ITIL Service Operation

Finally! Service Operation is a real man's book. This is where it happens. Here we make money. All we do in Strategy, Design and Transition makes sense here. Service Provider does day-to-day activities of keeping the service available and customer happy.
If you are going to read any of the five books, my bet is that this will be the one. Since in the beginning we are all interested in consequences more than causes. 

Purpose
To do everything necessary for service delivery at agreed levels.

Objectives

• Minimizing the adverse impact of service outages on business activities
• Delivering and supporting the agreed services effectively and efficiently
• Maintaining access to services for authorized customers (and no one else)

Scope

• People
• Processes (Service Management)
• Technology
• Services

Value

• Reduced outage duration and frequency
• Operational results and data provided
• Enforcement of security policy

ITIL Service Operation Mind Map

Service Operation Processes:

Incident Management
Key process, one of the oldest Service Support processes. If you know anything about ITIL, odds are that you know Incident Management. It is in charge of restoring disrupted service as soon as possible.

Event Management
This process was added in V3 to address emerging use of monitoring tools in IT and describe the relation to Incident Management from V2.

Request Fulfilment
This is another offspring of the holly Incident Management, cause of many an internet forum discussion 'What is Request Fulfilment?" or likes.  Definition is simple: Request Fulfilment manages customer requests. Which by definition can be: requests for info or advice; for a Standard Change or for access to an IT Service. Simple. Have a look at article about password reset.

Problem Management
As opposed to Incident Management, Problem Management seeks underlying causes of one or more incidents and through lifecycle of known error-workaround-permanent fix,  strives to minimize the adverse impact of problems to the business process. Problem Management can be reactive and proactive.

Access Management
Another new one in V3. This is actually a process which spends a lot of Operations time - handling customer access rights . New users, approvals, identity statuses, logging and tracking, removal of rights.


Service Operation Functions:

Service Desk
The only function in V2, Service Desk is the single point of contact (SPOC) and an interface to a user for all communication with service support, all Operation and most of Transition processes. With accent to Incident Management, Request Fulfilment and Event Management.

Technical Management
Technical Management takes care of technology competencies. It identifies, develops and refines the knowledge needed to design, test, manage and improve the service. It also manages trainings and deployment of resources.

IT Operations Management
Operations Management does daily operational activities needed for IT Infrastructure management. It consists of Operations Control which performs routine operational tasks, and Facilities Management which manages physical environment.

Application Management
Application Management was a separate book in V2. It is responsible for managing Applications across their lifecycle (Requirements-Design-Build-Deploy-Operate-Optimize).

ITIL Service Transition

Service Transition is a stage which gives most pain to the IT Service Provider. Transition (add new, change existing, retire old service) is a source of many service disruptions. So we want our transition of service to be planned, built, tested, evaluated and deployed in an organized and controlled manner.

  

Purpose

To ensure that new or modified services are in conformance with business requirements, as defined in previous Strategy and Design stages, and that services which are no longer needed are properly retired.

Objectives

• Efficiently and effectively plan and manage service changes
• Manage change risks
• Release planned changes
• Manage expectations on new or changed services
• Manage accurate knowledge and info on changed services and assets

Value

• Better estimation of cost, timing, resource requirement and risks
• Higher volumes of successful change
• Reduce delays from unexpected clashes and dependencies
• Reduced effort spent on managing test and pilot environments
• Improved expectation setting for all stakeholders
• Increased confidence that new or changed services can be delivered to specification without unexpectedly affecting other services or stakeholders
• Ensure that new or changed services will be maintainable and cost- effective
• Improved control of service assets and configurations.

Scope

Creating new and changing existing services, implementing new and changed services, service retirement. Plan-build-test-evaluate-deploy.

Key principles

• Align service transition plans with the business needs
• Implement all changes through transition
• Adopt a common framework and standards
• Maximize re-use of established processes and systems
• Manage relationships with stakeholders
• Manage systems for transfer of knowledge and decision support
• Plan release packages
• Proactively manage resources across transitions

ITIL V2011 Service Transition Mind Map

Service Transition Processes:

  

Transition Planning and Support

Since Transition is so important, ITIL  defines the separate Transition Planning and Support process in order to manage and control changes and releases, from overall planning to specific transition resources management. The accent here is on standardization and best practices, managing of overall resources and helping with major changes and releases but not detailed planning of individual changes.

  

Change Management

Change Management is the key Transition process, and one of the key ITIL processes altogether. Since changes are the main cause of service disruptions, we want as much control of change as possible. In Change Management we ensure that all changes are recorded and evaluated. Authorized changes are prioritized, planned, tested, implemented, documented and reviewed. This way number of failed and unauthorized changes is significantly reduced, as well as number of resulting incidents and problems.

  

Service Asset & Configuration Management

This process was previously named Configuration Management and dealt with Configuration Management Database (CMDB). It looked and sounded too technical which scared off some new business-minded people in ITIL. In fact, Conf. Management was in charge of our knowledge of infrastructure: what do we have, where it is and how it works. To be more in spirit of the business aspect of this process, Asset management flavor was added, so now we follow lifecycle of IT assets from cradle to grave and actual info on this assets is available from all processes, any time.

  

Release and Deployment Management

Previous Release Management was the most difficult to explain in an "Elevator presentation", so deployment was added in order to enable Americans to get it quicker. It would be less confusing if it was called only Deployment management from the beginning. In a nutshell (or elevator :)) RDM deals with consequences of Change Management process: build, test and deployment of releases.

  

Service Validation and Testing

This one is a separate process since it is a discipline used throughout the lifecycle, mainly from Change and Release management. Service Validation and Testing will ensure that the service will deliver expected outcomes, and that it is 'fit for purpose' and 'fit for use' (Utility and Warranty, remember them from Strategy?).

  

Change Evaluation

This was 'Evaluation' in V3, and probably since no one knew what it relates to, they added 'Change' in 2011. So now we know it is a process which deals with evaluation of change. It is implemented to identify all predicted and unpredicted change effects. Smaller changes can be evaluated within Change Management, and for more significant changes (up to company to decide).  It is triggered before every approval point.

  

Knowledge Management

Knowledge Management was such a hype in 90's! Here in ITIL Service Transition, it is added as a nice to have process which is even in the foundations syllabus. General idea is to capture and manage knowledge as Service Provider's intellectual property. Methods are classic KM, I even recommend the reading since it is digest version of all I once knew about Knowledge Management.

ITIL Service Design

Service Design connects the Strategy with Transition and Operation, providing tools to create and redesign services aligned with strategic objectives. It takes care that service management is fully aligned with business needs and uses its capabilities in an efficient and resilient manner.

Purpose
To design IT Services in a cost-effective, secure manner and in accordance to Service Strategy, and to take care of designed service delivery having in mind customer satisfaction.
A set of design governance documents is defined: methods, best practices, procedures and policies.

Objective
Effective IT Service design using continual improvement methods, ensuring service alignment with existing and new business requirements.

Five Aspects of Service Design
deal with designing:
 • service solutions for new or changed services
 • management information systems and tools
 • technology architectures and management architectures
 • processes
 • measurement methods and metrics

Four Ps:
(we remember them as People, Processes, Technology from last version)
 • People
 • Processes
 • Products (services, technologies, tools)
 • Partners (manufacturers, supplier,  vendors)

Service Design Package (SDP)
Definition: "Service Design Documents defining all aspects of an IT Service and its Requirements through each stage of its Lifecycle. A Service Design Package is produced for each new IT Service, major Change, or IT Service Retirement"

ITIL V2011 Service Design Mind Map

Service Design processes:

Service Catalogue Management
Deals with management of information about all live services. Info has to be accurate and current.

Availability Management
One of the oldest ITIL processes, connected to SLM. Ensures that delivered services availability is in accordance with the agreed levels. Of course, in a timely and cost-effective manner.

Capacity Management
Another V2 veteran: Capacity Management wants to ensure that IT capacity (infrastructure and services) meets the agreed requirements in a cost effective (and timely, of course) manner. Capacity management spans through all ITIL lifecycles, since cost-effectiveness and efficiency are among the basic reasons for ITIL existence.

IT Service Continuity Management
IT Service Continuity Management (ITSCM) process is responsible for the alignment of IT services to Business Continuity Management.

Service Level Management
This is a matured key process, SLM ensures that all services are delivered as agreed. It is tightly coupled with other processes emerged from Service Delivery group. Main purpose of SLM is to improve communication and understanding of Business and Service Provider.

Design Coordination
New in ITIL 2011, this process became the central point of communication and control for all processes in Service Design stage.
Design Coordination process is in charge of all design activities, whether they are done through projects or Change Management. It ensures consistent design of services which are aligned with Service Strategy and will be properly prepared for Transition.

Information Security Management
ISM is a governance process which ensures that information security policy  is aligned with business security. ISM maintains and enforces the security policy.

Supplier Management
A fresh process which was probably introduced for better compliance with ISO/IEC 20000, same as Business Relationship Management in Service Strategy. Supplier Management ensures getting value for money from suppliers. All activities are included: negotiation, agreements, supplier performance management, seamless integration of underpinning contracts and delivered services.

ITIL Service Strategy

Service Strategy has the central position in the circular ITIL lifecycle model.
By a broader definition, strategy is a plan devised to achieve a long-term aim. Service strategy is therefore a systematic long-term plan designed by the IT service organization to achieve defined objectives.

A good service strategy should define a way to create and deliver a better value to the customer.
Main objective of service strategy is to recognize competitors and have them in mind when considering services which will in some way be better than the competition's.

Service management is regarded as a strategic asset in the service strategy stage.

Service Strategy deals with

• developing service markets
• service provider types
• development of a service portfolio
• financial aspects of service management
• business relationships and others.

Strategy provides the tools and guidance to an organization to step back from daily operation and view existing services in terms of

• costs
• risks involved
• their performance

Strategy is about the pure cause of services, not about effects and how-to’s.

Service Strategy deals with some key principles:

• Utility and warranty
• Utility is "what is the service"/fit dor purpose.
• Warranty is "how it works"/fit for use.
• Value Creation - what does the service do for the customer and how he/she sees it.
• Assets -anything that can help us to deliver the service. Assets are either resources or capabilities.
• Resource - a kind of physical assets: infrastructure elements, people, financial capital, applications.
• Capabilities - intangible assets: usualy the ability to create value.
• Patterns of Business Activity (PBA) every cutomer has activities which generate demand for services.
• Governance - defines how we implement and follow strategy, policies and processes.

ITIL V2011 Service Strategy Mind Map

Service Strategy Processes:

Service Portfolio Management
A service organization manages investments in services across the lifecycle by exercising Service Portfolio Management.
Service Portfolio Management enables customers to understand what services are available, why they should use them (and why from this provider) and what will be the costs. Also to govern the services in such a way to support Service Strategy.
It enables a service organization to determine weaknesses and strengths of their portfolio, what the priorities and weaknesses of their investment are and how to allocate resources according to these priorities and risks.
Service Portfolio Management deals with

• services which will be delivered (pipeline)
• services which are being delivered (catalogue)
• withdrawn services (retired)

Financial management for IT services

Financial management enables the service organization to measure the value of IT services and underpinning assets. It manages cost-effectiveness of IT Service Management.

Service organizations use Financial management  to achieve Better decision making, Change Speed, Better Service Portfolio Management, Financial and Operational control, Sense of service value.

In ITIL 2011 returned to key activities from earlier versions:

• Accounting
• Budgeting
• Charging

Demand modeling is focused on TCO of service provision to the customer.

Return of Investment (ROI) is the main value of an investment.

Business Relationship Management
This is a newly defined process in Service Strategy. Here is the culprit for the fact that Measurement and Reporting are not in CSI any more. Anyway, this is a welcome change. BRM existed for some time in ISO/IEC20000 and is widely recognized as a crucial process in IT Service Management. Its main purpose is to support most of other processes in all lifecycle stages - by helping Service organization and Business to better understand each other. Which is, as we know, the basic means/goal to all ITSM organized voyages. If Business and IT don't make an effort to speak the same language, to understand each other's pains, then all the other endeavors are meaningless.

Demand Management
Another new  process! Previously, Demand Management was dealt with inside of Capacity Management. On primary ITSM levels, it is the right place for Demand Management. But since we started dealing with Strategy and Design lifecycle stages, we saw Demand as the crucial driver for them. So here it is.

Service Strategy is the most boring ITIL book. It was most thoroughly rewritten in 2011., and it still helps me to fall asleep when all other methods fail :)
On the other hand, it contains some very important concepts and aspects of Service Management which tend to be more and more interesting as you gather experience working in IT industry.

ITIL 2011 Processes

Here is a clear and organized table of ITIL 2011 processes for you. What is where, what is important, what is old and new:

ITIL 2011 Processes Table

There are some changes from 2007 edition.

What is not so obvious from this table, most of the changes happened in Service Strategy. Strategy Generation is not treated as a process any more, rest of the processes are more uniformly described. New processes are Strategy management for IT Services and Business Relationship Management.

Some interesting changes in Service Design also: processes are better described and aligned, I like to see clarified Pipeline to Catalogue transition. New process is Design Coordination.

Less radical changes in Service Transition. Understandable, since these were mature processes. Except for Evaluation, which is now called Change Evaluation process.

Least changes in Service Operation. Of course, new Service Fulfillment and Event Management additionally clarified. Interesting , but not unexpected, Problem Management was polished some more. Looks like Problem Management was problematic from the beginning :)

Continual Service Improvement: of course, more changes. CSI model is now CSI approach. 7-step process has seven steps :)  What bothers  me a little is that Service Measurement and Reporting are not processes any more. Where I work, these are most important processes and the right place for them is in CSI.

Functions

All four functions are still Defined in Service Operation:

• Service Desk
• Technical Management
• IT Operations Management
• Application Management

Generally, I like the way things are developing. This is probably not the last of changes we will see in ITIL. TSO and Cabinet Office people are taking care of their baby.

ITIL 2011 - What Happened?

ITIL Lifecycle Suite 2011 Edition

As you can see in an excellent ITIL History article on this blog, ITIL has come a long way from first publications in late 80's. In July 2011 ITIL V3 was updated to 2011 edition.
Now folks, let's get down to basics. I will slowly go through changes and events and talk a little bit about every ITIL Lifecycle stage and what happened where. I am talking about my following posts here, of course. Those who know me understand the emphasis on SLOWLY here :)

So, we received a package of books which are 57% heavier (2,5kg increase) and have 46% more pages (+600) comparing to "old" 2007 V3 edition. Apparently, this increase was mostly due to thorough Service Strategy book rewrite, and of course a larger font used.

Service Strategy was the most vague and least accepted in larger ITSM community, so it really needed some serious rewriting. Other books were also improved to some point, a few new processes introduced, obvious ambiguities and errors removed (some new created), so the whole package looks more polished and admissible by the critical members of the community.

Complete list of Frequently Asked Questions can be found on APMG's ITIL Official Site on this page http://www.itil-officialsite.com/Publications/ITILPublicationUpdates.aspx  .

Also, a very fine summary of 2011 updates can be found on the same page. Look for ITIL 2011 Summary of Updates .

People at ILX Group were so kind to update their popular ITIL Process Model available free for download here: http://www.ilxgroup.com/downloads/itil-2011-process-model.pdf

Con
Critics among us will keep the mantra that the whole thing is a bit out of date and clinging to it's 80's roots, not referring enough to modern concepts of Clouds, Agile and Virtualization.
Also, they say that the vastness of material is repelling, supporting the complex Qualification scheme http://www.itil-officialsite.com/Qualifications/ITILQualificationScheme.aspx in a self-serving purpose to make more money.

Pro
On the other side, attaching tighter to modern technologies brings the danger of quicker obsolescence. Polishing general concepts made ITIL go this far, so "descriptive not prescriptive" motto lives on.
2000 pages is a lot, but it is fair to give the authors credit of the intention to cover adequately all topics in an integral baseline set of books.
For executives, beginners and innocent passers-by, Compact/Digest editions will probably follow soon, like this fine pocket book: http://itservicemngmt.blogspot.com/2012/02/new-itil-foundation-handbook-released.html

Anyway, most reviewers are happy with the overall 2011 update. Are you?

As I said, I intend to go through all five lifecycles in the following articles. Stay tuned.

What is Password Reset: Service Request, Incident or Change?

I browsed through a few social networks lately discussing basic Service Support activities like password reset. Interesting to see how even experienced IT professionals have different points of view on elementary procedures like this one.

One of discussions goes on and on about what is a Password Reset procedure: is it a Service Request, Incident or Change?
We can take for granted that these portals consider the simplest case of Password Reset event: the user forgot hers/his password. In a consolidated service desk of 2000s this was the most frequent event, making 50-80% of all calls.

Is it an Incident?
So, could it be an Incident? Obviously NOT. Incident definition requires a service downtime or probability of downtime. No service downtime here, only end user can't log in, by his own fault.

Why then a plenty of Service organizations treat these events as Incidents? Because of the Service Desk TOOL they (miss)use. They have a nice little tool which is ITIL approved by some elephant. It can do all the process, you name it. But implementation of additional modules costs money and time. They already have Incident Management. Their implementer sucks, their ITSM consultant could do better, and they are often the same person. So they created a category "Password reset" in Incident Management module and they treat password reset as an incident. That's why it has to be an incident. If the only tool you have is a hammer, every problem is a nail. Let's move further.

Is it a Service Request?
Is password reset request a Service Request? Of course it is, there it is in the ITIL definition of a Service Request:

• A request from a User for information or advice, or for a Standard Change or for Access to an IT Service. For example to reset a password, or to provide standard IT Services for a new User. Service requests are usually handled by a Service Desk, and do not require an RFC to be submitted.

So it's a small preapproved standard Change which is processed thru Request Fulfillment process.

Yes, it is a Change, but no need for Change Manager and CAB to get involved since it happens frequently and can be dealt with on the 1st level. And thank you God for technology you provided so that lately any end user password can be reset via a simple self-help portal. User just answers a secret question, puts in his employee ID and receives the new password via text message or such.

What other special flavors of password reset are there?

• Simple web application user passwords are a mild example of the above described case.
• Enterprise domain user password is closer to what first comes to our mind when we think about password reset. Now, we said it is a Service Request. In which cases it escalates to a Change Request? Well, if you have a strong security policy, implemented SOX or ISO/IEC 27001 and influential security officer, then it's possible that they require formalized approval cycle and implemented operational Standard Change procedure.
• VPN account passwords which enable user to connect from the outside of the company to internal network are a very sensitive security case, so all concerns regarding domain user accounts apply to them, and then some. A special case is a VPN account given to a 3rd party employee. Usually such a request has to have defined start and end of usage and approval from a high position (chief security, IT manager or CEO).
• Application Administrator account passwords enable the user to create a significant amount of damage to a company according to the importance of the application to the business. Examples: Intranet applications, CRM, ERP. Which one contains the most sensitive data for your company? Probably the ERP application.
• System Administrator Account presents the highest possible level of trust to an employee. Only security officer , Operations or IT Manager should approve these account creations and their password reset requests.
• Service Accounts under which different IT services are executed. These have to be taken care by the security officers, their catalogue has to point to services they enable (1:M relation) and access to their passwords has to be restricted only to most confidential people. Usually these accounts have broad authorization and they are set to rarely or never expire, so they should be maintained with utmost care, especially in organizations with frequent employee fluctuation. Best practice is to deposit them in a safe box by a single person.
   

Note: there are significant changes lately in best practices and recommendations with large vendors and consulting companies about the password lockout policy.
Until recently, the recommendation was to lock the user account after three to five unsuccessful attempts. What changed? Implementation of security standards and best practices introduced higher password complexity and more frequent user password changes. Majority of users have some kind of mobile device for connecting to an enterprise mail system. These devices cache user credentials and often lock-out user's accounts after password change. Virtualization also contributed to simplification of lockout policy since various user credentials can be cached on different physical and virtual machines.
Brute force attacks are measured in hundreds if not thousands of attempts in a short period of time, so it is now advised to lift the lockout attempt number to 60-100, or to turn the policy off completely and survey security logs with adequate tools.  

Let me just finish here in a nicer tone. ITIL is not too prescriptive in telling you how exactly to do things.
In the above example, if you process Service Requests as a special category Incidents, you are still in the green. Customers get their service, all needed reports can be generated as agreed, KPIs are there, you are good!

We are in business of keeping the customer business going. In the spirit of current holidays, I wish you the very best of luck with it. Because you are going to need it :)

For further reading I recommend 4.2 Incident Management, 4.3 Request Fulfilment and 4.5 Access Management chapters in ITIL Service Operation book.

Also, have a look at articles:

• Incident Management
• Change Management

ISO/IEC 20000 - A Brief History

From DISC PD 005 over BSI 15000 to ISO/IEC 20000. Specifications, requirements, Code of practice.

History is a myth that men agree to believe.
Napoleon

ISO/IEC 20000 Timeline

I have been looking around for some brief document with ISO/IEC 20000 history, and I could not find anything useful.

Here are a few major points I have collected from various sources in ISO/IEC 20000 history.

1995: British Standard Institution (BSI) published the first version of DISC PD 0005:1995 - Code of Practice for IT Service Management. It described only four basic ITSM processes.

1998: BSI publishes a revised version of DISC PD 0005:1998 and it already described all five process areas and 13 processes as we know it today.

2000: Published BS 15000:2000 - Specification for IT Service Management which was used together with the code of practice DISC PD 0005.
Also in 2000, the third supplementary document entitled DISC PD 0015:2000 IT Service Management Self-Assessment Workbook was published.  It was a questionnaire that enabled anyone to make an assessment of its compliance degree with BS 15000.
Some serious revisions and rewriting followed, resulting in standard documents very similar to today's norm:

2002: BS 15000-1:2002 IT service management - Specification for Service Management;
PD 0015:2002 - Self-Assessment Workbook

2003: BS 15000-2:2003 IT service management - Code of Practice for Service Management
The same year a new PD 0005:2003 Guide to Management of IT Service Management was published with explanations of the purpose of BS 15000, and also the framework guidance on how to use the standard processes and implement them.
BSI 15000 was adopted by many service companies in UK, and countries worldwide accepted it.

2005: BS-15000 was placed on the “fast track” by the ISO. By the end of the year, with some moderate changes, it was published as ISO/IEC 20000 standard:

• ISO/IEC 20000-1:2005 Specification  is very formal, it defines processes and provides assessment/ audit criteria.
• ISO/IEC 20000-2:2005 Code of Practice that gives HOW-TOs and describes best practices for implementation of Part 1.

Standard was unchanged for four years. Adoption was a bit slower due to somewhat lower ISO maturity level of the standard. The norm requirements were very demanding, and supplemental documentation was scarce and sometimes ambiguous. There was a need for some additional documentation:

2009: ISO/IEC TR 20000-3:2009 Guidance on scope definition and applicability  was published. It provided guidance on scope , applicability and of conformance for service providers

2010:

• ISO/IEC TR 20000-4:2010 Process reference model - describes  the service management system processes implied by ISO/IEC 20000-1 at an abstract level.
• ISO/IEC TR 20000-5:2010 Exemplar implementation plan for ISO/IEC 20000 -1 - provided guidance  to implementation of ISO/IEC 20000 by example and advice.

2011. April:  ISO/IEC 20000-1:2011 - new version of specification is out.

2012. February: ISO/IEC 20000-2:2012 - new Guidance on the application of service management systems published.

If someone has an update or a correction to this, I will be very glad to update the post. Thank you.

Related posts:

ISO/IEC 20000 Essentials
A few more words on ISO/IEC 20000

ISO/IEC 20000 Rediscovered
Describing differencies and similarities of ITIL and ISO/IEC 20000

ITIL and ISO/IEC 20000 Compared
ITIL V2 - ITIL V3 - ISO20000 comparisson table

Hope this helps. Have a nice day!

ITIL Major Incident - All you want to know

What is a Major Incident in ITIL? What are the roles and responsibilities? How to avoid common mistakes? What to do After the Resolution?

Trust me, I know what I'm doing!
Sledge Hammer

What is a Major Incident?
Definition of a Major Incident has to be clear to every employee in Service Support. Therefore it has to be clearly described in a separate document, Major Incident Procedure.

What makes a Major Incident? It is usually defined by the impact outage has or could have on customer’s business process. Also, it may be determined by priority of the incident or by its urgency.

How come that the impact isn’t allways the only factor in defining the Major incident? For example, an incident of high impact can be resolved by Service Desk thru a simple resolution procedure, like switch resetting after network down event, or connecting a backup provider after internet down event.

Both examples are definitely high impact but we don’t have to recruit a bunch of higher level people on it just yet. We just have to have in mind that they are Priority 1 and they have to be resolved ASAP. In case they can’t be resolved by standard procedure, THEN they can be marked Major and handled with appropriate procedure and policy. That’s why most leading Incident Management tools on the market have a separate checkbox Major or Hot incident.

This was all theory. In practice, to simplify the procedure and make it easier to Service Desk staff, this is what I usually advise: all priority 1 incidents are Major Incidents, if they are not exceptions. Exceptions can be easily defined for particular customers, contracts and incident categories. For example: Major incidents are all Priority 1 incidents except cash register tickets, which are urgent but can be fixed by technicians, no need to involve for more important people. Or: all categories except end user incidents. Simple.

Major Incident Team

OK, now we have determined it’s a Major Incident. What next? We establish a Major Incident Team. Members are:

• Service Desk Manager – he will be responsible for communication with resolution team and timely reporting to the customer
• Incident Manager – in reasonable service organizations Incident Manager is usually also the Service Desk Manager. If not, then these two have to work closely together.
• Major Incident Manager: a frequent mistake is to promote Incident or Service Desk Manager into Major Incident Manager. This doesn’t have to, but can cause some serious conflicts of interests: he has to survive somewhere between Incident Management, Problem Management, Business Management and the customer.
  Major Incident Manager has to be a liaison between all internal parties involved, also acquainted well to technical aspects of the outage. So he will often be recruited between people formerly engaged in a project, or those involved in service catalogue definition.
• Problem Manager: remember him? He will be most helpful here in investigative phase, towards closure phase, and a life saver in post mortem reporting. Better keep him on our side. Mind you, Major Incident is still an incident, but usually has some underlying cause which will be recognized as a Problem. Hence Incident and Problem Manager have to work closely here, each with his own goal in mind (service restoration vs. underlying cause).
• Other members of Major Incident Team: representatives of all people involved, impacted users, competent technical staff, vendors... Good practice would be to choose people here the same way you would choose ECAB (Emergency Change Advisory Board) members. There is always a chance that you will be implementing an Emergency Change during a Major Incident resolution process.

Resolution Process

Major Incident resolution works on tight SLA parameters. Service Desk takes care of them. Also, ticket updates and frequent feedback to customers is performed by Service Desk. Remember, customer hates to be kept in the dark, even if news are bad (no progress) they must be updated frequently.

Major Incident Procedure has to define the escalation policy in case of SLA breech. Usually the incident is escalated vertically to higher level IT / Business management and to vendors of services/equipment underpinning the service.

After the battle

Upon the resolution, Incident Management Team stays “on call” and monitors the service for the period defined by Major Incident Manager. He also schedules a short team meeting for the next day.

Incident Review is performed on this meeting, points for improvement and lessons learned are defined and Post Mortem Major Incident Report is created.

Incident Manager sends the report to the customer.

I have prepared for you a template for Major Incident Report, free for download here.

Related posts:

Incident Management Elements
Key elements of Incident management.

Incident Management Mind Map
Download the incident management mind map.

All About Incident Classification

How to deal with incident categories.

What Everyone Should Know About Incident Priority

Incident prioritization in ITIL.

Hope this helps. Have a nice day!