Related Articles

• ITIL® Glossary
• Incident Creation
• Priority Definition and Basic Service Levels

Introduction

Incident Management is an ITIL® process that is part of the Service Operation Phase:

Definitions

Please consult "Incident Management" section on the ITIL® Glossary.

Objectives

Incident Management process objectives are:

• Ensure that standardized methods and procedures are used for efficient and prompt response, analysis, documentation, ongoing management and reporting of incidents
• Increase visibility and communication of incidents to business and IT support staff
• Enhance business perception of IT through use of a professional approach in quickly resolving and communicating incidents when they occur
• Align incident management activities and priorities with those of the business
• Maintain user satisfaction with the quality of IT services

Scope

Incident management includes any event which disrupts, or which could disrupt, a service. This includes events which are communicated directly by users, either through the Service Desk, a web interface or any other way.

Although both incidents and service requests are reported to the Service Desk, this does not mean that they are the same. Service requests are not a service disruption as incidents are. See Request Fulfilment ITIL® Process for more information on how are managed service requests.

Value

• Reduce unplanned labour and costs for both the business and IT support staff caused by incidents
• Detect and resolve incidents which results in lower downtime to the business, which in turn means higher availability of the service
• Align IT activity with business priorities; Incident management includes the capability to identify business priorities and allocate resources as necessary
• Identify potential improvement to services; this happens as a result of understanding what constitutes an incident and also from being in contact with the activities of business operational staff
• Service Desk can, during its handling of incidents, identify additional service or training requirements found in IT or the business

Incident management is highly visible to the business,, and it is therefore easier to demonstrate its value than most areas in service operation. For this reaason, Incident management is often one of the first processes to be implemented.

Basic Concepts

Timescales

Timescales must be agrred for all incident handling according to their priority; this includes response and resolution targets. All support groups should be made fully aware of these timescales. The tool should be used to automate timescales and escalate the incident as required based on predefined rules.

Incident Models

An incident model is a template that can be reused for recurrent incidents. It can be practical to predefine 'standard' incident models and apply them when incidents occurs; they contribute to a faster entry and a more efficient treatment.

Major Incidents

A separate procedure, with shorter timescales and greater urgency, must be used for 'major' incidents. A definition of what constitutes a major incident must be agreed and ideally mapped onto the overall incident prioritization scheme. When necessary, a special team can be put in place by the Incident Manager to ensure that adequate resources and focus are provided to finding a swift solution.

Incident Status Tracking

During incidents lifecycle, differents status occurs; here are some examples :

• New - an incident is submitted but is not assigned to a group or resource for resolution
• Assigned - an incident is assigned to a group or resource for resolution
• In process - the incident is in the process of being investigated for resolution
• Resolved - a resolution has been put in place
• Closed - the user has agreed that the incident has been resolved and that normal state operations have been restored

Process and Activities