Incident response

An incident records a summary, priority, opening time, state, affected service, affected asset and assigned person. The Incident Coordinator uses those links to put the response in the right context before the work begins. An asset with a known location can lead the responder to its rack position; a cable connection can later show patch work associated with the incident. The links are part of the operating record, so they should be checked at intake rather than filled from memory after resolution.

The coordinator sets a priority when one has not been recorded and identifies the technician who will respond. The actual acknowledgment time matters: it tells the next shift when someone accepted the work. As investigation continues, dated updates record what happened and who wrote the account. Resolution and closure should follow the operational outcome shown in the incident, rather than the mere presence of an update.

The Incident Coordinator triages, assigns and records the actual acknowledgment time; the Service Technician records what changed.

• Triage in context. Service, asset and priority sit with the incident summary.
• Named response. The assigned person and acknowledgment time show who accepted work.
• Dated account. Updates link back to the incident and identify their author.

Agree who may set priority and assign an incident, including what to do when a report arrives outside the usual shift. Decide when an incident can be marked resolved and who closes it after checking the outcome. Prepare a short update format that distinguishes observation, action and next step without turning the field into an unstructured chat. Rehearse an incident that arrives without priority and one that has already moved beyond open.

A service disruption arrives for a tagged asset. The coordinator records the summary, links the service and asset, sets critical priority and assigns a technician. The coordinator records the actual acknowledgment time during triage; the technician writes an update after checking the equipment. If a cable is replaced, that patch record is linked to the same incident. The coordinator can read the incident, update and cable evidence together before deciding whether the issue is resolved.

Repeat the triage with an incident already under investigation. It should retain its existing state and assignment unless an authorized person deliberately changes them.

• Open incidents — Current work by priority, assigned person, affected service and asset.
• My incidents — The assigned technician’s own response queue.
• Incident updates — Dated notes and authors linked to each incident.

Follow an incident and review problem follow-up.