incident management - u.s. department of veterans … · an incident is an unplanned interruption...

Incident Management

Process Asset Library Office of Information and Technology

Incident Management ii

Table of Contents Incident Management Process Map ........................................................ 1

Process: Incident Management ............................................................... 2 Incident Management Description and Goals.......................................................... 3

Description................................................................................................................. 3 Goals........................................................................................................................... 3

Incident Management RACI Information .................................................................. 4 Incident Management Associated Artifacts Information ........................................ 9 Incident Management Tools and Web Sites Information ....................................... 9 Incident Management Standards Information ......................................................... 9 Incident Management Process ................................................................................ 10

Process Activity Name: INM-01 Identify Incident ............................................... 10 Process Activity Name: INM-02 Event Management .......................................... 11 Process Activity Name: INM-03 Perform User Contact Management.............. 12 Process Activity Name: INM-03.01 Receive Customer Communication ......... 12 Process Activity Name: INM-03.02 Contact Record Exist? ............................... 13 Process Activity Name: INM-03.03 Validate User Contact Record .................. 14 Process Activity Name: INM-03.04 Create User Contact Record ..................... 15 Process Activity Name: INM-04 Log Incident...................................................... 16 Process Activity Name: INM-05 Categorize Incident ......................................... 17 Process Activity Name: INM-06 Prioritize Incident ............................................ 18 Process Activity Name: INM-07 Perform Initial Diagnosis ................................ 20 Process Activity Name: INM-08 First Contact Resolution? .............................. 21 Process Activity Name: INM-09 Escalate Incident ............................................. 22 Process Activity Name: INM-10 SWAT Eligible? ................................................ 23 Process Activity Name: INM-11 Convene Swift Action and Triage .................. 24 Process Activity Name: INM-12 Investigate and Diagnose ............................... 25 Process Activity Name: INM-13 Change Required?........................................... 27 Process Activity Name: INM-14 Resolve Incident .............................................. 27 Process Activity Name: INM-15 Change Management ...................................... 28 Process Activity Name: INM-16 Resolved? ......................................................... 29 Process Activity Name: INM-17 Close Incident .................................................. 30 Process Activity Name: INM-18 PBM Candidate? .............................................. 31 Process Activity Name: INM-19 Problem Management ..................................... 32

The links in this process map are inactive. Please scroll to view activity data. 1

Incident Management Process Map

Incident Management 2

Process: Incident Management Overview: The process map for Incident Management cycles through the following process and review activities:

INM-01 Identify Incident INM-02 Event Management INM-03 Perform User Contact Management INM-03.01 Receive Customer Communication INM-03.02 Contact Record Exist? INM-03.03 Validate User Contact Record INM-03.04 Create User Contact Record INM-04 Log Incident INM-05 Categorize Incident INM-06 Prioritize Incident INM-07 Perform Initial Diagnosis INM-08 First Contact Resolution? INM-09 Escalate Incident INM-10 SWAT Eligible? INM-11 Convene Swift Action and Triage INM-12 Investigate and Diagnose INM-13 Change Required? INM-14 Resolve Incident INM-15 Change Management INM-16 Resolved? INM-17 Close Incident INM-18 PBM Candidate? INM-19 Problem Management


Incident Management Description and Goals Description The Incident Management process provides details on restoring normal service operation as quickly as possible and minimizing the adverse impact on business operations, thus ensuring that the best possible levels of service quality and availability are maintained within Service Level Agreement (SLA) limits.

Goals The goals of Incident Management are:

To restore normal service operation within SLA limits

To provide effective and efficient management of the lifecycle of incidents cradle to grave

To follow Swift Action Triage (SWAT) Protocol, as applicable


Incident Management RACI Information The following describes the RACI information for this process:

INM-01 Identify Incident Responsible Role: Customer

Accountable Role: Incident Management Manager

Consulted Role: None Listed

Informed Role: Incident Management Analyst

INM-02 Event Management Responsible Role: Incident Management Analyst



Informed Role: None Listed

INM-03.01 Receive Customer Communication Responsible Role: Incident Management Analyst




INM-03.02 Contact Record Exist? Responsible Role: Incident Management Analyst




INM-03.03 Validate User Contact Record Responsible Role: Incident Management Analyst





INM-03.04 Create User Contact Record Responsible Role: Incident Management Analyst



Informed Role: Customer

INM-04 Log Incident Responsible Role: Incident Management Analyst




INM-05 Categorize Incident Responsible Role: Incident Management Analyst




INM-06 Prioritize Incident Responsible Role: Incident Management Analyst




INM-07 Perform Initial Diagnosis


Responsible Role: Incident Management Analyst


Consulted Role: Incident Management Assignment Group

Informed Role: Customer; Stakeholders

INM-08 First Contact Resolution? Responsible Role: Incident Management Analyst




INM-09 Escalate Incident Responsible Role: Incident Management Analyst




INM-10 SWAT Eligible? Responsible Role: Incident Management Analyst




INM-11 Convene Swift Action and Triage Responsible Role: Swift Action and Triage Commander





INM-12 Investigate and Diagnose Responsible Role: Incident Management Assignment Group

Accountable Role: Incident Management Analyst


Informed Role: Incident Management Manager; Stakeholders; Customer

INM-13 Change Required? Responsible Role: Incident Management Assignment Group




INM-14 Resolve Incident Responsible Role: Incident Management Assignment Group



Informed Role: Incident Management Analyst; Customer; Stakeholders

INM-15 Change Management Responsible Role: Incident Management Assignment Group

Accountable Role: None Listed



INM-16 Resolved? Responsible Role: Incident Management Assignment Group





INM-17 Close Incident Responsible Role: Incident Management Analyst




INM-18 PBM Candidate? Responsible Role: Incident Management Analyst




INM-19 Problem Management Responsible Role: Incident Management Analyst





Incident Management Associated Artifacts Information Associated Artifacts information (including hyperlinks) for this process includes:

Incident Ticket

Request for Change

Incident Management Tools and Web Sites Information The Tools and Web Sites associated with this process (including hyperlinks) include:

After Action Report Portal

Change Management (ChM)

Incident Management Standards Information Standards associated with this process (including hyperlinks) include:

Creating a Contact Record Process Document

Framework for Improving Critical Infrastructure Cybersecurity Draft Version 1.1

Incident Management Swift Action and Triage (SWAT) Standard Operating Procedure (SOP)

OI&T Incident Management Process Document


Incident Management Process Process Activity Name: INM-01 Identify Incident Previous Activities Process Begins

Next Activities INM-03 Perform User Contact Management

Description The Customer or the Event Management monitoring tool identifies an incident has occurred. The Customer or Event Management Tool discovers a Configuration Item or Service has been degraded or has an outage.

Input Identified Event

Output Incident Ticket

Associated Artifacts Incident Ticket

Responsible Role Customer

Accountable Role Incident Management Manager

Consulted Role None Listed

Informed Role Incident Management Analyst

Tools and Websites None Listed

Standards OI&T Incident Management Process Document

More Info Event Management monitoring tools are used in this process. There are variations of the tools listed in Event Management.


Process Activity Name: INM-02 Event Management Previous Activities Process Begins

Next Activities If "Return to EVM":

Event Management Process

Or

If "Remain in INM":

INM-03 Perform User Contact Management

Description There is a flow from the Event Management Process into the Incident Management Process to evaluate the event based on incident criteria. An incident is an unplanned interruption to an IT Service or a reduction in the quality of an IT Service; failure of a configuration item that has not yet impacted service is also an incident.

Input None Listed

Output Incident Ticket


Responsible Role Incident Management Analyst



Informed Role None Listed


Standards None Listed


More Info None Listed

Process Activity Name: INM-03 Perform User Contact Management Previous Activities INM-01 Identify Incident

Or

INM-02 Event Management

Next Activities INM-03.01 Receive Customer Communication

Description The sub-process Perform User Contact Management cycles through the following dependent activities:

- Receive Customer Communication

- Contact Record Exist?

- Validate User Contact Record

- Create User Contact Record

Process Activity Name: INM-03.01 Receive Customer Communication Previous Activities INM-03 Perform User Contact Management

Next Activities INM-03.02 Contact Record Exist?

Description The Incident Management Analyst receives notification of a Configuration Item or Service has been degraded or has an outage via the Event Management monitoring tools or from a customer. The Incident Management Analyst receives customer communication via phone, email, fax, Telecommunications Device for the Deaf (TDD), or through a system generated device.

Input Customer Communication

Incident Ticket

Output Verification of an existing user contact record

Associated Artifacts None Listed








More Info Global Address Listing (GAL), Incident and Service Management Tools are used in this process.

Process Activity Name: INM-03.02 Contact Record Exist? Previous Activities INM-03.01 Receive Customer Communication

Next Activities If "Yes":

INM-03.03 Validate User Contact Record

Or

If "No":

INM-03.04 Create User Contact Record

Description Incident Management Analyst determines if a Contact Record Exist (Yes) or does not exist (No).






Process Activity Name: INM-03.03 Validate User Contact Record Previous Activities INM-03.02 Contact Record Exist?

Next Activities INM-04 Log Incident

And

INM-05 Categorize Incident

And

INM-06 Prioritize Incident

And


Description The Incident Management Analyst validates the user contact record. If the communication is via the phone or the Telecommunications Device for the Deaf (TDD), the record is validated directly from the customer. If the communication is via any other method, the record is validated from the information within the Global Address Listing (GAL).

Input Existing user contact record

Output Validated record









More Info Global Address Listing (GAL), Incident Management Tools and Service Management Tools are used in this process.

Process Activity Name: INM-03.04 Create User Contact Record Previous Activities INM-03.02 Contact Record Exist?

Next Activities INM-04 Log Incident

And


And


And


Description If the customer does not have a User Contact record or a Global Address Listing, the Incident Management Analyst creates a New User Contact Record from the information provided by the customer.

Input Customer Communication

Output New User Contact Record






Informed Role Customer



Creating a Contact Record Process Document

More Info Global Address Listing (GAL), Incident and Service Management Tools are used in this process.

Process Activity Name: INM-04 Log Incident Concurrent Activities INM-05 Categorize Incident

And


And


Previous Activities INM-03.03 Validate User Contact Record

Or


Next Activities INM-08 First Contact Resolution?

Description The Incident Management Analyst logs the incident. All incidents must be fully logged and date/time stamped, regardless of whether they are raised through a service desk notification or whether automatically detected via an event alert. All relevant information relating to the nature of the incident must be logged so that a full historical record is maintained - and so that if the incident is referred to other support group(s), they have all relevant information at hand to assist them.

Input Event information

Incident information


Incident Ticket

Output Incident Ticket (new or updated)








More Info Service Management Tools are used in this process.

Process Activity Name: INM-05 Categorize Incident Concurrent Activities INM-04 Log Incident

And


And



Or




Description The Incident Management Analyst categorizes the incident. The initial logging must be properly categorized according to the Configuration Item or service affected. Proper categorization is important when reviewing incident types/frequencies to establish trends for use in Incident and Problem Management.



Incident Ticket

Output Categorized Incident Ticket









Process Activity Name: INM-06 Prioritize Incident Concurrent Activities INM-04 Log Incident

And


And




Or



Description The Incident Management Analyst Prioritizes the incident. An appropriate prioritization code determines how the incident is handled by support tools and support staff. Prioritization is determined by the urgency of the incident and the level of impact.



Incident Ticket

Output Prioritized Incident Ticket










Process Activity Name: INM-07 Perform Initial Diagnosis Concurrent Activities INM-04 Log Incident

And


And



Or



Description The Incident Management Analyst performs initial diagnosis. If the incident has been routed to the service desk, the Service Desk Analyst carries out initial diagnosis, tries to discover the full symptoms of the incident, and tries to determine exactly what has gone wrong and how to correct the incident. The Service Desk Analyst tries to resolve the incident while the user is still on the telephone, closes the incident if the resolution is successful, or escalates the incident. If the incident is escalated, the Service Desk Analyst provides the user the incident reference number and escalates the incident to the appropriate assignment group.



Incident Ticket

Output Incident Ticket (Updated)





Consulted Role Incident Management Assignment Group

Informed Role Customer; Stakeholders



More Info Known Error Database and Service Management Tools are used in this process.

Process Activity Name: INM-08 First Contact Resolution? Previous Activities INM-04 Log Incident

Or


Or


Or



INM-17 Close Incident

Or

If "No":

INM-09 Escalate Incident

Description The Incident Management Analyst determines if there is a First Contact Resolution (Yes) or not a First Contact Resolution (No).






Process Activity Name: INM-09 Escalate Incident Previous Activities INM-08 First Contact Resolution?

Next Activities INM-10 SWAT Eligible?

Description The Incident Management Analyst escalates the incident. There are potentially two types of escalation.

They are Functional and Hierarchical.

- Functional Escalation. As soon as it becomes clear that the Service Desk is unable to resolve the incident itself, the incident is escalated to the appropriate assignment group.

- Hierarchical Escalation. If incidents are of a serious nature, the appropriate IT managers, Senior OIT Leadership, and appropriate VA Leadership must be notified. Hierarchical escalation is also used if the Investigation and Diagnosis’ and ‘Resolution and Recovery’ steps have taken too long or proven too difficult.

Input Recorded Incident Ticket

Output Incident Ticket (Updated and Escalated)









More Info The incident may be escalated to Problem Management, IT Service Continuity Management, or other processes at any time during this activity.

If an Incident Ticket is escalated to the Problem Management process a new Problem Ticket Number is assigned.

Service Management Tools are used in this process.

Process Activity Name: INM-10 SWAT Eligible? Previous Activities INM-09 Escalate Incident


INM-11 Convene Swift Action and Triage

Or

If "No":

INM-12 Investigate and Diagnose

Description Incident Management Analyst determines if the incident is Swift Action Triage (SWAT) eligible (Yes) or not eligible (No).






Process Activity Name: INM-11 Convene Swift Action and Triage Previous Activities INM-10 SWAT Eligible?

Next Activities INM-12 Investigate and Diagnose

Description The Swift Action and Triage (SWAT) Commander convenes a Swift Action Triage (SWAT) team if the incident cannot be resolved at Tier 1 and the impact and urgency of the incident are defined as 'critical' or, certain high visibility incidents.

The Swift Action and Triage (SWAT) Commander, or designee, sends a meeting invite to the members of the SWAT Team to join an on-line meeting to troubleshoot and restore service from each functional workgroups perspective.

Once service is restored a Problem Management ticket is opened by the National Service Desk.

Input Recorded Incident Ticket

Output After Action Report

Incident Ticket (Updated and Escalated)


Responsible Role Swift Action and Triage Commander





Tools and Websites After Action Report Portal

Standards Incident Management Swift Action and Triage (SWAT) Standard Operating Procedure (SOP)

OI&T Incident Management Process Document


Process Activity Name: INM-12 Investigate and Diagnose Previous Activities INM-10 SWAT Eligible?

Or

INM-11 Convene Swift Action and Triage

Or

INM-16 Resolved?

Next Activities INM-13 Change Required?

Description The Incident Management Assignment Group investigates and diagnosis the incident. The assignment groups involved with the incident handling investigates and diagnoses the Incident Ticket. All activities should be fully documented in the incident record so that a complete historical record of all activities is maintained at all times. An investigation is likely to include such actions as:

- Establishing exactly what has gone wrong or being sought by the user.

- Understanding the chronological order of events.

- Confirming the full impact of the incident, including the number and range of Users/Veterans affected.

- Identifying any events that could have triggered the incident.

- Knowledge searches looking for previous occurrences by searching previous Incident/Problem Records and/or Known Error.


- Databases or manufacturers’/suppliers’ Error Logs or Knowledge Databases.

- Reviewing changes made to CI or Service.

Input Incident Ticket

Known Errors

Known Similar Incidents

Output Incident Ticket (Updated)

Request for Change

Associated Artifacts Request for Change

Incident Ticket

Responsible Role Incident Management Assignment Group

Accountable Role Incident Management Analyst


Informed Role Incident Management Manager; Stakeholders; Customer



More Info The incident may be escalated to Problem Management at any time during this activity, if needed.

Change Management Tools, Known Error Database, and Service Management Tools are used in the process.


Process Activity Name: INM-13 Change Required? Previous Activities INM-12 Investigate and Diagnose


INM-14 Resolve Incident

Or

If "No":

INM-16 Resolved?

Description The Incident Management Assignment Group determines if a Change is required (Yes) or not required (No).





Process Activity Name: INM-14 Resolve Incident Previous Activities INM-13 Change Required?

Next Activities INM-15 Change Management

Description The Incident Management Assignment Group resolves the incident. When a potential resolution has been identified, the fix is tested, properly documented, and approved before it is applied. The specific actions that are undertaken and the people who are involved in taking the recovery actions may vary, depending upon the nature of the fault.


Output Incident Ticket (Updated and Resolved)


Request for Change (if needed)

Associated Artifacts Request for Change

Incident Ticket




Informed Role Incident Management Analyst; Customer; Stakeholders



More Info The incident may be escalated to Problem Management at any time during this activity, if needed.

Change Management Tools and Service Management Tools are used in this process.

There is a flow from the Incident Management Process into the Change Management Process.

Process Activity Name: INM-15 Change Management Previous Activities INM-14 Resolve Incident

Next Activities If "Navigate to CHG":

Change Management Process

Or

If "Remain in INM":

INM-16 Resolved?


Description A Request for Change (RFC) was created and then processed in the flow to the Change Management Process. Upon completion of processing the RFC, there is a flow back into the Incident Management Process.

Input Request for Change

Output Successful Implemented Request for Change records from the CHG Process



Accountable Role None Listed






Process Activity Name: INM-16 Resolved? Previous Activities INM-13 Change Required?

Or

INM-15 Change Management


INM-17 Close Incident

Or


If "No":

INM-12 Investigate and Diagnose

Description The Incident Management Assignment Group determines if the incident is Resolved (Yes) or not resolved (No).





Process Activity Name: INM-17 Close Incident Previous Activities INM-08 First Contact Resolution?

Or

INM-16 Resolved?

Next Activities INM-18 PBM Candidate?

Description The Incident Management Analyst, or their designee, closes the incident. The Service Desk verifies that service to the Configuration Item or Service is restored and that the customer(s) are satisfied and agree the incident can be closed. The Service Desk ensures that the Incident Record is properly documented so that a full historic record, at a sufficient level of detail, is complete.


Output Incident Ticket (Closed)

Problem Ticket







Tools and Websites After Action Report Portal


More Info The incident may be escalated to Problem Management at any time during this activity. Escalation to Problem Management occurs if the applications are escalated to Swift Action and Triage Team, or if Senior Management wants an After Action Report which is assigned to Problem Management and designated Technical Representative.

Service Management Tools are used in this process.

Process Activity Name: INM-18 PBM Candidate? Previous Activities INM-17 Close Incident


INM-19 Problem Management

Or

If "No":

Process Ends

Description Incident Management Analyst determines if the incident is a candidate for the Problem Management Process (Yes) or not a candidate (No).






Process Activity Name: INM-19 Problem Management Previous Activities INM-18 PBM Candidate?

Next Activities If "Go to PBM":

Problem Management Process

Or

If "Stay in INM":

Process Ends

Description There is a flow from the Incident Management Process into the Problem Management Process to evaluate the incident, identify the severity as a problem, and to track the problem.


Output None Listed









More Info None Listed END OF PROCESS

incident management - u.s. department of veterans … · an incident is an unplanned interruption...

Documents