Incidents

An incident records the interruption against a service and an asset. The incident coordinator writes a short summary, selects the priority and assigns a person to investigate. Opening time begins the chronology. An acknowledgment time marks when the team accepted the work; it is distinct from the later resolution time. The status moves from Open through Acknowledged and Investigating to Resolved and Closed as the team actually handles the issue.

A public component can be changed to match the visible effect, but the incident remains the working record. The coordinator can show the assigned person the affected service and asset rather than relying on a public message. If the interruption is broader than the first report suggested, the coordinator revisits priority and customer wording with the service owner.

• Intake. Record the service, asset, priority, assignee and opening time.
• Chronology. Add attributed incident updates with occurrence times and investigation detail.
• Recovery. Record resolution time before closing the incident.

Agree who can open and assign incidents, how priority is chosen, and when an acknowledgment should be recorded. The team should know who has authority to move an incident to Resolved and who checks the service before it is Closed. Define the distinction between an internal incident update and a message intended for the public. The linked update history supports the working team; the public message has a separate audience and approval reference.

Set a practical handoff when the assigned person changes. A new investigator needs the current symptom, affected service, asset and latest update. A status value alone does not explain the unresolved question. The coordinator should keep the incident summary and updates readable enough that another person can continue the work without reconstructing a private chat.

A customer portal stops accepting sign-ins. The coordinator opens an incident on the portal service, links the relevant asset, marks the priority Critical and assigns the person on duty. That person acknowledges the issue, records the time and adds an incident update describing the observed failure. As the investigation continues, the status becomes Investigating. The service owner checks the linked component status so customers see the affected area.

After a fix, the investigator checks the service and records the resolution time. The coordinator marks the incident Resolved, reviews the public message with the communications reviewer and closes it only after the outcome is clear. The opening, acknowledgment and resolution dates can later answer how long the work took without treating an internal note as a customer update.

• Open incidents — Review active interruptions by priority, service and assignee.
• Active services — Confirm the owner of the affected service.
• Incident history — Read attributed updates in time order.

Use incident response for the operational sequence and public status cycle for external wording. Review the data model before importing service and asset links.