INCIDENT!MANAGEMENT!
PROCESS!
Computing!&!Telecommunications!Services!
Wright!State!University!
ITSM/RF-IM!Project!Team!
Prepared!by:!Jonathan!Jackson!
jonathan.jackson@wright.edu!
1
Table of Contents
Overview'................................................................................................................................'3!
Description'.........................................................................................................................'3!
Scope'..................................................................................................................................'3!
Goals,'Objectives,'CSFs'and'KPIs'.........................................................................................'3!
Goals!.......................................................................................................................................!3!
Objectives!...............................................................................................................................!3!
Critical!Success!Factors!and!associated!Key!Performance!Indicators!.....................................!4!
CSF!#1!–!Commitment!to!Process!....................................................................................................................!4!
KPI!1.1:!Weekly!reports!provided!to!all!CaTS!Management!........................................................................!4!
CSF!#2!–!Improved!Customer!Satisfaction!.......................................................................................................!4!
KPI!2.1:!95%!of!Incidents!responded!to!within!target!response!time!.........................................................!4!
KPI!2.2:!95%!of!Incidents!resolved!within!target!resolution!time!................................................................!4!
KPI!2.3:!Timely!and!consistent!communication!provided!to!customer!.......................................................!4!
KPI!2.4:!70%!First!Call!Resolution!.................................................................................................................!5!
Roles'&'Description'of'Responsibilities'...................................................................................'5!
Workflow'...............................................................................................................................'7!
Activities'.............................................................................................................................'7!
Incident!Identification,!Logging!Categorization!and!Prioritization!..........................................!7!
Cross-Functional!Flow!Diagram!........................................................................................................................!7!
WSUIM!1.1:!Incident!Identification!..................................................................................................................!7!
WSUIM!1.2:!Incident!Logging!...........................................................................................................................!8!
WSUIM!1.3:!Incident!Categorization!................................................................................................................!9!
WSUIM!1.4:!Incident!Prioritization!................................................................................................................!10!
Incident!Matrix!..........................................................................................................................................!11!
Incident!Diagnosis!and!Escalation!.........................................................................................!12!
Cross!Functional!Diagram!...............................................................................................................................!12!
WSUIM!2.1:!Incident!Diagnosis!......................................................................................................................!12!
WSUIM!2.2:!Investigation!and!Diagnosis!.......................................................................................................!13!
WSUIM!2.3:!Functional!Escalation!to!Tier!2/3!...............................................................................................!14!
WSUIM!2.4:!Management!Escalation!............................................................................................................!15!
Resolution,!Recovery!and!Closure!........................................................................................!17!
Cross!Functional!Diagram!...............................................................................................................................!17!
WSUIM!3.1:!Resolution!and!Recovery!...........................................................................................................!17!
WSUIM!3.2:!Incident!Closure!.........................................................................................................................!18!
Appendix'...............................................................................................................................'20!
Appendix'A'–'Service'Level'Targets:'Response'and'Resolution'...........................................'20!
2
Overview!
A!process!is!defined!as!a!set!of!linked!activities!that!transform!specified!inputs!into!specified!
outputs,!aimed!at!accomplishing!an!agreed-upon!goal!in!a!a!measurable!manner.!
Description!
This!is!the!Incident!Management!process!for!Wright!State!University!Computing!&!
Telecommunications!Services,!and!any!distributed!IT!department!utilizing!CaTS!as!their!first-
point-of-contact!(FPOC)!for!services!provided!by!the!distributed!department.!
Scope!
An!Incident!is!defined!as!any!event!which!disrupts,!or!could!disrupt!a!production!IT!service;!this!
includes!services!that!are!in!failed!or!degraded!states.!
Incidents!can!be!identified!in!the!following!ways:!
• Reported!directly!by!users
• Reported!and/or!logged!by!IT!staff
• Detected!by!Event!Management!software
• Reported!and/or!logged!by!Suppliers
Goals,!Objectives,!CSFs!and!KPIs!
Goals!
• Improved!response!to!service!disruptions
• Improved!customer!relationship
• Better!alignment!between!IT!and!service!the!business!needs!of!the!university
• Improved!Incident!monitoring!and!reporting!capability
• Improved!cooperation!and!communication!between!existing!IT!functional!groups
Objectives!
• Ensure!that!standard!methods!and!procedures!are!used!for!efficient!and!prompt
response,!analysis,!documentation,!ongoing!management!and!reporting!of!Incidents
• Increase!visibility!and!communication!of!Incidents!to!business!and!internal!IT!staff
• Enhance!university!perception!of!IT!through!the!use!of!a!professional!approach!in
quickly!resolving!and!communicating!incidents
• Align!Incident!management!activities!and!priorities!with!those!of!the!business
• Increase!user!satisfaction!to!90%!in!annual!CaTS!Customer!Service!surveys
3
!
!
Critical!Success!Factors!and!associated!Key!Performance!Indicators!
Critical!Success!Factors!(CSF)!are!defined!as!something!that!must!happen!if!an!IT!service,!
process,!plan,!project!or!other!activity!is!to!succeed.!CSFs!are!measured!by!Key!Performance!
Indicators!(KPI),!which!are!defined!as!“metrics!that![are]!used!to!manage!an!IT!service,!process,!
plan,!project,!or!other!activity”!(ITIL$Foundation$with$Case$Study,!Quint!Wellington!Redwood)!
CSF$#1$–$Commitment$to$Process$
KPI!1.1:!Weekly!reports!provided!to!all!CaTS!Management!
Description:!
Highlights!usage,!trends,!and!compliance!with!Incident!
Management!process.!
!
Type:!
quaLitative!
Supporting!Details:!
weekly!
Measurement!Procedure:!
ServiceNow!metrics/dashboards!
Category:!
Effectiveness!
$
CSF$#2$–$Improved$Customer$Satisfaction$
KPI!2.1:!95%!of!Incidents!responded!to!within!target!response!time!
Description:!
95%!of!Incidents!responded!to!within!target!response!time!(see!
Appendix!A)!
!
Type:!
quaNitative!
Supporting!Details:!
Weekly!
Measurement!Procedure:!
ServiceNow!metrics/dashboards,!Customer!Closure!Surveys!
Category:!
Value!
!
KPI!2.2:!95%!of!Incidents!resolved!within!target!resolution!time!
Description:!
95%!of!Incidents!resolved!within!target!resolution!time!(see!
Appendix!A)!
!
Type:!
quaLitative!
Supporting!Details:!
weekly!
Measurement!Procedure:!
ServiceNow!metrics/dashboards!
Category:!
Value!
!
KPI!2.3:!Timely!and!consistent!communication!provided!to!customer!
Description:!
Timely!and!consistent!communication!provided!to!customer!by!
CaTS!staff!for!open!incidents!
!
Type:!
quaNtitative!
4
!
!
Supporting!Details:!
Weekly!and!yearly!
Measurement!Procedure:!
Customer!satisfaction!surveys!(Closure!and!Annual)!
Category:!
Value!
KPI!2.4:!70%!First!Call!Resolution!
Description:!
70%!of!Incidents!responded!to!and!resolved!at!first!call!
!
Type:!
quaNitative!
Supporting!Details:!
Weekly!and!yearly!
Measurement!Procedure:!
ServiceNow!metrics/dashboards!
Category:!
Value!
!
!
Roles!&!Description!of!Responsibilities!
During!each!activity!in!the!Incident!Management!process,!the!following!roles!have!certain!
responsibilities.!Their!overall!role!is!described!here,!with!activity-specific!roles!described!further!
within!this!document.!
Name'
Description'of'Role'
Incident!Manager!
Accountable!for!the!overall!Incident!Management!process,!
and!responsible!to!monitor!existing!incidents!to!detect!trends.!
Service!Desk!Manager!
Responsible!for!the!day-to-day!supervision!of!the!Service!
Desk.!If!the!Incident!Manager!and!Service!Desk!Manager!are!
separate!individuals,!will!be!responsible!to!monitor!existing!
incidents!to!assist!the!Incident!Manager!in!identifying!incident!
trends.!
Service!Desk!Analyst!
• Responsible!for!accurately!logging!all!Incidents,!
prioritizing!and!categorizing!the!Incident.!
• Provide!first-line!investigation!and!diagnosis!of!the!
Incident.!
• Resolve!as!many!Incidents!as!possible!on!first-contact.!
• Escalate!Incidents!that!cannot!be!resolved!by!Service!
Desk.!
• Communicate!with!users,!keeping!them!informed!of!
the!Incident’s!progress,!troubleshooting,!confirming!
Incident!resolution!
• Initiate!the!Resolution,!Recovery!and!Closure!activity!
once!an!Incident!resolution!is!identified.!
Tier!2!or!Tier!3!Manager!
• Manages!the!ownership!of!Incidents!within!their!
functional!group.!
• Assign!Incidents!escalated!to!their!functional!group.!
5
!
!
• Notify!the!Service!Desk!of!any!Incidents!identified!by!
or!reported!directly!to!Tier!2/3!Analysts.!
• Provide!guidance!and!direction!to!Tier!2/3!Analysts!to!
achieve!Incident!resolution!within!agreed!Service!Level!
Targets!
Tier!2!or!Tier!3!Analyst!
• Notify!the!Service!Desk!of!any!Incidents!identified!by!
or!reported!to!a!Tier!2/3!Analyst.!
• If!a!Tier!2/3!Analyst!chooses!not!to!inform!the!Service!
Desk!of!an!Incident,!the!Tier!2/3!Analyst!will!perform!
the!activities!in!which!the!Service!Desk!Analyst!is!
responsible.!
• If!a!Tier!2/3!Manager!is!unavailable,!perform!roles!
assigned!to!the!Tier!2/3!Manager!until!one!is!available.!
• Take!ownership!of!Incidents!escalated!to!the!Tier!2/3!
Analyst’s!functional!group.!
• Validates!that!an!Incident!is!valid!and!is!able!to!be!
resolved!by!that!analyst’s!functional!group.!
• Assign!Incidents!to!others!within!the!functional!group!
as!necessary.!
• Communicate!with!users,!keeping!them!informed!of!
the!Incident’s!progress,!troubleshooting,!confirming!
Incident!resolution!
• As!available!and!necessary,!escalate!Incidents!to!
higher!support!Tiers!or!third-party!vendors/support.!
• Initiate!the!Resolution,!Recovery!and!Closure!activity!
once!an!Incident!resolution!is!identified.!
!
!
! !
6
!
!
Workflow!
!
Activities!
!
Incident!Identification,!Logging!Categorization!and!Prioritization !
!
!
!
Cross-Functional$Flow$Diagram$
!
WSUIM$1.1:$Incident$Identification$
A!call!first!needs!to!be!identified!as!an!Incident!and!not!another!process!(e.g.,!Request!
Fulfillment).!An!Incident!is!defined!as!a!production!IT!service!that!is!not!functioning!or!not!
functioning!at!an!acceptable!level.!
7
!
!
RACI!Matrix!
A!RACI!Matrix!defines!who!is!Responsible,!Accountable,!Consulted!and!Informed!for!a!given!
activity.!
Name'
Duties'
Type'
Incident'Manager'
Accountable!for!the!entire!process,!and!for!
identifying!changes!that!may!need!to!be!made!to!
the!process!
A!
Service'Desk'Manager'
Responsible!for!the!day-to-day!supervision!of!the!
Service!Desk.!Will!assist!Service!Desk!Analysts!in!
properly!logging!Incidents.!
R!
Service'Desk'Analyst'
Responsible!for!handling!the!incoming!contact!
with!the!User!and!properly!identifying!whether!
the!reported!issue!is!an!Incident.!
R!
Tier'2/3'Analyst'
Responsible!for!reporting!Incidents!to!the!
Service!Desk!that!are!either!identified!by!or!
reported!to!a!Tier!2/3!Analyst.!
!
If!a!Tier!2/3!Analyst!chooses!not!to!inform!the!
Service!Desk,!the!Tier!2/3!Analyst!will!perform!
the!duties!assigned!to!the!Service!Desk!Analyst.!!
R!
Tier'2/3'Manager'
Responsible!for!the!day-to-day!supervision!of!the!
Tier!2/3!Analysts.!
!
If!a!Tier!2/3!Analyst!chooses!not!to!inform!the!
Service!Desk!of!an!Incident,!the!Tier!2/3!
Manager!will!perform!the!duties!assigned!to!the!
Service!Desk!Manager!
R!
User'
User!is!responsible!for!notifying!the!Service!Desk!
of!any!Incidents!they!identify.!
R!
!
!
WSUIM$1.2:$Incident$Logging$
The!Incident!is!logged!into!ServiceNow.!The!Incident!record!will!include!User!details,!including!
name,!location!of!Incident!and!pertinent!contact!information.!Incident!record!should!also!
include!as!many!details!as!possible!regarding!the!Incident,!including!relevant!description!
information,!and!if!available!the!Configuration!Item!experiencing!the!Incident.!
!
8
!
!
RACI!Matrix!
A!RACI!Matrix!defines!who!is!Responsible,!Accountable,!Consulted!and!Informed!for!a!given!
activity.!
Name'
Duties'
Type'
Incident'Manager'
Accountable!for!the!entire!process,!and!for!
identifying!changes!that!may!need!to!be!made!to!
the!process!
A!
Service'Desk'Manager'
Responsible!for!the!day-to-day!supervision!of!the!
Service!Desk.!Will!assist!Service!Desk!Analysts!in!
properly!logging!Incidents.!
R!
Service'Desk'Analyst'
Service!Desk!Analyst!will!be!the!likely!recipient!of!
the!reported!Incident.!Service!Desk!Analyst!is!
responsible!for!logging!appropriate!details!of!the!
Incident!into!ServiceNow!
R!
Tier'2/3'Analyst'
If!a!Tier!2/3!Analyst!chooses!not!to!inform!the!
Service!Desk,!the!Tier!2/3!Analyst!will!perform!
the!duties!assigned!to!the!Service!Desk!Analyst.!!
R!
Tier'2/3'Manager'
Responsible!for!the!day-to-day!supervision!of!the!
Tier!2/3!Analysts.!
!
If!a!Tier!2/3!Analyst!chooses!not!to!inform!the!
Service!Desk!of!an!Incident,!the!Tier!2/3!
Manager!will!perform!the!duties!assigned!to!the!
Service!Desk!Manager!
R!
User'
User!can!view!the!status!of!an!Incident!via!the!
Self!Service!Portal.!
I!
!
WSUIM$1.3:$Incident$Categorization$
The!Incident!will!be!categorized!into!an!appropriate!category/subcategory!as!pre-defined!
within!ServiceNow.!CaTS!is!using!a!modified!Categorization!structure!developed!by!the!
EDUCAUSE!Center!for!Analysis!and!Research!(ECAR).!
RACI!Matrix!
A!RACI!Matrix!defines!who!is!Responsible,!Accountable,!Consulted!and!Informed!for!a!given!
activity.!
Name'
Duties'
Type'
Incident'Manager'
Accountable!for!the!entire!process,!and!for!
identifying!changes!that!may!need!to!be!made!to!
the!process!
A!
Service'Desk'Manager'
Responsible!for!the!day-to-day!supervision!of!the!
C!
9
!
!
Service!Desk.!
!
May!be!consulted!in!determining!the!
appropriate!categorization!for!an!Incident.!
Service'Desk'Analyst'
Responsible!to!use!judgment!to!categorize!the!
Incident!appropriately.!!!
R!
Tier'2/3'Analyst'
If!a!Tier!2/3!Analyst!chooses!not!to!inform!the!
Service!Desk,!the!Tier!2/3!Analyst!will!perform!
the!duties!assigned!to!the!Service!Desk!Analyst.!!
R!
Tier'2/3'Manager'
Responsible!for!the!day-to-day!supervision!of!the!
Tier!2/3!Analysts.!
!
If!a!Tier!2/3!Analyst!chooses!not!to!inform!the!
Service!Desk!of!an!Incident,!the!Tier!2/3!
Manager!will!perform!the!duties!assigned!to!the!
Service!Desk!Manager!
R!
User'
User!is!able!to!view!the!status!of!an!Incident!
within!the!Self!Service!Portal!
I!
!
WSUIM$1.4:$Incident$Prioritization$
An!Incident!is!prioritized!based!on!the!Impact!and!Urgency!of!the!reported!Incident.!!
Impact:'Defines!how!widely!the!Incident!affects!users.!CaTS!will!utilize!the!following!to!
determine!Impact:!
High!
Impacts!teaching!and!learning,!or!support!services,!for!the!entire!university!or!
many!departments;!or!is!an!imminent!threat!to!public!or!life!safety.!!
Medium!
Impacts!teaching!and!learning,!or!support!services,!for!a!single!or!few!
departments;!or!is!a!moderate!threat!to!public!or!life!safety.!
Low'
Impacts!teaching!and!learning,!or!support!services,!for!an!individual!or!few!users;!
or!is!a!low!threat!to!public!or!life!safety.!
!
Urgency:!Defines!the!level!of!business!criticality!of!the!affected!service(s)!
High!
Core!line!of!business!or!critical!support!services!are!affected;!or!an!imminent!
threat!to!public!or!life!safety.!!
Medium!
General!university!support!services!are!affected.!
Low'
Non-critical!university!services!are!affected.!
!
By!default,!ServiceNow!will!select!the!priority!of!an!Incident!from!a!pre-defined!matrix!based!on!
the!selected!Impact!and!Urgency!entered!by!the!Service!Desk!Analyst.!However,!the!Analyst!is!
10
!
!
able!to!override!the!pre-defined!priority!if!they!feel!the!matrix!does!not!provide!an!adequate!
priority!of!the!given!Incident.!An!Analyst!required!to!provide!a!justification!of!the!priority!
override!within!a!field!in!the!Incident!record.!All!priority!overrides!will!be!reviewed!by!the!
Incident!Manager!as!part!of!Continual!Service!Improvement.!
Incidents!logged!as!either!priority!1'–'Critical!or!2'–'High'will!be!classified!as!“Major!Incidents”!
and!will!invoke!the!Major!Incident!Process.!
!
Incident!Matrix!
!
Impact!
Urgency!
!
1'–'High'
2'–'Medium'
3'–'Low'
1'–'High'
1!–!Critical!
2!–!High!
3!–!Medium!
2'-'Medium'
2!–!High!
3!–!Medium!
4!–!Low!
3'-'Low'
3!–!Medium!
4!-!Low!
5!-!Planning!
!
RACI!Matrix!
A!RACI!Matrix!defines!who!is!Responsible,!Accountable,!Consulted!and!Informed!for!a!given!
activity.!
Name'
Duties'
Type'
Incident'Manager'
Accountable!for!the!entire!process,!and!for!
identifying!changes!that!may!need!to!be!made!to!
the!process!
!
Responsible!for!reviewing!priority!overrides!as!
part!of!Continual!Service!Improvement.!
A/R!
Service'Desk'Manager'
Responsible!for!the!day-to-day!supervision!of!the!
Service!Desk.!
!
May!be!consulted!by!Service!Desk!Analysts!to!
determine!the!appropriate!Impact!and!Urgency!
of!a!reported!Incident,!and!if!necessary!indicate!
that!the!priority!should!be!overridden.!
C!
Service'Desk'Analyst'
Responsible!to!use!judgment!to!select!the!
appropriate!Impact!and!Urgency!of!a!reported!
Incident,!and!to!override!the!pre-defined!priority!
if!necessary.!
R!
Tier'2/3'Analyst'
If!a!Tier!2/3!Analyst!chooses!not!to!inform!the!
Service!Desk,!the!Tier!2/3!Analyst!will!perform!
the!duties!assigned!to!the!Service!Desk!Analyst.!!
R!
11
!
!
Tier'2/3'Manager'
Responsible!for!the!day-to-day!supervision!of!the!
Tier!2/3!Analysts.!
!
If!a!Tier!2/3!Analyst!chooses!not!to!inform!the!
Service!Desk!of!an!Incident,!the!Tier!2/3!
Manager!will!perform!the!duties!assigned!to!the!
Service!Desk!Manager!
R!
User'
User!is!consulted!to!assist!the!Service!Desk!
Analyst!in!choosing!the!appropriate!Impact!of!a!
reported!Incident.!
C!
!
Incident!Diagnosis!and!Escalation!
Cross$Functional$Diagram$
!
WSUIM$2.1:$Incident$Diagnosis$
The!Analyst!who!logs!the!Incident!will!attempt!to!discover!the!full!symptoms!of!the!Incident!
and!determine!the!cause!and!possible!resolution.!A!resolution!may!be!found!by!using!a!
combination!of:!referencing!a!Known!Error!Database!(KEDB),!use!of!diagnostic!scripts,!or!
utilizing!Incident!Matching.!If!a!Resolution!is!found,!the!Incident!can!be!resolved;!otherwise!it!
will!be!escalated.!If!escalated,!the!user!is!informed!of!this!fact!and!is!provided!the!Incident!
record!number.!
12
!
!
RACI!Matrix!
A!RACI!Matrix!defines!who!is!Responsible,!Accountable,!Consulted!and!Informed!for!a!given!
activity.!
Name'
Duties'
Type'
Incident'Manager'
Accountable!for!the!entire!process,!and!for!
identifying!changes!that!may!need!to!be!made!to!
the!process!
A!
Service'Desk'Manager'
Responsible!for!the!day-to-day!supervision!of!the!
Service!Desk.!
!
May!be!consulted!by!Service!Desk!Analysts!to!
assist!in!the!Incident!Diagnosis!process.!
C!
Service'Desk'Analyst'
Responsible!to!properly!diagnose!the!Incident!
using!available!documentation!and!resources.!
R!
Tier'2/3'Analyst'
If!a!Tier!2/3!Analyst!chooses!not!to!inform!the!
Service!Desk,!the!Tier!2/3!Analyst!will!perform!
the!duties!assigned!to!the!Service!Desk!Analyst.!!
R!
Tier'2/3'Manager'
Responsible!for!the!day-to-day!supervision!of!the!
Tier!2/3!Analysts.!
!
If!a!Tier!2/3!Analyst!chooses!not!to!inform!the!
Service!Desk!of!an!Incident,!the!Tier!2/3!
Manager!will!perform!the!duties!assigned!to!the!
Service!Desk!Manager!
R!
User'
User!is!consulted!to!assist!the!Service!Desk!
Analyst!in!properly!diagnosing!the!Incident.!This!
may!involve!receiving!instruction!from!the!
Service!Desk!Analyst!and!performing!instructed!
tasks.!
C!
!
WSUIM$2.2:$Investigation$and$Diagnosis$
The!Analyst!logging!the!Incident!will!investigate!and!diagnose!the!Incident!in!order!to!
understand!as!fully!as!possible!all!relevant!details!of!the!Incident.!This!can!include:!establishing!
exactly!what!has!gone!wrong;!the!chronological!order!of!events;!confirming!full!impact!of!the!
Incident!including!number!of!users!affected;!identifying!any!events!that!could!have!triggered!
the!Incident!(e.g.,!a!recent!change,!or!user!action);!and!performing!detailed!searches!of!
previous!Incidents!or!Problems,!entries!in!Known!Error!Databases,!vendor!knowledge!databases!
or!available!error!logs.!
Once!the!potential!resolution!has!been!identified,!the!actions!to!be!undertaken!to!resolve!
should!be!applied.!This!may!require!asking!the!user!to!follow!certain!directions!or!activities,!
13
!
!
may!involve!CaTS!staff!performing!certain!activities!(e.g.,!restarting!a!failed!service,!remote!
control!session!of!user’s!computer,!etc),!or!may!involve!a!third-party!vendor!to!perform!
activities.!
RACI!Matrix!
A!RACI!Matrix!defines!who!is!Responsible,!Accountable,!Consulted!and!Informed!for!a!given!
activity.!
Name'
Duties'
Type'
Incident'Manager'
Accountable!for!the!entire!process,!and!for!
identifying!changes!that!may!need!to!be!made!to!
the!process.!
A!
Service'Desk'Manager'
Responsible!for!the!day-to-day!supervision!of!the!
Service!Desk.!
!
May!be!consulted!by!Service!Desk!Analysts!to!
assist!in!investigating!the!Incident!and!its!causes.!
C!
Service'Desk'Analyst'
Responsible!for!Investigating!and!Diagnosing!the!
Incident.!
R!
Tier'2/3'Analyst'
If!a!Tier!2/3!Analyst!chooses!not!to!inform!the!
Service!Desk,!the!Tier!2/3!Analyst!will!perform!
the!duties!assigned!to!the!Service!Desk!Analyst.!!
R!
Tier'2/3'Manager'
Responsible!for!the!day-to-day!supervision!of!the!
Tier!2/3!Analysts.!
!
If!a!Tier!2/3!Analyst!chooses!not!to!inform!the!
Service!Desk!of!an!Incident,!the!Tier!2/3!
Manager!will!perform!the!duties!assigned!to!the!
Service!Desk!Manager!
R!
User'
User!is!consulted!to!assist!the!Service!Desk!
Analyst!in!properly!investigating!the!Incident.!
This!may!involve!receiving!instruction!from!the!
Service!Desk!Analyst!and!performing!instructed!
tasks.!
C!
!
WSUIM$2.3:$Functional$Escalation$to$Tier$2/3$
If!an!Incident!is!not!able!to!be!resolved!by!the!Service!Desk!Analyst,!the!Service!Desk!Analyst!
will!escalate!the!Incident!to!the!appropriate!Tier!2!support!group.!!The!receiving!Tier!2/3!group!
and/or!analyst!is!responsible!for!completing!the!Incident!Management!lifecycle.!
14
!
!
RACI!Matrix!
A!RACI!Matrix!defines!who!is!Responsible,!Accountable,!Consulted!and!Informed!for!a!given!
activity.!
Name'
Duties'
Type'
Incident'Manager'
Accountable!for!the!entire!process,!and!for!
identifying!changes!that!may!need!to!be!made!to!
the!process.!
A!
Service'Desk'Manager'
Responsible!for!the!day-to-day!supervision!of!the!
Service!Desk.!
!
May!be!consulted!by!Service!Desk!Analysts!to!
determine!whether!an!Incident!needs!to!be!
escalated!to!a!higher!Tier.!
C!
Service'Desk'Analyst'
Responsible!for!determining!whether!an!Incident!
needs!escalated.!
R!
Tier'2/3'Analyst'
If!a!Tier!2/3!Analyst!chooses!not!to!inform!the!
Service!Desk,!the!Tier!2/3!Analyst!will!perform!
the!duties!assigned!to!the!Service!Desk!Analyst.!
!
Once!the!Tier!2/3!Analyst!receives!the!escalated!
Incident,!they!are!responsible!for!remaining!
activities!in!the!Incident!Management!process.!!
R!
Tier'2/3'Manager'
Responsible!for!the!day-to-day!supervision!of!the!
Tier!2/3!Analysts.!
!
If!a!Tier!2/3!Analyst!chooses!not!to!inform!the!
Service!Desk!of!an!Incident,!the!Tier!2/3!
Manager!will!perform!the!duties!assigned!to!the!
Service!Desk!Manager!
R!
User'
User!is!informed!that!the!Incident!has!been!
escalated,!and!is!provided!the!Incident!Record!
Number.!
I!
!
WSUIM$2.4:$Management$Escalation$
Certain!Incidents!may!require!escalation!through!management!and!higher!levels!of!the!
organization.!This!may!include!Incidents!reported!for!VIP!users,!if!an!Incident!appears!to!be!
taking!too!long!to!resolve,!an!Incident!is!nearing!a!breach!of!an!SLA,!an!Incident!involving!
sensitive!or!confidential!matters,!or!if!the!receiving!Analyst!feels!the!standard!Incident!
workflow!is!insufficient!to!resolve!the!Incident.!
15
!
!
In!these!cases,!Management!will!make!best!judgment!to!determine!how!the!Incident!will!flow!
to!resolution;!however,!will!make!every!effort!to!follow!the!standard!process!as!closely!as!
possible.!The!Manager!receiving!the!escalation!may!take!ownership!of!the!Incident!or!may!
provide!consultation!to!the!receiving!Analyst.!
RACI!Matrix!
A!RACI!Matrix!defines!who!is!Responsible,!Accountable,!Consulted!and!Informed!for!a!given!
activity.!
Name'
Duties'
Type'
Incident'Manager'
Accountable!for!the!entire!process,!and!for!
identifying!changes!that!may!need!to!be!made!to!
the!process.!
!
May!be!responsible!for!escalating!the!Incident!
through!further!Management!levels!or!
functional!Tiers.!
A/R!
Service'Desk'Manager'
Responsible!for!the!day-to-day!supervision!of!the!
Service!Desk.!
!
May!be!consulted!by!Service!Desk!Analysts!to!
determine!whether!an!Incident!needs!to!be!
escalated!through!Management.!If!so,!may!be!
responsible!for!escalating!the!Incident!through!
further!Management!levels!or!functional!Tiers.!
R/C!
Service'Desk'Analyst'
Responsible!for!determining!whether!an!Incident!
needs!escalated.!
R!
Tier'2/3'Analyst'
If!a!Tier!2/3!Analyst!chooses!not!to!inform!the!
Service!Desk,!the!Tier!2/3!Analyst!will!perform!
the!duties!assigned!to!the!Service!Desk!Analyst.!
!
R!
Tier'2/3'Manager'
Responsible!for!the!day-to-day!supervision!of!the!
Tier!2/3!Analysts.!
!
If!a!Tier!2/3!Analyst!chooses!not!to!inform!the!
Service!Desk!of!an!Incident,!the!Tier!2/3!
Manager!will!perform!the!duties!assigned!to!the!
Service!Desk!Manager!
R!
User'
User!is!informed!that!the!Incident!has!been!
escalated,!and!is!provided!the!Incident!Record!
Number.!
I!
!
16
!
!
Resolution,!Recovery!and!Closure!
Cross$Functional$Diagram$
!
WSUIM$3.1:$Resolution$and$Recovery$
Once!a!resolution!has!been!identified!as!successful,!the!details!leading!to!the!successful!
resolution! are!recorded!into! ServiceNow.!This!information!includes:!closure!notes,!closure!code,!
and!the!closure!configuration!item!(e.g.,!the!CI!that!was!actually!at!fault).!
The!Incident!will!be!marked!as!Resolved,!at!which!point!the!user!will!have!five!(5)!days!to!
indicated!whether!they!accept!that!the!Incident!has!been!resolved.!
RACI!Matrix!
A!RACI!Matrix!defines!who!is!Responsible,!Accountable,!Consulted!and!Informed!for!a!given!
activity.!
Name'
Duties'
Type'
Incident'Manager'
Accountable!for!the!entire!process,!and!for!
identifying!changes!that!may!need!to!be!made!to!
the!process.!
R!
Service'Desk'Manager'
Responsible!for!the!day-to-day!supervision!of!the!
Service!Desk.!
R!
Service'Desk'Analyst'
Responsible!for!ensuring!the!Incident!is!
Resolved,!consulting!with!the!User;!and!marking!
the!Incident!record!as!Resolved!
R!
Tier'2/3'Analyst'
If!a!Tier!2/3!Analyst!chooses!not!to!inform!the!
Service!Desk,!the!Tier!2/3!Analyst!will!perform!
the!duties!assigned!to!the!Service!Desk!Analyst.!
!
R!
17
!
!
If!an!Incident!has!been!escalated!to!Tier2/3,!the!
Tier!2/3!Analyst!is!responsible!for!ensuring!the!
Incident!is!Resolved,!consulting!with!the!User;!
and!marking!the!Incident!record!as!Resolved!
!
Tier'2/3'Manager'
Responsible!for!the!day-to-day!supervision!of!the!
Tier!2/3!Analysts.!
!
If!a!Tier!2/3!Analyst!chooses!not!to!inform!the!
Service!Desk!of!an!Incident,!the!Tier!2/3!
Manager!will!perform!the!duties!assigned!to!the!
Service!Desk!Manager!
R!
User'
User!is!consulted!to!verify!that!the!Incident!has!
been!resolved;!and!is!informed!when!the!
Incident!goes!into!Resolved!status.!
C/I!
!
WSUIM$3.2:$Incident$Closure$
After!5!days!of!being!in!resolved!states,!an!Incident!will!automatically!be!closed.!At!anytime!
during!the!5!day!window,!the!user!can!indicate!that!they!feel!the!resolution!is!inaccurate.!The!
user!can!do!this!by!either!clicking!the!appropriate!link!send!to!them!in!the!resolution!email,!or!
can!indicate!by!re-opening!the!Incident!in!the!self-service!portal.!
The!user!is!also!able!to!Close!the!Incident!sooner!than!5!days!by!clicking!the!appropriate!button!
within!the!self-service!portal.!
Once!the!Incident!has!been!moved!into!closed!status,!the!user!will!receive!an!email!inviting!
them!to!complete!a!Satisfaction!Survey.!
RACI!Matrix!
A!RACI!Matrix!defines!who!is!Responsible,!Accountable,!Consulted!and!Informed!for!a!given!
activity.!
Name'
Duties'
Type'
Incident'Manager'
Accountable!for!the!entire!process,!and!for!
identifying!changes!that!may!need!to!be!made!to!
the!process.!
R!
Service'Desk'Manager'
Responsible!for!the!day-to-day!supervision!of!the!
Service!Desk.!
R!
Service'Desk'Analyst'
Is!informed!once!the!Incident!goes!into!closed!
status.!
I!
Tier'2/3'Analyst'
If!a!Tier!2/3!Analyst!chooses!not!to!inform!the!
Service!Desk,!the!Tier!2/3!Analyst!will!perform!
I!
18
!
!
the!duties!assigned!to!the!Service!Desk!Analyst.!
Tier'2/3'Manager'
Responsible!for!the!day-to-day!supervision!of!the!
Tier!2/3!Analysts.!
!
If!a!Tier!2/3!Analyst!chooses!not!to!inform!the!
Service!Desk!of!an!Incident,!the!Tier!2/3!
Manager!will!perform!the!duties!assigned!to!the!
Service!Desk!Manager!
R!
User'
User!is!responsible!to!indicate!whether!an!
Incident!was!not!resolved!to!their!satisfaction.!If!
the!User!does!not!respond!to!the!resolution!
email!notification!within!5!days,!the!Incident!will!
automatically!close.!
R!
!
! !
19
!
!
Appendix!
Appendix!A!–!Service!Level!Targets:!Response!and!Resolution!
'
'
Default'Service'Level'Targets'(SLTs)*'
(Goal!of!all!priorities!is!to!achieve!response!and!resolution!time!95%)!
Priority'
Response'
Resolution'
1!-!Critical'
30!continuous!minutes!
4!continuous!hours!
2!-!High'
90!continuous!minutes!
1!continuous!day!
3!-!Moderate'
1!business!day!
3!business!days!
4!-!Low'
2!business!days!
5!business!days!
5!-!Planning!
2!business!days!
5!business!days!
!
Individual'Classroom'Incident'Service'Level'Targets'(SLTs)*'
(Goal!of!all!priorities!is!to!achieve!response!and!resolution!time!95%)!
Priority'
Response'
Resolution'
3!-!Moderate'
10!business!minutes!
30!business!minutes!
4!-!Low'
60!business!minutes!
8!business!hours!
5!–!Planning!
4!business!hours!
8!business!hours!
!
Individual'Workstation'Virus/Malware'Incident'
Service'Level'Targets'(SLTs)*'
(Goal!of!all!priorities!is!to!achieve!response!and!resolution!time!95%)!
Priority'
Response'
Resolution'
3!-!Moderate'
9!business!hours!(1!business!day)!
3!business!days!
4!-!Low'
13.5!business!hours!(1!½!business!days)!
3!business!days!
5!-!Planning!
2!business!days!
5!business!days!
!
Due!to!the!presence!of!sensitive!data,!Virus/Malware!Incidents!in!the!following!departments!
will!automatically!receive!a!priority!of!3,!and!Networking!Services!will!be!notified!immediately!
to!turn!off!network!connectivity!to!the!affected!workstation:!Business!and!Finance,!Human!
Resources,!Payroll.!
20
