INCIDENT MANAGEMENT PROCESS - Wright State University · INCIDENT MANAGEMENT PROCESS Computing &...

INCIDENTMANAGEMENTPROCESS

Computing&TelecommunicationsServicesWrightStateUniversity

ITSM/RF-IMProjectTeamPreparedby:JonathanJackson

[email protected]

1

Table of Contents Overview................................................................................................................................3Description.........................................................................................................................3Scope..................................................................................................................................3Goals,Objectives,CSFsandKPIs.........................................................................................3Goals.......................................................................................................................................3Objectives...............................................................................................................................3CriticalSuccessFactorsandassociatedKeyPerformanceIndicators.....................................4

CSF#1–CommitmenttoProcess....................................................................................................................4KPI1.1:WeeklyreportsprovidedtoallCaTSManagement........................................................................4

CSF#2–ImprovedCustomerSatisfaction.......................................................................................................4KPI2.1:95%ofIncidentsrespondedtowithintargetresponsetime.........................................................4KPI2.2:95%ofIncidentsresolvedwithintargetresolutiontime................................................................4KPI2.3:Timelyandconsistentcommunicationprovidedtocustomer.......................................................4KPI2.4:70%FirstCallResolution.................................................................................................................5

Roles&DescriptionofResponsibilities...................................................................................5

Workflow...............................................................................................................................7Activities.............................................................................................................................7IncidentIdentification,LoggingCategorizationandPrioritization..........................................7

Cross-FunctionalFlowDiagram........................................................................................................................7WSUIM1.1:IncidentIdentification..................................................................................................................7WSUIM1.2:IncidentLogging...........................................................................................................................8WSUIM1.3:IncidentCategorization................................................................................................................9WSUIM1.4:IncidentPrioritization................................................................................................................10

IncidentMatrix..........................................................................................................................................11IncidentDiagnosisandEscalation.........................................................................................12

CrossFunctionalDiagram...............................................................................................................................12WSUIM2.1:IncidentDiagnosis......................................................................................................................12WSUIM2.2:InvestigationandDiagnosis.......................................................................................................13WSUIM2.3:FunctionalEscalationtoTier2/3...............................................................................................14WSUIM2.4:ManagementEscalation............................................................................................................15

Resolution,RecoveryandClosure........................................................................................17CrossFunctionalDiagram...............................................................................................................................17WSUIM3.1:ResolutionandRecovery...........................................................................................................17WSUIM3.2:IncidentClosure.........................................................................................................................18

Appendix...............................................................................................................................20AppendixA–ServiceLevelTargets:ResponseandResolution...........................................20

2

OverviewAprocessisdefinedasasetoflinkedactivitiesthattransformspecifiedinputsintospecifiedoutputs,aimedataccomplishinganagreed-upongoalinaameasurablemanner.

DescriptionThisistheIncidentManagementprocessforWrightStateUniversityComputing&TelecommunicationsServices,andanydistributedITdepartmentutilizingCaTSastheirfirst-point-of-contact(FPOC)forservicesprovidedbythedistributeddepartment.

ScopeAnIncidentisdefinedasanyeventwhichdisrupts,orcoulddisruptaproductionITservice;thisincludesservicesthatareinfailedordegradedstates.

Incidentscanbeidentifiedinthefollowingways:

• Reporteddirectlybyusers• Reportedand/orloggedbyITstaff• DetectedbyEventManagementsoftware• Reportedand/orloggedbySuppliers

Goals,Objectives,CSFsandKPIsGoals

• Improvedresponsetoservicedisruptions• Improvedcustomerrelationship• BetteralignmentbetweenITandservicethebusinessneedsoftheuniversity• ImprovedIncidentmonitoringandreportingcapability• ImprovedcooperationandcommunicationbetweenexistingITfunctionalgroups

Objectives• Ensurethatstandardmethodsandproceduresareusedforefficientandprompt

response,analysis,documentation,ongoingmanagementandreportingofIncidents• IncreasevisibilityandcommunicationofIncidentstobusinessandinternalITstaff• EnhanceuniversityperceptionofITthroughtheuseofaprofessionalapproachin

quicklyresolvingandcommunicatingincidents• AlignIncidentmanagementactivitiesandprioritieswiththoseofthebusiness• Increaseusersatisfactionto90%inannualCaTSCustomerServicesurveys

3

CriticalSuccessFactorsandassociatedKeyPerformanceIndicatorsCriticalSuccessFactors(CSF)aredefinedassomethingthatmusthappenifanITservice,process,plan,projectorotheractivityistosucceed.CSFsaremeasuredbyKeyPerformanceIndicators(KPI),whicharedefinedas“metricsthat[are]usedtomanageanITservice,process,plan,project,orotheractivity”(ITILFoundationwithCaseStudy,QuintWellingtonRedwood)

CSF#1–CommitmenttoProcessKPI1.1:WeeklyreportsprovidedtoallCaTSManagementDescription: Highlightsusage,trends,andcompliancewithIncident

Managementprocess.

Type: quaLitativeSupportingDetails: weeklyMeasurementProcedure: ServiceNowmetrics/dashboardsCategory: EffectivenessCSF#2–ImprovedCustomerSatisfactionKPI2.1:95%ofIncidentsrespondedtowithintargetresponsetimeDescription: 95%ofIncidentsrespondedtowithintargetresponsetime(see

AppendixA)

Type: quaNitativeSupportingDetails: WeeklyMeasurementProcedure: ServiceNowmetrics/dashboards,CustomerClosureSurveysCategory: ValueKPI2.2:95%ofIncidentsresolvedwithintargetresolutiontimeDescription: 95%ofIncidentsresolvedwithintargetresolutiontime(see

AppendixA)

Type: quaLitativeSupportingDetails: weeklyMeasurementProcedure: ServiceNowmetrics/dashboardsCategory: Value

KPI2.3:TimelyandconsistentcommunicationprovidedtocustomerDescription: Timelyandconsistentcommunicationprovidedtocustomerby

CaTSstaffforopenincidents

Type: quaNtitative

4

SupportingDetails: WeeklyandyearlyMeasurementProcedure: Customersatisfactionsurveys(ClosureandAnnual)Category: ValueKPI2.4:70%FirstCallResolutionDescription: 70%ofIncidentsrespondedtoandresolvedatfirstcall

Type: quaNitativeSupportingDetails: WeeklyandyearlyMeasurementProcedure: ServiceNowmetrics/dashboardsCategory: Value

Roles&DescriptionofResponsibilitiesDuringeachactivityintheIncidentManagementprocess,thefollowingroleshavecertainresponsibilities.Theiroverallroleisdescribedhere,withactivity-specificrolesdescribedfurtherwithinthisdocument.

Name DescriptionofRoleIncidentManager AccountablefortheoverallIncidentManagementprocess,

andresponsibletomonitorexistingincidentstodetecttrends.ServiceDeskManager Responsiblefortheday-to-daysupervisionoftheService

Desk.IftheIncidentManagerandServiceDeskManagerareseparateindividuals,willberesponsibletomonitorexistingincidentstoassisttheIncidentManagerinidentifyingincidenttrends.

ServiceDeskAnalyst • ResponsibleforaccuratelyloggingallIncidents,prioritizingandcategorizingtheIncident.

• Providefirst-lineinvestigationanddiagnosisoftheIncident.

• ResolveasmanyIncidentsaspossibleonfirst-contact.• EscalateIncidentsthatcannotberesolvedbyService

Desk.• Communicatewithusers,keepingtheminformedof

theIncident’sprogress,troubleshooting,confirmingIncidentresolution

• InitiatetheResolution,RecoveryandClosureactivityonceanIncidentresolutionisidentified.

Tier2orTier3Manager • ManagestheownershipofIncidentswithintheirfunctionalgroup.

• AssignIncidentsescalatedtotheirfunctionalgroup.

5

• NotifytheServiceDeskofanyIncidentsidentifiedbyorreporteddirectlytoTier2/3Analysts.

• ProvideguidanceanddirectiontoTier2/3AnalyststoachieveIncidentresolutionwithinagreedServiceLevelTargets

Tier2orTier3Analyst • NotifytheServiceDeskofanyIncidentsidentifiedbyorreportedtoaTier2/3Analyst.

• IfaTier2/3AnalystchoosesnottoinformtheServiceDeskofanIncident,theTier2/3AnalystwillperformtheactivitiesinwhichtheServiceDeskAnalystisresponsible.

• IfaTier2/3Managerisunavailable,performrolesassignedtotheTier2/3Manageruntiloneisavailable.

• TakeownershipofIncidentsescalatedtotheTier2/3Analyst’sfunctionalgroup.

• ValidatesthatanIncidentisvalidandisabletoberesolvedbythatanalyst’sfunctionalgroup.

• AssignIncidentstootherswithinthefunctionalgroupasnecessary.

• Communicatewithusers,keepingtheminformedoftheIncident’sprogress,troubleshooting,confirmingIncidentresolution

• Asavailableandnecessary,escalateIncidentstohighersupportTiersorthird-partyvendors/support.

• InitiatetheResolution,RecoveryandClosureactivityonceanIncidentresolutionisidentified.

6

Workflow

Activities

IncidentIdentification,LoggingCategorizationandPrioritization

Cross-FunctionalFlowDiagram

WSUIM1.1:IncidentIdentificationAcallfirstneedstobeidentifiedasanIncidentandnotanotherprocess(e.g.,RequestFulfillment).AnIncidentisdefinedasaproductionITservicethatisnotfunctioningornotfunctioningatanacceptablelevel.

7

RACIMatrixARACIMatrixdefineswhoisResponsible,Accountable,ConsultedandInformedforagivenactivity.

Name Duties TypeIncidentManager Accountablefortheentireprocess,andfor

identifyingchangesthatmayneedtobemadetotheprocess

A

ServiceDeskManager Responsiblefortheday-to-daysupervisionoftheServiceDesk.WillassistServiceDeskAnalystsinproperlyloggingIncidents.

R

ServiceDeskAnalyst ResponsibleforhandlingtheincomingcontactwiththeUserandproperlyidentifyingwhetherthereportedissueisanIncident.

R

Tier2/3Analyst ResponsibleforreportingIncidentstotheServiceDeskthatareeitheridentifiedbyorreportedtoaTier2/3Analyst.IfaTier2/3AnalystchoosesnottoinformtheServiceDesk,theTier2/3AnalystwillperformthedutiesassignedtotheServiceDeskAnalyst.

R

Tier2/3Manager Responsiblefortheday-to-daysupervisionoftheTier2/3Analysts.IfaTier2/3AnalystchoosesnottoinformtheServiceDeskofanIncident,theTier2/3ManagerwillperformthedutiesassignedtotheServiceDeskManager

R

User UserisresponsiblefornotifyingtheServiceDeskofanyIncidentstheyidentify.

R

WSUIM1.2:IncidentLoggingTheIncidentisloggedintoServiceNow.TheIncidentrecordwillincludeUserdetails,includingname,locationofIncidentandpertinentcontactinformation.IncidentrecordshouldalsoincludeasmanydetailsaspossibleregardingtheIncident,includingrelevantdescriptioninformation,andifavailabletheConfigurationItemexperiencingtheIncident.

8




A

ServiceDeskManager Responsiblefortheday-to-daysupervisionoftheServiceDesk.WillassistServiceDeskAnalystsinproperlyloggingIncidents.

R

ServiceDeskAnalyst ServiceDeskAnalystwillbethelikelyrecipientofthereportedIncident.ServiceDeskAnalystisresponsibleforloggingappropriatedetailsoftheIncidentintoServiceNow

R

Tier2/3Analyst IfaTier2/3AnalystchoosesnottoinformtheServiceDesk,theTier2/3AnalystwillperformthedutiesassignedtotheServiceDeskAnalyst.

R


R

User UsercanviewthestatusofanIncidentviatheSelfServicePortal.

I

WSUIM1.3:IncidentCategorizationTheIncidentwillbecategorizedintoanappropriatecategory/subcategoryaspre-definedwithinServiceNow.CaTSisusingamodifiedCategorizationstructuredevelopedbytheEDUCAUSECenterforAnalysisandResearch(ECAR).




A

ServiceDeskManager Responsiblefortheday-to-daysupervisionofthe C

9

ServiceDesk.MaybeconsultedindeterminingtheappropriatecategorizationforanIncident.

ServiceDeskAnalyst ResponsibletousejudgmenttocategorizetheIncidentappropriately.

R


R


R

User UserisabletoviewthestatusofanIncidentwithintheSelfServicePortal

I

WSUIM1.4:IncidentPrioritizationAnIncidentisprioritizedbasedontheImpactandUrgencyofthereportedIncident.

Impact:DefineshowwidelytheIncidentaffectsusers.CaTSwillutilizethefollowingtodetermineImpact:

High Impactsteachingandlearning,orsupportservices,fortheentireuniversityormanydepartments;orisanimminentthreattopublicorlifesafety.

Medium Impactsteachingandlearning,orsupportservices,forasingleorfewdepartments;orisamoderatethreattopublicorlifesafety.

Low Impactsteachingandlearning,orsupportservices,foranindividualorfewusers;orisalowthreattopublicorlifesafety.

Urgency:Definesthelevelofbusinesscriticalityoftheaffectedservice(s)

High Corelineofbusinessorcriticalsupportservicesareaffected;oranimminentthreattopublicorlifesafety.

Medium Generaluniversitysupportservicesareaffected.Low Non-criticaluniversityservicesareaffected.

Bydefault,ServiceNowwillselectthepriorityofanIncidentfromapre-definedmatrixbasedontheselectedImpactandUrgencyenteredbytheServiceDeskAnalyst.However,theAnalystis

10

abletooverridethepre-definedpriorityiftheyfeelthematrixdoesnotprovideanadequatepriorityofthegivenIncident.AnAnalystrequiredtoprovideajustificationofthepriorityoverridewithinafieldintheIncidentrecord.AllpriorityoverrideswillbereviewedbytheIncidentManageraspartofContinualServiceImprovement.

Incidentsloggedaseitherpriority1–Criticalor2–Highwillbeclassifiedas“MajorIncidents”andwillinvoketheMajorIncidentProcess.

IncidentMatrix ImpactUrgency 1–High 2–Medium 3–Low

1–High 1–Critical 2–High 3–Medium2-Medium 2–High 3–Medium 4–Low3-Low 3–Medium 4-Low 5-Planning



identifyingchangesthatmayneedtobemadetotheprocessResponsibleforreviewingpriorityoverridesaspartofContinualServiceImprovement.

A/R

ServiceDeskManager Responsiblefortheday-to-daysupervisionoftheServiceDesk.MaybeconsultedbyServiceDeskAnalyststodeterminetheappropriateImpactandUrgencyofareportedIncident,andifnecessaryindicatethatthepriorityshouldbeoverridden.

C

ServiceDeskAnalyst ResponsibletousejudgmenttoselecttheappropriateImpactandUrgencyofareportedIncident,andtooverridethepre-definedpriorityifnecessary.

R


R

11


R

User UserisconsultedtoassisttheServiceDeskAnalystinchoosingtheappropriateImpactofareportedIncident.

C

IncidentDiagnosisandEscalationCrossFunctionalDiagram

WSUIM2.1:IncidentDiagnosisTheAnalystwhologstheIncidentwillattempttodiscoverthefullsymptomsoftheIncidentanddeterminethecauseandpossibleresolution.Aresolutionmaybefoundbyusingacombinationof:referencingaKnownErrorDatabase(KEDB),useofdiagnosticscripts,orutilizingIncidentMatching.IfaResolutionisfound,theIncidentcanberesolved;otherwiseitwillbeescalated.Ifescalated,theuserisinformedofthisfactandisprovidedtheIncidentrecordnumber.

12




A

ServiceDeskManager Responsiblefortheday-to-daysupervisionoftheServiceDesk.MaybeconsultedbyServiceDeskAnalyststoassistintheIncidentDiagnosisprocess.

C

ServiceDeskAnalyst ResponsibletoproperlydiagnosetheIncidentusingavailabledocumentationandresources.

R


R


R

User UserisconsultedtoassisttheServiceDeskAnalystinproperlydiagnosingtheIncident.ThismayinvolvereceivinginstructionfromtheServiceDeskAnalystandperforminginstructedtasks.

C

WSUIM2.2:InvestigationandDiagnosisTheAnalystloggingtheIncidentwillinvestigateanddiagnosetheIncidentinordertounderstandasfullyaspossibleallrelevantdetailsoftheIncident.Thiscaninclude:establishingexactlywhathasgonewrong;thechronologicalorderofevents;confirmingfullimpactoftheIncidentincludingnumberofusersaffected;identifyinganyeventsthatcouldhavetriggeredtheIncident(e.g.,arecentchange,oruseraction);andperformingdetailedsearchesofpreviousIncidentsorProblems,entriesinKnownErrorDatabases,vendorknowledgedatabasesoravailableerrorlogs.

Oncethepotentialresolutionhasbeenidentified,theactionstobeundertakentoresolveshouldbeapplied.Thismayrequireaskingtheusertofollowcertaindirectionsoractivities,

13

mayinvolveCaTSstaffperformingcertainactivities(e.g.,restartingafailedservice,remotecontrolsessionofuser’scomputer,etc),ormayinvolveathird-partyvendortoperformactivities.



identifyingchangesthatmayneedtobemadetotheprocess.

A

ServiceDeskManager Responsiblefortheday-to-daysupervisionoftheServiceDesk.MaybeconsultedbyServiceDeskAnalyststoassistininvestigatingtheIncidentanditscauses.

C

ServiceDeskAnalyst ResponsibleforInvestigatingandDiagnosingtheIncident.

R


R


R

User UserisconsultedtoassisttheServiceDeskAnalystinproperlyinvestigatingtheIncident.ThismayinvolvereceivinginstructionfromtheServiceDeskAnalystandperforminginstructedtasks.

C

WSUIM2.3:FunctionalEscalationtoTier2/3IfanIncidentisnotabletoberesolvedbytheServiceDeskAnalyst,theServiceDeskAnalystwillescalatetheIncidenttotheappropriateTier2supportgroup.ThereceivingTier2/3groupand/oranalystisresponsibleforcompletingtheIncidentManagementlifecycle.

14




A

ServiceDeskManager Responsiblefortheday-to-daysupervisionoftheServiceDesk.MaybeconsultedbyServiceDeskAnalyststodeterminewhetheranIncidentneedstobeescalatedtoahigherTier.

C

ServiceDeskAnalyst ResponsiblefordeterminingwhetheranIncidentneedsescalated.

R

Tier2/3Analyst IfaTier2/3AnalystchoosesnottoinformtheServiceDesk,theTier2/3AnalystwillperformthedutiesassignedtotheServiceDeskAnalyst.OncetheTier2/3AnalystreceivestheescalatedIncident,theyareresponsibleforremainingactivitiesintheIncidentManagementprocess.

R


R

User UserisinformedthattheIncidenthasbeenescalated,andisprovidedtheIncidentRecordNumber.

I

WSUIM2.4:ManagementEscalationCertainIncidentsmayrequireescalationthroughmanagementandhigherlevelsoftheorganization.ThismayincludeIncidentsreportedforVIPusers,ifanIncidentappearstobetakingtoolongtoresolve,anIncidentisnearingabreachofanSLA,anIncidentinvolvingsensitiveorconfidentialmatters,orifthereceivingAnalystfeelsthestandardIncidentworkflowisinsufficienttoresolvetheIncident.

15

Inthesecases,ManagementwillmakebestjudgmenttodeterminehowtheIncidentwillflowtoresolution;however,willmakeeveryefforttofollowthestandardprocessascloselyaspossible.TheManagerreceivingtheescalationmaytakeownershipoftheIncidentormayprovideconsultationtothereceivingAnalyst.



identifyingchangesthatmayneedtobemadetotheprocess.MayberesponsibleforescalatingtheIncidentthroughfurtherManagementlevelsorfunctionalTiers.

A/R

ServiceDeskManager Responsiblefortheday-to-daysupervisionoftheServiceDesk.MaybeconsultedbyServiceDeskAnalyststodeterminewhetheranIncidentneedstobeescalatedthroughManagement.Ifso,mayberesponsibleforescalatingtheIncidentthroughfurtherManagementlevelsorfunctionalTiers.

R/C

ServiceDeskAnalyst ResponsiblefordeterminingwhetheranIncidentneedsescalated.

R


R


R

User UserisinformedthattheIncidenthasbeenescalated,andisprovidedtheIncidentRecordNumber.

I

16

Resolution,RecoveryandClosureCrossFunctionalDiagram

WSUIM3.1:ResolutionandRecoveryOncearesolutionhasbeenidentifiedassuccessful,thedetailsleadingtothesuccessfulresolutionarerecordedintoServiceNow.Thisinformationincludes:closurenotes,closurecode,andtheclosureconfigurationitem(e.g.,theCIthatwasactuallyatfault).

TheIncidentwillbemarkedasResolved,atwhichpointtheuserwillhavefive(5)daystoindicatedwhethertheyacceptthattheIncidenthasbeenresolved.




R

ServiceDeskManager Responsiblefortheday-to-daysupervisionoftheServiceDesk.

R

ServiceDeskAnalyst ResponsibleforensuringtheIncidentisResolved,consultingwiththeUser;andmarkingtheIncidentrecordasResolved

R


R

17

IfanIncidenthasbeenescalatedtoTier2/3,theTier2/3AnalystisresponsibleforensuringtheIncidentisResolved,consultingwiththeUser;andmarkingtheIncidentrecordasResolved


R

User UserisconsultedtoverifythattheIncidenthasbeenresolved;andisinformedwhentheIncidentgoesintoResolvedstatus.

C/I

WSUIM3.2:IncidentClosureAfter5daysofbeinginresolvedstates,anIncidentwillautomaticallybeclosed.Atanytimeduringthe5daywindow,theusercanindicatethattheyfeeltheresolutionisinaccurate.Theusercandothisbyeitherclickingtheappropriatelinksendtothemintheresolutionemail,orcanindicatebyre-openingtheIncidentintheself-serviceportal.

TheuserisalsoabletoClosetheIncidentsoonerthan5daysbyclickingtheappropriatebuttonwithintheself-serviceportal.

OncetheIncidenthasbeenmovedintoclosedstatus,theuserwillreceiveanemailinvitingthemtocompleteaSatisfactionSurvey.




R

ServiceDeskManager Responsiblefortheday-to-daysupervisionoftheServiceDesk.

R

ServiceDeskAnalyst IsinformedoncetheIncidentgoesintoclosedstatus.

I

Tier2/3Analyst IfaTier2/3AnalystchoosesnottoinformtheServiceDesk,theTier2/3Analystwillperform

I

18

thedutiesassignedtotheServiceDeskAnalyst.Tier2/3Manager Responsiblefortheday-to-daysupervisionofthe

Tier2/3Analysts.IfaTier2/3AnalystchoosesnottoinformtheServiceDeskofanIncident,theTier2/3ManagerwillperformthedutiesassignedtotheServiceDeskManager

R

User UserisresponsibletoindicatewhetheranIncidentwasnotresolvedtotheirsatisfaction.IftheUserdoesnotrespondtotheresolutionemailnotificationwithin5days,theIncidentwillautomaticallyclose.

R

19

AppendixAppendixA–ServiceLevelTargets:ResponseandResolution

DefaultServiceLevelTargets(SLTs)*(Goalofallprioritiesistoachieveresponseandresolutiontime95%)

Priority Response Resolution1-Critical 30continuousminutes 4continuoushours2-High 90continuousminutes 1continuousday3-Moderate 1businessday 3businessdays4-Low 2businessdays 5businessdays5-Planning 2businessdays 5businessdays

IndividualClassroomIncidentServiceLevelTargets(SLTs)*(Goalofallprioritiesistoachieveresponseandresolutiontime95%)

Priority Response Resolution3-Moderate 10businessminutes 30businessminutes4-Low 60businessminutes 8businesshours5–Planning 4businesshours 8businesshours

IndividualWorkstationVirus/MalwareIncidentServiceLevelTargets(SLTs)*

(Goalofallprioritiesistoachieveresponseandresolutiontime95%)Priority Response Resolution3-Moderate 9businesshours(1businessday) 3businessdays4-Low 13.5businesshours(1½businessdays) 3businessdays5-Planning 2businessdays 5businessdaysDuetothepresenceofsensitivedata,Virus/MalwareIncidentsinthefollowingdepartmentswillautomaticallyreceiveapriorityof3,andNetworkingServiceswillbenotifiedimmediatelytoturnoffnetworkconnectivitytotheaffectedworkstation:BusinessandFinance,HumanResources,Payroll.

20

INCIDENT MANAGEMENT PROCESS - Wright State University · INCIDENT MANAGEMENT PROCESS Computing &...

Documents

Transcript of INCIDENT MANAGEMENT PROCESS - Wright State University · INCIDENT MANAGEMENT PROCESS Computing &...