Incident Management

Predecessors/Before You Begin

ITIL makes a big distinction in vocabulary between an incident and a problem. Please keep in mind these two are different: a problem is the unknown, underlying cause of one or more incidents.

Incident Management

Incident management is arguably the most important of any ITIL process. Service Strategy, Change Management, and the other processes are all needed, but incident management is the one process that (in my opinion) IT cannot live without. Incident management is the tracking of incidents, which are breaches or potential breaches to service level agreements. In plain English, incident management is about tracking stuff that is currently broken. Without incident management, IT has no way to ensure that users' services get restored when they break.

Virtually all IT organizations have some sort of ticket-tracking system, to keep track of contacts and to help IT staff hand off issues. Virtually all IT organizations also have some form of Service Desk as well, that receives calls, records them, and resolves incidents or escalates them.

Incident management tools ideally track service level targets--for example, when a user is having difficulty checking their e-mail, then the time it takes IT to restore service is tracked against the e-mail service level agreement.

ITIL recommends creating "incident models" for typical issues. For example, at Wake Forest University, our Service Desk often receives laptops that need to be repaired. ITIL recommends creating an incident model to describe the particular process of repairing a laptop.

ITIL also calls out "major incidents" as a particular form of important incident that may require a Major Incident team to resolve. Major incidents are different than problems--major incidents are still trying to get users up and running as quickly as possible (where a problem would be trying to find the underlying cause). Major incidents in an organization could be kicked off by a system-generated page, or whenever a certain number of users might be affected.

University-specific risks

Incident management tools allow you to track a lot of information about your users. It can be difficult to map users' department information (e.g. a professor may be teaching in two different departments) and status information (e.g. a student may also be a staff member).

Also, ITIL calls out the option for tracking "VIPs" and handling them separately--if your University marks certain people as VIPs, e.g. the Chancellor, consider this a policy decision. Publicize the policy internally and externally so IT staff understand the purpose of VIP status and so users do not think there is secret favoritism going on within IT.

Find the user groups for your incident management tool and ask your salesperson to put you in touch with other higher education institutions that use that tool.

Videos, Photos, and Presentations