Identify and analyze in order to improve your incident management process.

Some standards define incident tracking methodologies. It can be useful to take inspiration from it in order to improve the stability of your IT processes.

The ISO/IEC 27035 standard, for example, makes it possible to provide, internally for each organization, its own incident management process. Other methodologies, such as ITIL, which are perfectly complementary, define an incident as any event not part of the normal operation of a service (or equipment), and which causes or may cause an interruption or alteration of its functionality. quality. Consequently, incident management makes it possible to quickly restore normal operation of the service and minimize their impact on the company. The action must be carried out while ensuring the level of availability and service defined in the service contract (SLA), namely the best possible level. It is important to remember that it is about treating the consequences and not the causes.

 

 

Incident management requires:

• A service level agreement between the supplier and the customer, defining incident priorities, escalation trajectories and response/resolution times.
• Templates that allow these incidents to be resolved effectively.
• A categorization of incident types.
• An agreement on the statuses and priorities in the event of an incident.
• An implementation of a response process in the event of a major incident.
• An agreement on the assignment of incident management roles.

 

 

It is important not to confuse "incident management" with "problem management" because in ITIL terminology incident management is focused on the user level, it serves to restore normal service as quickly as possible, either act "in firefighter mode". In addition, problem management resolves the root cause of incidents with the goal of preventing future incidents from occurring. these two axes complement and come together, for example in an ISO27001 approach and its monitoring of continuous improvement.

 

 

Classification of incidents according to iTiL

Incidents are classified according to:

• Their priority (low, medium and high): Low priority incidents do not interrupt end users, they can usually complete the work despite the incident.
• Medium priority incidents are issues that affect end users, but the disruption is mild or brief.
• High priority incidents affect a large number of end users and prevent a system from functioning properly.

We can see the volume and scale of an incident on a company by measuring the number of users or the number of systems affected by a malfunction. When an incident has a major impact for a large number of users, it is considered a high priority incident.

 

Of their type:

• Hardware (network problem and other system failures).
• Software (application bug or service availability problem).
• Security (Unauthorized domain access or any other threat that compromises and violates data).

It is important to remember that often the performance problem results from a combination of these areas.

IMPORTANT

In view of legal obligations, additional attributes may be necessary. This point is discussed in detail in the Classification section.

 

POTENTIAL RISKS OF MAJOR INCIDENT