Handbook
Griffith University
Version 1.7
Griffith University
Incident Management Process Handbook
Version History
Version
No
Issue Date
Nature of Amendment
Editor
0.3
July 2003
First draft
Patrick Keogh
(LucidIT)
0.4
8/3/2004
John Scullen
0.5
22/3/2004
John Scullen
0.6
24/3/2004
0.7
6/4/2004
Merril Rogers
1.0
20/4/2004
John Scullen
1.1
13/07/2006
Revision
1.2
02/10/2006
1.3
22/06/2007
Minor update
Sanja Tadic
1.4
29/09/2008
1.5
30/07/2010
Felicity Berends
Sanja Tadic
1.6
30/4/2013
Felicity Berends
Distribution
Ver #
0.4
Recipient
Andrew Bowness
Wendy Balachandran
Christine Schafer
Regina Obexer
Matt Maynard
Carol OFaircheallaigh
Carolyn Plant
Date issued
8/3/2004
ii
Griffith University
Incident Management Process Handbook
Karl Turnbull
Rowan Salt
Geoff Mitchell
Sandra Reis
0.6
ICTS-MT
Chris Walker
Paul Jardine
26/3/2004
0.7
Project Board
6/4/2004
Approval
1.0
21/4/2004
FYI
1.1
22/08/2006
Approval
1.1
12/09/2006
29/09/2006
FYI
1.5
31/08/2010
FYI
1,6
30/4/2013
FYI
iii
Griffith University
Incident Management Process Handbook
Print date
31 August 2010
Filename
335601873.doc
Author(s)
Patrick Keogh (Lucid IT Pty Ltd), Wendy Balachandran, John Scullen, Sanja Tadic,
Felicity Berends
iv
Griffith University
Incident Management Process Handbook
Table of Contents
1
Introduction......................................................................................3
1.1 Objective......................................................................................3
1.2 Scope...........................................................................................3
1.3 Document Structure.....................................................................3
Communication Framework.........................................................24
4.1 Communication Framework......................................................24
4.2 Relationship with Other Processes...........................................25
4.3 Incident Management & Problem Management........................25
4.4 Incident Management & Configuration Management................26
4.5 Incident Management & Service Level Management...............27
Performance Management............................................................28
Management Reports....................................................................29
6.1 Management Reports................................................................29
Process Review.............................................................................31
Griffith University
Incident Management Process Handbook
Griffith University
Incident Management Process Handbook
1 Introduction
The main goal of Incident Management is to restore normal service operation as
quickly as possible and minimise the adverse impact on business operations. Service
Desk as the first point of contact for Information Services clients is the owner of the
Incident Management Process. The main objective of Service Desk is to facilitate the
restoration of normal operational service with minimal business impact on the client
and within agreed service levels and business priorities.
These procedures are to be used by all Information Services staff handling Incidents
within the scope defined in section 2.2 Scope.
1.1 Objective
Information Services aims to achieve the following objectives with the Incident
Management Process:
Capture information about an incident at the start of the process
Clients have confidence in Information Services capability
Consistent processes for clients
Have clear procedures for clients on how to get help
Better management of, and alignment with, client expectations
A well defined scope of the Service Desk role which is clearly communicated
Analysis of incidents which will contribute to a better understanding of the
underlying issues
1.2 Scope
This Handbook documents the Incident Management Process including:
-
Griffith University
Incident Management Process Handbook
Section 3: Roles and Responsibilities The different roles within the Incident
Management Process are described. The responsibilities of each role are included.
Section 4: Communication Framework The communication aspects are
explained in more detail. Included is high level communication framework and the
relationship between Incident Management and other processes.
Section 5: Performance Management The Key Performance Indicators (KPIs)
for the Incident Management Process are described.
Section 6: Management Reports Information about the different management
reports is provided.
Section 7: Process Review Information about reviewing the Incident
management process.
The following Appendices are included at the end of the document:
Quick Reference Cards (QRC) for Service Desk and second and third tier support
groups.
-
Griffith University
Incident Management Process Handbook
2.2 Scope
An Incident is any event which is not part of the standard operation of the service and
which causes, or may cause, an interruption to, or a reduction of, the quality of the
service.
Only production systems, or systems connected to the production network, are covered
by the Incident Management process.
Excluded from the scope of this process are:
-
Development activities
Non-production activities (unless connected to the production network)
All unsupported functions as specified in Appendix D.
Griffith University
Incident Management Process Handbook
Urgency
Impact
Low
Medium
High
Low
Medium
High
The assessment methodology for the impact and the severity is explained in more
detail in the sections below.
2.3.1.1 Impact
Incidents will be placed into High, Medium and Low impact categories. The key factor
in measuring impact is the impact the incident has on the business. Each incident
will be reviewed on a case-by-case basis with appropriate impact assessment and
approval based on the following criteria.
Impact
Description
High
Medium
Low
Griffith University
Incident Management Process Handbook
2.3.1.2 Urgency
Incidents will be placed into High, Medium and Low urgency categories. The key factor
in measuring urgency is how severely the clients work process is affected. This
influences the timeframe that is allowed to resolve the incident. Each incident will be
reviewed on a case-by-case basis with appropriate severity assessment and approval
based on the following criteria.
Urgency
Description
High
Medium
Low
Griffith University
Incident Management Process Handbook
2. Acceptance,
Recording and
Classification
Service
Request ?
Activate
Change Management
process
Priority 1 ?
Activate
Priority 1 Incident
procedure
3. Initial Support
4. Investigation
and Diagnosis
5. Resolve Incident
Incident
Resolved ?
6. Incident
Escalation
7. Verify Resolution
and
Incident Closure
Griffith University
Incident Management Process Handbook
The Service Desk staff member classifies the incident according to impact and urgency
of the incident. Refer to the Impact/Urgency Matrix in 2.3.1 to help determine the
priority of the incident.
If an issue can be identified as a Request for Information (RFI) or a Request for
Change (RFC), the RFI & RFC process gets activated.
Griffith University
Incident Management Process Handbook
resolved. This will trigger an auto-generated email informing the client that their
incident has been resolved.
Part of this activity is updating Service Desk tool with the resolution information.
Accurate and complete recording of details is very important and is a requirement of all
parties involved in the Incident Management process. Quality information is critical for
future incident handling and restoration of normal business activities.
Griffith University
Incident Management Process Handbook
Research a solution
Mobilise a priority team
Request further details from the client
Advise action taken and provide an indication of the resolution time if required
Resolution Time is the target time for a resolution to an incident to be implemented.
Information Services aims to resolve at least 80% of incidents inside the resolution
times specified. This will allow for exceptional circumstances that cannot be met using
the standard times. Official closure of the incident is dependent on the approval of the
client. Solution time therefore does not include the time taken for the client to contact
Information Services to give approval, as this could happen some time later.
Detection &
report to
Service Desk
Start Repair
Diagnosis
Finish Repair
Recovery
Incident
Incident
Detection
time
Response time
Repair time
Recovery
time
11
Griffith University
Incident Management Process Handbook
The following table provides an overview of response and resolution times for
incidents. The times listed below relate to response and resolution times of the support
groups involved during standard business hours, Mondays to Fridays. Time required by
external support service providers (non Information Services) or purchasing time
(should there be the need for the acquisition of parts and/or materials) is excluded.
Response Time
Resolution Time
Priority 1
30 minutes
4 hours
Priority 2
1 hour
8 hours
Priority 3
4 hours
12 hours
Priority 4
1 day
3 days
Priority 5
2 days
5 days
2.6 Escalation
Escalation can take place in two ways:
Vertical Escalation
Hierarchical Escalation
Horizontal Escalation
Functional Escalation
12
Griffith University
Incident Management Process Handbook
Method
Email generated by Service
Desk tool
2 = 6 hours
3 = 9 hours
4 = 2.25 days
5 = 3.75 days
100% - SLA
Breached
1 = 4 hours
2 = 8 hours
3 = 12 hours
4 = 3 days
5 = 5 days
Weekly
Note: 1 working day = 9 hours, 8am 5pm. The clock does not continue outside of
these hours for the purpose of escalation notification.
13
Griffith University
Incident Management Process Handbook
Table B
Priority
1&2
After
Immediately after
an incident has
been assigned to a
group or
transferred to
another group
Method
SDT Announcement is
created to notify INS staff
using SDT and or Griffith
University Community
30 minutes
(if Incident has not
been responded to
or appropriately
updated)
PVC (INS)
Group Manager of the
assigned group
Category Owner of the Incident
Category
Incident Management Process
Owner (Manager Library and IT
Help)
Service Desk Manager (Library
and IT Help Management
Team)
The Analyst the Incident is
assigned to
Business/Clients
14
Griffith University
Incident Management Process Handbook
Priority
After
has not been
responded to or
appropriately
updated)
Method
Desk tool
SDT Announcement is
updated with a progress
report of the Incident.
Update Library and IT Help
phone greeting to keep
clients informed on
progress of the incident.
Email from the relevant
Director/PVC (INS) might
be sent to all staff and all
students
Priority
1
After
Hourly (if Incident
has not been
responded to or
appropriately
updated)
Method
Business/Clients
SDT Announcement is
updated with a progress
report of the Incident.
Update Library and IT Help
phone greeting to keep
clients informed on
progress of the incident
Update email from the
relevant Director/PVC
(INS) might be sent to all
staff and all students
Immediately after an
incident has been
assigned to a group
or transferred to
another group
30 minutes after an
15
Griffith University
Incident Management Process Handbook
Priority
After
incident has been
assigned to a group
or transferred to
another group
group
Method
Desk tool
1 hour
(if Incident has not
been responded to
or appropriately
updated)
PVC (INS)
Group Manager of the
assigned group
Category Owner of the
Incident Category
Incident Management
Process Owner (Manager
Library and IT Help)
Service Desk Manager
(Library and IT Help
Management Team)
The Analyst the Incident is
assigned to
2 hours
(if Incident has not
been responded to
or appropriately
updated)
3-5
Immediately after an
incident has been
assigned to a group
or transferred to
another group
Business/Clients
16
Griffith University
Incident Management Process Handbook
Griffith University
Incident Management Process Handbook
2.7.4.2 Frequency
The frequency of the communication will be determined by the impact and severity of
the outage. Frequency of communication for priority one and two incidents is outlined in
the section 2.6.1 Incident Notification and Escalation, Table B above.
2.7.4.3 Content
The content will depend on the audience. Communication with the staff who are tasked
with the resolution of the incident will be internally focussed, detailed and will contain
clear actions and timelines. Communication with clients will focus on the impact and
what is being done to minimise the impact and resolve the incident. It should not
contain technical descriptions or detailed information about internal processes.
The content will focus on:
-
Email
Web page
Phone
Public Announcement System
18
Griffith University
Incident Management Process Handbook
Face to face (response team meetings, meetings with staff tasked with the
resolution of Incident, meetings with Information Services staff impacted by the incident ,
CTS Team Leaders informing staff in schools, Library staff informing clients in the Library,
etc.)
Printed notices
Notice boards
SMS message to key stakeholders advising them who to contact for more
information or updates
-
19
Griffith University
Incident Management Process Handbook
20
Griffith University
Incident Management Process Handbook
Service Desk provides first tier support. First tier support is responsible for:
Incident and service request registration
Initial support and classification
Resolution and recovery of incidents
Escalation of incidents when necessary
Monitoring of the status and progress toward resolution of all open incidents
Following up on behalf of clients about progress towards resolution
Monitoring of response and resolution times
Closure of incidents (This process has been automated. Please refer to 2.4.7)
Keeping affected clients informed about progress
Quality checking of closed incidents
Identifying the need for and creating/editing of Knowledge Base documents to
assist with a timely response for future incidents
(Pro-) Active relationship management with the clients
Communication with clients about Information Services issues and service
requests (status updates)
Advising and assisting Information Services clients to make best use of services
provided by Library and IT Help
Encouraging use of self-help resources
Note: Library and IT Help is Information Services product/service line that provides first
tier support for the majority of Information Services products and services.
For the purpose of Incident Management Process, Library and IT Help is defined as the
Service Desk. However, all groups involved in the resolution of Incidents and using
Service Desk tool have the responsibility to follow Service Desk processes. For
example, all groups using Service Desk tool should record Incidents they detect and
those Incidents reported to them by other groups within Information Services that are
not currently using Service Desk tool.
21
Griffith University
Incident Management Process Handbook
On site support
Technical support
with the following responsibilities:
Griffith University
Incident Management Process Handbook
Providing monitoring and diagnosis tools to Library and IT Help (Service Desk/First
Tier Support)
Creating, knowledge base documents and providing relevant training to Service
Desk staff
Providing any other information to Library and IT Help (Service Desk/First Tier
Support) to assist in incident classification, initial support and escalation
Accurate and complete recording of Incidents from and to other internal groups
within Information Services, using the Service Desk tool
Accurate and complete updating of activities and steps taken to resolve the
Incident.
Procedural Activities
1st
Tier
2nd
Tier
3rd
Tier
R
R
R
R
R
R
R
R
R
A
A
A
I
I
Service
Incident
Group
Desk
Management Managers
Manager
Process
Owner
Client
R,C
R,C
R,C
R,C
I,C
R,C
R,C
C,R
R
R
R
R,C
R
I
R,C
R
I
C,R
I
A
A
R
I
R
I
I
A
R
Explanation of Roles
Accountable
The person in this process who has the accountability for ensuring the overall
process is available, understood and performed correctly
Responsible
The person(s) who are expected to perform the prescribed activity, resolve and/or
escalate the related issues. Multiple levels within the matrix can do this
Consulted
The person(s) who are consulted before decisions are made or implementations
carried out
Informed
23
Griffith University
Incident Management Process Handbook
24
Griffith University
Incident Management Process Handbook
4 Communication Framework
This section consists of two parts:
1. Communication framework; In which the different communication lines between
Information Services and the business are described on an operational, tactical and
strategic level
2. Relationship with other processes; The input and output flows between Incident
Management and the other processes (Problem, Change, Configuration and
Service Level Management) are detailed in this section.
Strategic
Busine
ss
Directo
r
Exception Reporting
KPIs
INS Strategic Plan
Griffith Strategic Plan
Exception Reporting
KPIs
INS Strategic Plan
Griffith Strategic
Plan
INS Budget
SLAs
Business
Needs
SLAs
Business Manager
Tactical
Exception Reporting
Service Levels
Service Catalogue
SLA Reporting
Request for Service Outside SLA
Client Satisfaction Survey
Client Needs
Satisfaction Survey
Request for Service outside
SLA
SLAs
Operational
End User
PVC
(INS)
DSD
Incident Reporting
Incidents
Service Catalogue
Outages
Request for Service Outside SLA
Client Satisfaction Survey
Service Delivery News
Training
Exception Reporting
KPIs
INS Strategic Plan
Griffith Strategic Plan
Request for Service Outside
SLA
SLAs
Incident Reporting
Service Desk
25
Griffith University
Incident Management Process Handbook
Incident
Management
RFC
Service Desk
Service Level
Management
Incident
Problem
Management
Incident
IT Operations
Configuration
Management
RFC
Change
Management
The main input and output flows between Incident Management and the other
processes that will be implemented at Griffith University. (Problem, Change
Configuration and Service Level Management) are detailed in this section.
4.3.1.2 Output
Information provided to Problem Management by Incident Management includes:
error)
-
26
Griffith University
Incident Management Process Handbook
Change schedule
Status update of scheduled changes
Result of implemented changes (history)
4.3.2.2 Output
Information provided to Change Management by Incident Management includes:
-
Accepted RFCs
Advice on incidents resulting from an implemented change (feedback)
4.4.1.2 Output
Information provided to Configuration Management by Incident Management includes:
-
27
Griffith University
Incident Management Process Handbook
4.5.1.2 Output
Information provided to Service Level Management by Incident Management includes:
-
28
Griffith University
Incident Management Process Handbook
5 Performance Management
The following Key Performance Indicators (KPIs) have been set for the Incident
Management process:
-
scale)
received
-
29
Griffith University
Incident Management Process Handbook
6 Management Reports
In this section the management information provided by the Incident Management
process is specified.
Weekly
Monthly
All Exceptions
All Exceptions
All Exceptions
Critical Issues
Incident Summary
Availability of services
Open Incident
Closed Incident
Implemented Improvements
New Incident
Group Breakdown
Priority 1 Incident
Status
SLA Exceptions
Category
Priority
Service Group
30
Griffith University
Incident Management Process Handbook
Metric
Metric Use
Number of incidents
recorded per category (open
and closed)
Helps show which parts of the infrastructure are creating the most
incidents. Useful to identify areas that could require detailed analysis
to remove common problems.
Will show the workload per priority code and hence service level. This
data can be used to determine staffing levels, costs of services or the
review of the priority codes defined.
Percentage of incidents
resolved at first, second and
third tier.
Number of incidents
assigned per Information
Services group/staff member
(open and closed)
Show the amount of work that different staff members and groups are
processing
Apart from the specific metrics above the following reports can be made available.
Results of client satisfaction surveys
A summary of any major outages, the actions taken to fix the outage and steps to
ensure that this will not occur again.
31
Griffith University
Incident Management Process Handbook
7 Process Review
In order to maintain continuous improvement of the Incident Management process an
ongoing review is essential. Detailed Incident Management review should be
undertaken on a six monthly basis.
These reviews should take place to ensure quality is maintained or improved. The
following steps should take place for each review.
Gather data and information from the Service Desk tool, Client Satisfaction
Surveys and input from Incident Management staff. Input for the process review should be
pro-actively sought from the Information Services staff by the Library and IT Help Manager
(Incident Management Process Owner).
Analyse the data looking at areas such as, client satisfaction, suggestions from
staff and process metrics. Some specific metrics to look at include those listed in Sections 5
Performance Management" and 6 Management Reports and the following list.
Correct logging of incident data in terms of incident categories, priority and specific
information relating to the incident
Review of incident Management reports such as performance against service
levels.
State of the Incident Management Process Handbook (Up to date or awaiting
review)
Problems identified with the process
From the above analysis identify improvement opportunities and put forward a
report detailing the suggestions. This report should be submitted to the Information Services
Management.
Following approval for improvements documented in the above mentioned report a
Process Improvement Plan should be formulated for improvements.
Changes to the Incident Management process should be authorised by the
Change Management processes. Once authorised implementation of changes should occur.
Following an improvement project a Post Implementation Review should be carried
out. This review should look at all the reports analysed before to identify that improvements
have made a positive change.
32
Griffith University
Incident Management Process Handbook
33
Griffith University
Incident Management Process Handbook
34
Griffith University
Incident Management Process Handbook
35
Griffith University
Incident Management Process Handbook
Definition
INS
Information Services
ITIL
RFC
SLA
Definition
Business Manager
Change
Change Management
Change Manager
Classification
Configuration
Management
Incident
ITIL Definition: Any event that deviates from the standard and
expected operation of an IT system or service.
Incident Management
Incident Recording
36
Griffith University
Incident Management Process Handbook
Term
Definition
Incident Reporting
Information Services
(Information Services)
Information Technology
Infrastructure Library
(ITIL)
Information Services
Information Services
infrastructure
Information Services
service
Key Performance
Indicator (KPI)
Known Error
Problem
Problem Management
Process
Release Management
The process that has as primary focus to securely control the physical
and logical storage, management, distribution and implementation of
all software assets, ensuring that only currently authorised and quality
checked versions of software, are actually brought into use in the
production environment at minimal cost
37
Griffith University
Incident Management Process Handbook
Term
Definition
Service Catalogue
Service Desk
Service Level
Service Level
Agreement (SLA)
Service Level
Management
The process of regular communication with the client to find out their
requirements and to offer new services and technologies.
38
Griffith University
Incident Management Process Handbook
39