Incident response

Step by step

1. Identify the service Incident Coordinator

   The Incident Coordinator confirms the affected service and, where known, the asset. The Service Owner checks which public component represents the effect customers see.

   • Establishes the affected service and visible component.
   • Updates Services, Public components, Assets

2. Open the incident Incident Coordinator

   Record a summary, priority, opening time and assignee. Open gives the team a working record for the interruption.

   • Creates the assigned interruption with priority.
   • Updates Incidents

3. Acknowledge the work Incident Coordinator

   The assigned person accepts the investigation and records acknowledgment time. The incident moves to Acknowledged.

   • Records acceptance and acknowledgment time.
   • Updates Incidents

4. Investigate Incident Coordinator

   Add a linked, attributed incident update when new facts matter. Move the incident to Investigating and keep the next unresolved question visible.

   • Adds time and author to new findings.
   • Updates Incidents, Incident updates

5. Resolve and close Incident Coordinator

   Record the resolution time after checking service behavior. Mark Resolved, then Close after the owner has checked the outcome and component status.

   • Records recovery and reviews visible status.
   • Updates Incidents, Public components

Incident Coordinator

, Service Owner, Communications Reviewer.