By ITIL® from Experience ©
Lets take the following situation as example:
Network access was disrupted temporarily and the service automatically restored itself as soon as the fail over came on line. As a result, the interruption or outage can be measured in seconds however, users must logout and log back in to restore their network based services.
In this situation some people would argue that a Major Incident is not required since the service was restored and therefore the incident1 has been resolved. For sure an incident can be logged to record the event, but it’s hardly a Major Incident2 since it has come and gone. After all if a tree fell in the forest and no one there was there to hear it fall, did it make a sound? In this situation, a Major Incident should be opened if there was a high impact to the business or if it was significantly disrupted. If there was no impact to the business, like when netwrok traffic was automatically redirected to another switch, than a Major Incident is not required and a simple incident can be opened.
The reasons why a Major Incident should still be opened even if it has been resolved are:
- That the Service Desk may still be receiving a large volume of calls. For example, people may not know that they must logout and back in to restore their network services and the ITSM Tool's functionality related to Major Incidents enables the Service Desk to quickly log repetitive incidents
- To initiate the Major Incident communication protocol or procedure (since the CIO is likely to hear about it, it’s better that he/she hears it officially from operations)
- For visibility and reporting. This is especially important if the organization does not have a good Availability Management process
- To initiate the Problem Management process if the organization has a policy to do a root cause analysis for every major incident (see How to first introduce Problem Management)
- To document the event and its resolution to help resolve similar incidents in the future and to provide data for problem management trend analysis
Declaring and logging a Major Incident after the fact even if the SLA clock is stopped initiates the Major Incident procedures and enables the organization to realize the process’ benefits.
- Who closes the Major Incident
- Should a Problem be opened for every Major Incident
- Should incidents be closed or kept open for monitoring
- How to first introduce Problem Management
From Around the Web:
Copyright 2013-2016 - ITIL® from Experience - D.Matte