Incident Management Life Cycle 

• Incident:-Incident is  An unplanned interruption to an IT service or reduction in the quality of an IT service. Failure of a configuration item that has not yet affected service is also an incident. for example, A computer or personal device won’t start up.

            

            

Step 1—Incident Identification 

The initial step for any incident management lifecycle is identification. 

This starts with an end-user, IT specialist, or automated monitoring system reporting an interruption. The alert can come via in-person notification, automated system notice, email, SMS, or phone call.

Step 2—Incident Logging 

After the team has been notified about the incident, it’s crucial that they record and document it. 

Thorough reporting helps your organization notice incident trends that may morph into more significant problems. It also gives your team better visibility over their workflow, allowing them to delegate resources where they’re needed most.   

Every incident must be reported – big and small – and logged as a ticket. Tickets need to contain the following information:

• User name 
• User contact information
• Date and time of the report
• Description of the incident

When it comes to incident logging, the more details you can include, the better. 

Step 3—Incident Categorization 

Incident categorization requires the service team to assign a category and at least one sub-category to any incident. 

This is done for three critical reasons:

1. It helps the service desk sort and model incidents according to their categories and subcategories.
2. It makes it possible to automatically prioritize some of the issues. 
3. Provides accurate incident tracking.

By assigning appropriate categories, it becomes easier for the help desk to assign, escalate, and then monitor incident trends and frequencies. When done correctly, it streamlines incident logging, prevents redundancy, and quickens the entire resolution process. 

Categorization utilizes a hierarchical structure with multiple levels of classification—usually with three to four levels of granularity. But since all organizations are unique, classification must be conducted internally, especially at lower levels.

Step 4—Incident Prioritization

After incidents have been assigned their proper category, the next important task is to prioritize them according to urgency and impact on the users and the business. Urgency is how quickly a resolution needs to happen, whereas impact is the potential damage an incident could cause.  

Incidents are typically designated one of three priority statuses: 

1. Low-priority incidents – Do not interrupt users or the business and can generally be worked around. Service to customers and users continues. 
2. Medium-priority incidents – Impact some employees and can moderately disrupt work. Customers may be slightly inconvenienced by the incident. 
3. High-priority incidents – Affect a significant number of users or customers, interrupt the business, and have a noticeable impact on service delivery. Such incidents will almost always cause a financial toll. 

Since your help desk’s resources and time is limited, the higher the assigned priority, the quicker the team must respond to the incident. The system ensures that IT teams aren’t focusing on low-level incidents while much larger ones are wreaking havoc on your employees or customers. 

Step 5—Incident Response  

After an incident has been identified, logged, categorized, and prioritized, the service desk can get to work on a resolution. Incident resolution has sub-steps to follow, including:

• Initial diagnosis – User details the problem and undergoes troubleshooting with the service agent.
• Incident escalation – If the incident requires advanced support, it can be forwarded to certified support staff or on-site technicians. Most incidents should be able to be resolved by the initial service agent. 
• Investigation and diagnosis – Once the initial incident hypothesis is confirmed, staff can then apply a solution or workaround.  
• Resolution and recovery – The service desk confirms that the user’s service has been restored to agreed upon SLA level.
• Incident closure – The incident is closed and no further work is required.