• Inputs to the process: Incidents can be detected and reported in various ways. Users will call the service desk to report incidents. Technical staff may log incidents or email details of an incident they have identified to the service desk. Increasingly incidents are raised via web interfaces. The event management process will also report incidents by monitoring.
• Incident identification: Work to understand and resolve incidents cannot start until an incident has been identified. For this reason, monitoring of the components that make up key services is essential. Incidents can be identified in various ways by users, technical staff and by monitoring.
• Incident logging: All incidents must be logged with the date and time being recorded. At this stage, the information required to manage the incident will be logged. This will include a unique reference number, a description of
symptoms, the service or CI impacted, the impact, its urgency and the name of person raising the incident or the method of raising the incident.
• Incident categorisation: A suitable categorisation code will be allocated. For example, this may be hardware or software with sub-codes for lower level
categorisation. Accurate categorisation is important because it will allow
useful metrics to be gathered highlighting areas of the infrastructure where incidents are occurring.
• Incident prioritisation: The priority of an incident is based on the impact and the urgency. Impact is the ‘pain’ to the business. Impact may relate to the number of users impacted, the potential financial loss to the organisation, the risk of breach of regulatory or legislative rules or, for some services, the risk of loss of life. Urgency relates to how quickly the business requires the incident to
be resolved.