use this document?

This document should be used b!& (S0 #S% "e sonnel es"onsible fo the esto ation of se *ices (S0 #S% "e sonnel in*ol*ed in the o"e ation and management of #ncident P ocess

Summary of changes
This section eco ds the histo ! of significant changes to this document. (nl! the most significant changes a e desc ibed he e.

217557927.doc

Page 2 of 18

Version 1.6

Date

Author

Description of change #nitial *e sion

Whe e significant changes a e made to this document3 the *e sion numbe 5ill be inc emented b! 1.6. Whe e changes a e made fo cla it! and eading ease onl! and no change is made to the meaning o intention of this document3 the *e sion numbe 5ill be inc eased b! 6.1.

217557927.doc

Page ' of 18

Chapter 1. Incident Process

1.1. Primary goal
The " ima ! goal of the #ncident .anagement " ocess is to esto e no mal se *ice o"e ation as :uic,l! as "ossible and minimi2e the ad*e se im"act on business o"e ations3 thus ensu ing that the best "ossible le*els of se *ice :ualit! and a*ailabilit! a e maintained. ;7o mal se *ice o"e ation< is defined he e as se *ice o"e ation 5ithin S=A limits.

1. . Process Definition!
#ncident .anagement includes an! e*ent 5hich dis u"ts3 o 5hich could dis u"t3 a se *ice. This includes e*ents 5hich a e communicated di ectl! b! use s o (S0 staff th ough the Se *ice %es, o th ough an inte face f om 4*ent .anagement to #ncident .anagement tools.

1.". #b$ecti%es & Pro%ide a consistent process to trac' incidents that ensures!
#ncidents a e " o"e l! logged #ncidents a e " o"e l! outed #ncident status is accu atel! e"o ted >ueue of un esol*ed incidents is *isible and e"o ted #ncidents a e " o"e l! " io iti2ed and handled in the a"" o" iate se:uence /esolution " o*ided meets the e:ui ements of the S=A fo the custome

1.(. Definitions
1.(.1. Customer
A custome is someone 5ho bu!s goods o Se *ices. The Custome of an #T Se *ice P o*ide is the "e son utili2ing the se *ice "u chased b! the custome <s o gani2ation. The te m Custome s is also sometimes info mall! used to mean ?se s3 fo e@am"le Athis is a Custome focused ( gani2ationA.

1.(. . Impact
#m"act is dete mined b! ho5 man! "e sonnel o functions a e affected. The e a e th ee g ades of im"act& ' + =o5 B (ne o t5o "e sonnel. Se *ice is deg aded but still o"e ating 5ithin S=A s"ecifications 2 + .edium B .ulti"le "e sonnel in one "h!sical location. Se *ice is deg aded and still functional but not o"e ating 5ithin S=A s"ecifications. #t a""ea s the cause of the incident falls ac oss multi"le se *ice " o*ide g ou"s

1 + Cigh B All use s of a s"ecific se *ice. Pe sonnel f om multi"le agencies a e affected. Public facing se *ice is una*ailable The im"act of an incident 5ill be used in dete mining the " io it! fo esolution.

217557927.doc

Page $ of 18

1.(.". Incident
An incident is an un"lanned inte u"tion to an #T Se *ice o eduction in the >ualit! of an #T Se *ice. 0ailu e of an! #tem3 soft5a e o ha d5a e3 used in the su""o t of a s!stem that has not !et affected se *ice is also an #ncident. 0o e@am"le3 the failu e of one com"onent of a edundant high a*ailabilit! configu ation is an incident e*en though it does not inte u"t se *ice. An incident occu s 5hen the o"e ational status of a " oduction item changes f om 5o ,ing to failing o about to fail3 esulting in a condition in 5hich the item is not functioning as it 5as designed o im"lemented. The esolution fo an incident in*ol*es im"lementing a e"ai to esto e the item to its o iginal state. A design fla5 does not c eate an incident. #f the " oduct is 5o ,ing as designed3 e*en though the design is not co ect3 the co ection needs to ta,e the fo m of a se *ice e:uest to modif! the design. The se *ice e:uest ma! be e@"edited based u"on the need3 but it is still a modification3 not a e"ai .

1.(.(. Incident )epository

The #ncident /e"osito ! is a database containing ele*ant info mation about all #ncidents 5hethe the! ha*e been esol*ed o not. 1ene al status info mation along 5ith notes elated to acti*it! should also be maintained in a fo mat that su""o ts standa di2ed e"o ting. At (S0 #S%3 the incident e"osito ! is contained 5ithin Peo"leSoft C/..

1.(.*. Priority
P io it! is dete mined b! utili2ing a combination of the incident<s im"act and se*e it!. 0o a full e@"lanation of the dete mination of " io it! efe to the "a ag a"h titled P io it! %ete mination.

1.(.+. )esponse
Time ela"sed bet5een the time the incident is e"o ted and the time it is assigned to an indi*idual fo esolution.

1.(.,. )esolution
Se *ice is esto ed to a "oint 5he e the custome can "e fo m thei )ob. #n some cases3 this ma! onl! be a 5o , a ound solution until the oot cause of the incident is identified and co ected.

1.(.-. Ser%ice Agreement

A Se *ice Ag eement is a gene al ag eement outlining se *ices to be " o*ided3 as 5ell as costs of se *ices and ho5 the! a e to be billed. A se *ice ag eement ma! be initiated bet5een (S0D#S% and anothe agenc! o a non+state go*e nment entit!. A se *ice ag eement is distinguished f om a Se *ice =e*el Ag eement in that the e a e no ongoing se *ice le*el ta gets identified in a Se *ice Ag eement.

1.(... Ser%ice /e%el Agreement

(ften efe ed to as the S=A3 the Se *ice =e*el Ag eement is the ag eement bet5een (S0 #S% and the custome outlining se *ices to be " o*ided3 and o"e ational su""o t le*els as 5ell as costs of se *ices and ho5 the! a e to be billed.

1.(.10. Ser%ice /e%el 1arget

Se *ice =e*el Ta get is a commitment that is documented in a Se *ice =e*el Ag eement. Se *ice =e*el Ta gets a e based on Se *ice =e*el /e:ui ements3 and a e needed to ensu e that the #T Se *ice continues to meet the o iginal Se *ice =e*el /e:ui ements.

217557927.doc

Page 5 of 18

1.(.11. Se%erity
Se*e it! is dete mined b! ho5 much the use is est icted f om "e fo ming thei 5o ,. The e a e th ee g ades of se*e it!& ' + =o5 + #ssue " e*ents the use f om "e fo ming a "o tion of thei duties. 2 + .edium + #ssue " e*ents the use f om "e fo ming c itical time sensiti*e functions 1 + Cigh + Se *ice o ma)o "o tion of a se *ice is una*ailable

The se*e it! of an incident 5ill be used in dete mining the " io it! fo esolution.

1.*. Incident Scope

The #ncident " ocess a""lies to all s"ecific incidents in su""o t of la ge se *ices al ead! " o*ided b! (S0.

1.*.1. 23clusions
/e:uest fulfilment3 i.e.3 Se *ice /e:uests and Se *ice Catalog /e:uests a e not handled b! this " ocess. /oot cause anal!sis of o iginal cause of incident is not handled b! this " ocess. /efe to P oblem .anagement. The need fo esto ation of no mal se *ice su"e sedes the need to find the oot cause of the incident. The " ocess is conside ed com"lete once no mal se *ice is esto ed.

1.+. Inputs and #utputs

Input #ncident 8*e bal o 5 itten9 Catego i2ation Tables Assignment /ules 4rom Custome 0unctional 1 ou"s 0unctional 1 ou"s

#utput Standa d notification to the custome 5hen case is closed

1o Custome .

1.,. 5etrics
.et ic
P ocess t ac,ing met ics E of incidents b! t!"e3 status3 and custome B see detail unde )eports and 5eetings Purpose To dete mine if incidents a e being " ocessed in easonable time f ame3 f e:uenc! of s"ecific t!"es of incidents3 and dete mine 5he e bottlenec,s e@ist.

217557927.doc

Page - of 18

Chapter . )oles and )esponsibilities

/es"onsibilities ma! be delegated3 but escalation does not emo*e es"onsibilit! f om the indi*idual accountable fo a s"ecific action.

.1. #S4 ISD Ser%ice Des'

(5ns all e"o ted incidents 4nsu e that all incidents ecei*ed b! the Se *ice %es, a e eco ded in C/. #dentif! natu e of incidents based u"on e"o ted s!m"toms and catego i2ation ules su""lied b! " o*ide g ou"s P io iti2e incidents based u"on im"act to the use s and S=A guidelines /es"onsible fo incident closu e %elegates es"onsibilit! b! assigning incidents to the a"" o" iate " o*ide g ou" fo esolution based u"on the catego i2ation ules Pe fo ms "ost+ esolution custome e*ie5 to ensu e that all 5o , se *ices a e functioning " o"e l! and all incident documentation is com"lete P e"a e e"o ts sho5ing statistics of #ncidents esol*ed D un esol*ed

. . Ser%ice Pro%ider 6roup

Com"osed of technical and functional staff in*ol*ed in su""o ting se *ices Co ect the issue o " o*ide a 5o , a ound to the custome that 5ill " o*ide functionalit! that a"" o@imates no mal se *ice as closel! as "ossible. #f an incident eoccu s o is li,el! to eoccu 3 notif! " oblem management so that oot cause anal!sis can be "e fo med and a standa d 5o , a ound can be de"lo!ed

217557927.doc

Page 7 of 18

Chapter ". Incident Categori7ation8 1arget 1imes8 Prioriti7ation8 and 2scalation

#n o de to ade:uatel! dete mine if S=A<s a e met3 it 5ill be necessa ! to co ectl! catego i2e and " io iti2e incidents :uic,l!.

".1. Categori7ation
The goals of " o"e catego i2ation a e& #dentif! Se *ice im"acted and a"" o" iate S=A and escalation timelines #ndicate 5hat su""o t g ou"s need to be in*ol*ed P o*ide meaningful met ics on s!stem eliabilit!

0o each incident the s"ecific se *ice 8as listed in the "ublished Se *ice Catalog9 5ill be identified. #t is c itical to establish 5ith the use the s"ecific a ea of the se *ice being " o*ided. 0o e@am"le3 if it<s Peo"leSoft3 is it 0inancial3 Cuman /esou ces3 o anothe a ea? #f it<s Peo"leSoft 0inancials3 is it fo 1ene al =edge 3 Accounts Pa!able3 etc.? #dentif!ing the se *ice " o"e l! establishes the a"" o" iate Se *ice =e*el Ag eement and ele*ant Se *ice =e*el Ta gets. #n addition3 the se*e it! and im"act of the incident need to also be established. All incidents a e im"o tant to the use 3 but incidents that affect la ge g ou"s of "e sonnel o mission c itical functions need to be add essed befo e those affecting 1 o 2 "eo"le. %oes the incident cause a 5o , sto""age fo the use o do the! ha*e othe means of "e fo ming thei )ob? An e@am"le 5ould be a b o,en lin, on a 5eb "age is an incident but if the e is anothe na*igation "ath to the desi ed "age3 the incident<s se*e it! 5ould be lo5 because the use can still "e fo m the needed function. The incident ma! c eate a 5o , sto""age fo onl! one "e son but the im"act is fa g eate because it is a c itical function. An e@am"le of this scena io 5ould be the "e son " ocessing "a! oll ha*ing an issue 5hich " e*ents the "a! oll f om " ocessing. The im"act affects man! mo e "e sonnel than )ust the use .

". . Priority Determination

The " io it! gi*en to an incident that 5ill dete mine ho5 :uic,l! it is scheduled fo esolution 5ill be set de"ending u"on a combination of the incident se*e it! and im"act. #ncident P io it! Se*e it! ' + =o5 #ssue " e*ents the use f om "e fo ming a "o tion of thei duties. 2 + .edium #ssue " e*ents the use f om "e fo ming c itical time sensiti*e functions ' + =o5 1 + Cigh Se *ice o ma)o "o tion of a se *ice is una*ailable 2 + .edium

' + =o5

#m"act

(ne o t5o "e sonnel %eg aded Se *ice =e*els but still " ocessing 5ithin S=A const aints

' + =o5

217557927.doc

Page 8 of 18

2 + .edium

.ulti"le "e sonnel in one "h!sical location %eg aded Se *ice =e*els but not " ocessing 5ithin S=A const aints o able to "e fo m onl! minimum le*el of se *ice #t a""ea s cause of incident falls ac oss multi"le functional a eas All use s of a s"ecific se *ice Pe sonnel f om multi"le agencies a e affected Public facing se *ice is una*ailable An! item listed in the C isis /es"onse tables

2 + .edium

2 + .edium

1 + Cigh

1 + Cigh

1 + Cigh

1 + Cigh

1 + Cigh

".". 1arget 1imes

#ncident su""o t fo e@isting se *ices is " o*ided 2$ hou s "e da!3 7 da!s "e 5ee,3 and '-5 da!s "e !ea . 0ollo5ing a e the cu ent ta gets fo es"onse and esolution fo incidents based u"on " io it!. P io it! Ta get /es"onse ' + =o5 2 + .edium 1 + Cigh 96F + 2$ hou s 96F + 2 hou s 95F + 15 minutes /esol*e 96F + 7 da!sG 96F + $ hou s 96F + 2 hou s

217557927.doc

Page 9 of 18

#ncident 1o*e nance P ocess

Chapter ( Process 4lo9

The follo5ing is the standa d incident management " ocess flo5 outlined in #T#= Se *ice ("e ation but e" esented as a s5im lane cha t 5ith associated oles 5ithin (S0 #S%.

217557927.doc

Page 16 of 18

#ncident 1o*e nance P ocess

(.1. Incident 5anagement Process 4lo9 Steps

)ole )e:uesting Customer Step 1 Description #ncidents can be e"o ted b! the custome o technical staff th ough *a ious means3 i.e.3 "hone3 email3 o a self se *ice 5eb inte face. #ncidents ma! also be e"o ted th ough the use of automated tools "e fo ming 4*ent .anagement. #ncident identification Wor' cannot begin on dealing 9ith an incident until it is 'no9n that an incident has occurred. As far as possible8 all 'ey components should be monitored so that failures or potential failures are detected early so that the incident management process can be started :uic'ly. #ncident logging All incidents must be full! logged and dateDtime stam"ed3 ega dless of 5hethe the! a e aised th ough a Se *ice %es, tele"hone call o 5hethe automaticall! detected *ia an e*ent ale t. All ele*ant info mation elating to the natu e of the incident must be logged so that a full histo ical eco d is maintained B and so that if the incident has to be efe ed to othe su""o t g ou"8s93 the! 5ill ha*e all ele*ant info mation at hand to assist them. #ncident catego i2ation All incidents 5ill elate to one of the "ublished se *ices listed in the Se *ice Catalog. #f the custome is calling about an issue the! ha*e that is not elated to one of the se *ices in the catalog3 then it is not an incident. #s this actuall! a Se *ice /e:uest inco ectl! catego i2ed as an incident? #f so3 u"date the case to eflect that it is a Se *ice /e:uest and follo5 the a"" o" iate Se *ice /e:uest " ocess. Cas this issue al ead! been e"o ted b! othe s? #f this is anothe "e son e"o ting the same issue3 elate the issue to the cases al ead! e"o ted. .o e "eo"le e"o ting the same issue means the im"act of the issue is b oade than 5hat might ha*e been e"o ted at fi st. The im"act needs to be eco ded base u"on cu ent ,no5ledge of the im"act. #ncident " io iti2ation Hefo e an incident " io it! can be set3 the se*e it! and im"act need to be assessed. See "a ag a"h '.2 #ncident P io iti2ation. (nce the se*e it! and im"act a e set3 the " io it! can be de i*ed using the " esc i"ti*e table. #s this a " io it! 1 8ma)o 9 incident? #f this is a " io it! 1 incident meaning that a se *ice is una*ailable in "a t o 5hole3 all mid le*el and senio (S0 D #S% management should be ale ted to ma,e ce tain an! esou ces necessa ! to the esolution 5ill be immediatel! made a*ailable. #nitial diagnosis #f the incident has been outed *ia the Se *ice %es,3 the Se *ice %es, anal!st must ca ! out initial diagnosis3 using diagnostic sc i"ts and ,no5n e o info mation to t ! to disco*e the full s!m"toms of the incident and to dete mine e@actl! 5hat has gone 5 ong. The Se *ice %es, e" esentati*e 5ill utili2e the collected info mation on the s!m"toms and use that info mation to initiate a sea ch of the Ino5ledge Hase to find an a"" o" iate solution. #f "ossible3 the Se *ice %es, Anal!st 5ill esol*e the incident and close the incident if the esolution is successful. #s the necessa ! info mation in the Ino5ledge Hase to esol*e the incident? #f not3 the case should then be assigned to the " o*ide g ou" that su""o ts the se *ice.

#S4 ISD Ser%ice Des'

217557927.doc Page 11 of 18

#ncident 1o*e nance P ocess

)ole

Step

Description #f the necessa ! info mation to esol*e the incident is not in the Ino5ledge Hase3 the incident must be immediatel! assigned to an a"" o" iate " o*ide g ou" fo fu the su""o t. The assignee 5ill then esea ch the issue to dete mine cause and emediation o"tions. Afte a "ossible esolution has been dete mined eithe f om the Ino5ledge Hase o th ough esea ch3 attem"t the esolution. Je if! 5ith the custome that the esolution 5as satisfacto ! and the custome is able to "e fo m thei 5o ,. An incident esolution does not e:ui e that the unde ling cause of the incident has been co ected. The esolution onl! needs to ma,e it "ossible fo the custome to be able to continue thei 5o ,. #f the custome is satisfied 5ith the esolution3 " oceed to closu e3 othe 5ise continue in*estigation and diagnosis. #ncident Closu e The Se *ice %es, should chec, that the incident is full! esol*ed and that the use s a e satisfied and 5illing to ag ee the incident can be closed. The Se *ice %es, should also chec, the follo5ing& Closure categori7ation. Chec, and confi m that the initial incident catego i2ation 5as co ect o 3 5he e the catego i2ation subse:uentl! tu ned out to be inco ect3 u"date the eco d so that a co ect closu e catego i2ation is eco ded fo the incident B see,ing ad*ice o guidance f om the esol*ing g ou"8s9 as necessa !. ;ser satisfaction sur%ey. Ca ! out a use satisfaction call+bac, o e+mail su *e! fo the ag eed "e centage of incidents. Incident documentation. Chase an! outstanding details and ensu e that the #ncident /eco d is full! documented so that a full histo ic eco d at a sufficient le*el of detail is com"lete. #ngoing or recurring problem? %ete mine 8in con)unction 5ith esol*e g ou"s9 5hethe it is li,el! that the incident could ecu and decide 5hethe an! " e*enti*e action is necessa ! to a*oid this. #n con)unction 5ith P oblem .anagement3 aise a P oblem /eco d in all such cases so that " e*enti*e action is initiated. 4ormal closure. 0o mall! close the #ncident /eco d.

#S4 ISD Ser%ice Des'

217557927.doc Page 12 of 18

#ncident 1o*e nance P ocess

Chapter *. Incident 2scalation

Acco ding to #T#= standa ds3 although assignment ma! change3 o5ne shi" of incidents al5a!s esides 5ith the Se *ice %es,. As a esult3 the es"onsibilit! of ensu ing that an incident is escalated 5hen a"" o" iate also esides 5ith the Se *ice %es,. The Se *ice %es, 5ill monito all incidents3 and escalate them based on the follo5ing guidelines& P io it! Time =imit befo e 4scalation ' + =o5 ' business da!s .anage 2 + .edium $ hou s .anage #f on+call contact cannot be eached du ing non+ business hou s #f neithe on+call contact o thei manage cannot be eached du ing non+business hou s $8 hou s #mmediate #mmediate .anage Senio .gt Senio .gt .anage Senio .gt

1 + Cigh

*.1. 4unctional 2scalation

(S0 #S% does not em"lo! an official tie ed su""o t s!stem that utili2es escalation f om one " o*ide g ou" to anothe . When the Se *ice %es, ecei*es notification of an incident3 the! a e to "e fo m the initial identification and diagnosis to classif! the incident acco ding to se *ice catego ! and " io iti2ation. #f the incident is a ,no5n " oblem 5ith a ,no5n solution3 the Se *ice %es, 5ill attem"t a esolution. #f it is not a ,no5n " oblem o if the attem"ted solution fails3 the! 5ill delegate es"onsibilit! fo an incident to an a"" o" iate " o*ide g ou".

*. . 2scalation <otifications!
An! time a case is escalated3 notification 5ill occu to *a ious indi*iduals o g ou"s de"ending u"on the " io it! of the incident. 0ollo5ing a e basic guidelines fo notifications& The default mechanism fo notification 5ill be b! email unless othe 5ise s"ecificall! stated. Whene*e escalation o notification b! "hone is indicated3 all ,no5n numbe s fo contact should be utili2ed3 lea*ing *oice mail on each until "e son is contacted. The maste sou ce fo on call info mation 5ill be the on+call files located in the #&K0unctionK(nCall folde . Senio management notification 5ill include C#(3 CT(3 and all functional manage s. 4scalation of a case does not emo*e the assignment f om an indi*idual. #t is u" to the manage of the " o*ide g ou" to ma,e ce tain the ight "e sonnel a e assigned. When additional "e sonnel need to be in*ol*ed3 the! ma! be added as inte ested "a ties. An! time a case is escalated3 the case 5ill be u"dated to eflect the escalation and the follo5ing notifications 5ill be "e fo med b! the Se *ice %es,& Custome 5ill ecei*e a standa d escalation email info ming them of the escalation. Pe son to 5hom case is cu entl! assigned 5ill be notified. .anage of functional g ou" to 5hom case is cu entl! assigned 5ill be notified

217557927.doc Page 1' of 18

#ncident 1o*e nance P ocess

*.". Incident 2scalation Process!

217557927.doc Page 1$ of 18

#ncident 1o*e nance P ocess

*.(. Incident 2scalation Process Steps!

All escalation " ocess ste"s a e "e fo med b! the Se *ice %es,. Some of the ste"s ma! be automated. Step Description 4@amine all o"en incidents and dete mine actions based u"on incident " io it!. Is this a priority 1 =high priority> incident? #f it is a high " io it! incident3 immediatel! notif! (S0 D #S% mid le*el and senio management "e sonnel. Senio management "e sonnel should be contacted b! "hone. .onito the status of the " io it! 1 incident " o*iding info mational u"dates to management at a minimum of e*e ! $ hou s. Cas the incident been esol*ed? #f not continue to monito . #f the incident has been esol*ed3 notif! (S0 D #S% mid le*el and senio management of the esolution. Senio management should be notified b! "hone du ing business hou s. #s this a " io it! 2 8medium " io it!9 incident? #f so3 notif! the manage of the " o*ide g ou" "e fo ming the esolution. 7otification should be b! email. Cas the incident occu ed du ing business hou s o off hou s? #f du ing business hou s3 " oceed to ste" 1$. #f the incident occu ed du ing off hou s3 is the on call "e son a*ailable? #f the on call "e son is not a*ailable3 call the manage of the " o*ide g ou" assigned fo esolution. #s the manage of the " o*ide g ou" a*ailable? #f neithe the " o*ide g ou" on+call "e son o the manage of the " o*ide g ou" is a*ailable3 notif! senio management *ia email and "hone. Cas the time limit to esol*e the incident ela"sed? #f the time limit to esol*e has ela"sed3 notif! the manage of the " o*ide g ou" *ia email. Continue to monito the incident Cas the incident been esol*ed? #f the incident has been esol*ed notif! the custome and all "e sonnel " e*iousl! contacted of the esolution.

217557927.doc Page 15 of 18

#ncident 1o*e nance P ocess

Chapter +. )ACI Chart

#bligation )es"onsible Accountable 8onl! 1 "e son9 Consulted Info med )ole Description /es"onsible to "e fo m the assigned tas, Accountable to ma,e ce tain 5o , is assigned and "e fo med Consulted about ho5 to "e fo m the tas, a"" o" iatel! #nfo med about ,e! e*ents ega ding the tas, #S4 Ser%ice Des' 5gr A AD/

Acti%ity

SP6 5gr

SP6 S52?s

SP6 1eam

Ser%ice Des' /

1 /eco d #ncident in C/. 2 Acce"t #nfo mation f om Custome ' $ 5 7 8 9 1 6 1 1

/ / /

217557927.doc

Page 1- of 18

#ncident 1o*e nance P ocess

Chapter ,. )eports and 5eetings

A c itical com"onent of success in meeting se *ice le*el ta gets is fo (S0 D #S% to hold itself accountable fo de*iations f om acce"table "e fo mance. This 5ill be accom"lished b! " oducing meaning e"o ts that can be utili2ed to focus on a eas that need im" o*ement. The e"o ts must then be used in coo dinated acti*ities aimed at im" o*ing the su""o t.

,.1. )eports
,.1.1. Ser%ice Interruptions
A e"o t sho5ing all incidents elated to se *ice inte u"tions 5ill be e*ie5ed 5ee,l! du ing the o"e ational meeting. The "u "ose is to disco*e ho5 se ious the incident 5as3 5hat ste"s a e being ta,en to " e*ent eoccu ence3 and if oot cause needs to be "u sued.

,.1. . 5etrics
.et ics e"o ts should gene all! be " oduced monthl! 5ith :ua te l! summa ies. .et ics to be e"o ted a e& Total numbe s of #ncidents 8as a cont ol measu e9 H ea,do5n of incidents at each stage 8e.g. logged3 5o , in " og ess3 closed etc9 Si2e of cu ent incident bac,log 7umbe and "e centage of ma)o incidents .ean ela"sed time to achie*e incident esolution o ci cum*ention3 b o,en do5n b! im"act code Pe centage of incidents handled 5ithin ag eed es"onse time as defined b! S=A<s o #S% standa ds 7umbe of incidents eo"ened and as a "e centage of the total 7umbe and "e centage of incidents inco ectl! assigned 7umbe and "e centage of incidents inco ectl! catego i2ed Pe centage of #ncidents closed b! the Se *ice %es, 5ithout efe ence to othe le*els of su""o t 8often efe ed to as ;fi st "oint of contact<9 7umbe and "e centage the of incidents " ocessed "e Se *ice %es, agent 7umbe and "e centage of incidents esol*ed emotel!3 5ithout the need fo a *isit H ea,do5n of incidents b! time of da!3 to hel" "in"oint "ea,s and ensu e matching of esou ces.

,.1.". 5eetings
The >ualit! Assu ance .anage 5ill conduct sessions 5ith each se *ice " o*ide g ou" to e*ie5 "e fo mance e"o ts. The goal of the sessions is to identif!& P ocesses that a e 5o ,ing 5ell and need to be einfo ced. Patte ns elated to incidents 5he e su""o t failed to meet ta gets /eoccu ing incidents 5he e the unde l!ing " oblem needs to be identified and esolution acti*ities a e "u sued #dentification of 5o , a ound solutions that need to be de*elo"ed until oot cause can be co ected
Page 17 of 18

217557927.doc

#ncident 1o*e nance P ocess

Chapter -. Incident Policy

The #ncident " ocess should be follo5ed fo all incidents co*e ed b! an e@isting se *ice ag eement3 ega dless of 5hethe the e:uest is e*entuall! managed as a " o)ect o th ough the #ncident " ocess. Su""o t fo o enhancement of e@isting se *ices identified in e@isting Se *ice Ag eements e:ui es an #ncident case to be o"ened. #f (S0 #S% al ead! " o*ides a se *ice to a custome 3 but that custome 5ants to significantl! e@"and that se *ice be!ond the e@isting cost su""o t model in "lace3 the e:uest should be t eated as a Se *ice Catalog /e:uest and fo 5a ded to the (S0 Se *ice %es,. #ncidents should be " io iti2ed based u"on im"act to the custome and the a*ailabilit! of a 5o ,a ound. L#ncident (5ne shi" emains 5ith the Se *ice %es,M /ega dless of 5he e an incident is efe ed to du ing its life3 o5ne shi" of the incident emains 5ith the Se *ice %es, at all times. The Se *ice %es, emains es"onsible fo t ac,ing " og ess3 ,ee"ing use s info med and ultimatel! fo #ncident Closu e.N B ITIL Service Operation /ules fo e+o"ening incidents + %es"ite all ade:uate ca e3 the e 5ill be occasions 5hen incidents ecu e*en though the! ha*e been fo mall! closed. #f the incident ecu s 5ithin one 5o ,ing da! then it can be e+o"ened B but that be!ond this "oint a ne5 incident must be aised3 but lin,ed to the " e*ious incident8s9. Wo , a ounds should be in confo mance 5ith (S0 #S% standa ds and "olicies.

217557927.doc Page 18 of 18