Incident response

Step by step

1. Capture the incident Incident Responder

   Incident Responder records a summary, priority, opened time and service. When an asset is implicated, the responder links it too. The working record identifies who is assigned to investigate.

   • Identifies impact and owner
   • Updates Incidents, Services, Assets

2. Acknowledge the issue Incident Responder

   The incident workflow applies the acknowledgement transition and creates the first response event. The team can distinguish when the issue was opened from when it was acknowledged.

   • Records acknowledgement evidence
   • Updates Incidents, Response events

3. Assess impact Incident Responder

   Incident Responder reviews the service and asset context. An impact assessment can record the severity, mitigation procedure and owner. If service is unavailable, the outage record tracks the start and restoration times.

   • Describes scope and mitigation
   • Updates Service impact assessments, Service outages, Incidents

4. Investigate Incident Responder

   Starting investigation moves the incident to Investigating and appends an attributed update. Each update should say what was learned or done so the next person can continue the work.

   • Adds attributed investigation history
   • Updates Incidents, Incident updates

5. Record the outcome Incident Responder

   Incident Responder records the resolution time and current status. A later Closed state signals the operational record has finished its response path.

   • Captures resolution and response state
   • Updates Incidents, Response events

Incident Responder

, Service Desk Manager, Admin.