Embed Size (px)
Citation preview
Firstsource © 2006 | Restricted 1
Incident Management Process v1.5
Master List Ref.: PR-ITSM-ENT-110 Issue Date: 25/01/2008
Version No.: 1.5 Issued by: VP Technology Approved by: CTO
Firstsource © 2006 | Restricted 2
Index
1. INTRODUCTION............................................................................................32. SCOPE.........................................................................................................33. Objective.....................................................................................................34. ROLES & RESPONSIBILITIES..........................................................................34.1 Customer Responsibilities 3
4.2 Incident Manager 3
4.3 Process Owner 3
4.4 IT Service Desk 3
5. INCIDENT MANAGEMENT PROCESS................................................................36. IT Incidents & Service Requests....................................................................36.1. Process Flow 3
6.2. INCIDENT RECORDING PROCESS 3
6.3. INCIDENT CLASSIFICATION PROCESS 3
6.4. INCIDENT INVESTIGATION & DIAGNOSIS 3
6.5 INCIDENT RESPONSE AND RESOLUTION TIME 3
6.5.1 Production Incidents...........................................................................36.5.2 Non Production Incidents....................................................................3
6.6 INCIDENT CLOSURE 3
6.7 PROCESS FOR P1 INCIDENTS 3
7 SUPPORTING TOOLS.....................................................................................38 CONTACT DETAILS........................................................................................3Annexure A...........................................................................................................3Annexure B...........................................................................................................3
1. INTRODUCTION
Firstsource © 2006 | Restricted 3
Firstsource recognizes the fact that Incident Management is an important aspect for smooth business continuity and accordingly has well defined Support processes in place.
Firstsource has a Centralized Support Desk (CSD) at its 4D Center, Malad, Mumbai, which will be the single point of contact and deliver the Support function for the Process.
All incidents will be reported to Central Support Desk over the phone or using self service tool (http://itsm.firstsource.com/SelfService/).
The Service Support Manager & Support Desk Manager are responsible for managing the IT Operations & Maintenance at the respective centers.
The in-house application Incident Management Software (henceforth referred to as the IMS) will be used to record and monitor incidents.
2. SCOPE
Incident Management handles all detected/reported incidents, including Security Incidents, and all service requests that can be raised through the service desk.
An incident is classified as any event that is not part of the standard operation of a service that causes, or may cause, an interruption to, or a reduction in, the quality of service.
A service request is classified as a request for a change, usually both common and straightforward, to be made to a service. A Service Request is characterised by the fact that the Change can be made under strict, well-defined procedural control and is therefore (virtually) risk free. Providing access to services for a new member of staff and relocating PCs are two typical examples.
3. OBJECTIVE
The object of Incident Management is to restore normal service to operation as quickly as possible with minimum disruption to the business, thus ensuring that the best achievable levels of availability and service are maintained.
Incident Management should be used to ensure the best use of resources to support the business, to develop and maintain meaningful records relating to Incidents, and to devise and apply a consistent approach to all Incidents reported.
Incident Management is responsible for Incident detection and recording, classification of all Incidents, and initial support, investigation and diagnosis, resolution and recovery, incident closure, and incident ownership, monitoring, tracking and communication.
Firstsource © 2006 | Restricted 4
The Customer will be alerted in advance if their service Levels cannot be met and an action agreed
4. ROLES & RESPONSIBILITIES
4.1 Customer Responsibilities
Customers will intimate the support desk of all incidents as soon as the incident starts. Customers will provide all the relevant information to facilitate accurate troubleshooting & resolution.Customer will confirm with the Support Desk once the incident is resolved.The Service Desk will provide a round the clock service and will be the single point of contact for all users, who request resolution of technological issues, computer related problems and technical repair.Service Support Managers are responsible for implementing the Incident Management Process in their respective teams. The Process Owner is responsible for reviewing and monitoring the process for its continued suitability, adequacy and effectiveness.
4.2 Incident Manager
The objective of Incident Manager is to restore normal service to operation as quickly as possible with minimum disruption to the business
The IM will also be responsible for updating the KEDB. The IM will use his/her judgment to identify incidents that can be qualified for entry into KEDB.
All staff involved in Incident Management will have access to relevant information such as KEDB, Problems resolution and CMDB
4.3 Process OwnerProcess owner will be responsible for:
Driving the efficiency and effectiveness of the process; Making recommendations for improvements; Developing and maintaining the process; Producing management information.
4.4 IT Service Desk Centralised Support Desk will be responsible for
All incidents/ service request reported by the users; Driving the incident resolution process with the help of SDM; Communication with the affected parties through the life-cycle of the
incident; Escalations of incidents as per incident escalation matrix; Closure of incidents.
Firstsource © 2006 | Restricted 5
5. INCIDENT MANAGEMENT PROCESS
Security Incidents
The Security Incidents will be handled as per the Incident Management Policy defined under ISMS (PL-ISMS-ENT-004)
Refer Infosec site for additional information on Security Incidents
http://security.firstsource.com/Web-sec-docs/ISMS_TREE_2004/Policies-2006/PL-ISMS-ENT-004.doc
6. IT INCIDENTS & SERVICE REQUESTS
The following Incident Management process will be adopted:
Incident Reporting & Recording Incident Classification Investigation & Diagnosis Resolution & Recovery Incident Closure
6.1. Process Flow
Firstsource © 2006 | Restricted 6
Firstsource © 2006 | Restricted 7
6.2. INCIDENT RECORDING PROCESS
When an incident is reported to the Centralised Support Desk, the following information is captured to facilitate faster resolution.
Full name Process Name Error message (If Any) No. of agents logged No. of agents affected Start time of issue Confirm whether the issue is impacting business or not Location
6.3. INCIDENT CLASSIFICATION PROCESS
Incidents received by the Centralised Support desk are assigned priority levels based on the following:
Incidents related to Operations ( Production)
a. Priority 1 – Critical
In case there is a downtime affecting more than 30% of the entire production floor it is updated as a Critical case.
A Priority 1 fault will have a critical impact to the service infrastructure. There will be critical impact to a large part of the business or an entire service is unavailable. Priority 1 faults will cause critical business impact and/or severe financial impact and will therefore not be constrained by time of day.
These incidents/events will typically affect a large number of business or external customers. These are to be treated with the highest priority. All Critical Cases will be directly assigned to the Incident Manager.
b. Priority 2 – High
In case there is a downtime affecting 10% - 30% of the entire production floor it is updated as a High priority case.
c. Priority 3 – Medium
Firstsource © 2006 | Restricted 8
In case there is a downtime affecting 1% - 10% of the entire production floor it is updated as a High priority case.
d. Priority 4 – Non Production / Service Request
These are the faults, which do not affect production, and there is no impact on the core business of the operations floor.
Incidents related to other User Departments ( Non –Production)The prioritization of all incidents affecting departments other than Operations is as per the Incident Classification List.
All calls are immediately assigned to the respective team irrespective of the priority levels, whereas the escalation process varies for calls with different priority levels.NOTE: The Prioritization will vary from client to client based on their requirements /SLA.
6.4. INCIDENT INVESTIGATION & DIAGNOSIS
Listed below are the activities that should take place during the incident management process with a brief description for each of the activities.
Activity Description
User logs Call with User calls/uses self service tool to contact Support Desk
Firstsource © 2006 | Restricted 9
Activity Description
Support Desk User provides details of Centre, Bay location, Brief description of problem
Support Desk created a Ticket and provides user the Incident Number
Support Desk assigns call to Technology Support Team
Support Desk assigns the Ticket on tool to the Technology Support Team ( Level 1 Tech Team)
Technology Support Engineer attends the call
Support Desk takes periodic updates from Tech Team on the resolution progress
Support Desk updates user on the current status received from Tech Team on the resolution progress
Technology Support Engineer informs Support Desk of call closure or with status of unresolved call
Technology Support Engineer gives the description of resolution for resolved /closed calls
Reasoning for unresolved/open calls Support Desk to follow standard escalation process for
unresolved /open calls Incident Manager provides the Incident Report within 24
hours of completion of Incident (for P1 only) Incident Manager circulates the Incident Report with 24 hours
of completion Incident ( refer Annexure C)
6.5 INCIDENT RESPONSE AND RESOLUTION TIME
The standard technology response and resolution time is given below.
6.5.1 Production Incidents
The following SLA and escalation matrix will be followed for the Production Incidents at Paradigm, except in cases where the client has explicitly specified the need to follow a different process.
SLA for Incident Response and Resolution*
Priority Response time (Mins.) Resolution time (Mins.)Critical – P1 15 45High – P2 30 90Medium – P3 60 120Low – P4 240 2280
Firstsource © 2006 | Restricted 10
Escalation Matrix*
*Updates can be viewed through self-service tool escalation matrix
6.5.2 Non Production Incidents
SLA for Incident Response and Resolution*
Escalation Matrix*
Escalation Points P2 (mins- P3 (Hrs) P4 (Hrs)
Escalation Points
P1 (max mins)*
P2 (max mins)
P3 (max mins)
P4 (max mins)
Senior Engineer Immediate Immediate 30 120Incident Manager Immediate 30 60 240SSMs 15 60 90 360VP 30 90 120 N.ACTO 60 120 N.A N.A
Priority Response time (in mins – maximum)
Provide progress update every (in hrs)*
Resolution time (in Hrs)
Critical 15 ½ 1High 15 1 2Medium 60 4 12Low 120 24 72
Firstsource © 2006 | Restricted 11
max)Senior Engineer 30 2 12Incident Manager 60 6 24Regional Manager 90 8 48VP 240 NA NACTO 480 NA NA
*Updates can be viewed through self-service tool escalation matrix
6.6 INCIDENT CLOSURE
The technology team will intimate the Centralised Support Desk once the incident is resolved with the resolution. The support desk will take confirmation from the user on the resolution and then close the case. The incident Manager to fill the corrective action taken and decide on 11pdation on KEDB
6.7 PROCESS FOR P1 INCIDENTS
Any incident, which has a downtime affecting more than 30% of production, is classified as P1 incident.
All major incidents have a maximum response time of 15 minutes and a maximum resolution time of 45 minutes (provided its Firstsource dependency).
Exceptions are if clients don’t want us to resolve the incident if there is a resilience device running on SPOF (Single Point of Failure)
The Centralized Support Desk (CSD) will forward the case to the respective technical team within 180 seconds of recording the incident.
The Centralized Support Desk (CSD) should follow up with the tech team every 15 minutes and update the user on the resolution progress till the incident is resolved
The Centralized Support Desk (CSD) will intimate on the incident status to all the parties in the escalation chart provided as per the timelines mentioned in escalation chart.
7 SUPPORTING TOOLS
The Centralised Support Desk uses IMS to record, forward and track incidents.
Firstsource © 2006 | Restricted 12
Users are given access to the self service tool by which they can log an issue onto the IMS and also follow up on the progress.
To go to the self service tool, you can type the following web address on your browser:
http://itsm.firstsource.com/SelfService/
It will take you to the login page where you need to fill in the login details and go ahead and log an issue.
A snapshot of the self-service tool is provided for reference.
8 CONTACT DETAILS
Centralised Support desk (CSD)
IPLC Extension #: 77777UK Number: +44 207 072 2550 US Number: +1 201 520 3157INDIA Number: +91 22 66983677US Number toll free: +1 201 520 3157Email: [email protected] Service tool http://itsm.firstsource.com/SelfService/
Firstsource © 2006 | Restricted 13
ANNEXURE A
Classification: Firstsource RestrictedInformation Owner (IO): ITSMFInformation Custodian (IC): VP TechnologyAuthorization List (AL): Technology Department EmployeesDeclassify on: Never
Firstsource © 2006 | Restricted 14
ANNEXURE B
Version Number Changes madeV 1.0 to V1.1 Under 1.
Customer Leverage Software. Changed to Incident Management Software (henceforth referred to as the IMS). Under 3.2.Removed the line All Security Incidents will be registered with the CSD through calls. Self-service tool does not provide the option of registering security incidents
Under 5.2.Changed Full name & Designation of the caller to Full name, Designation & Email address of the caller
Under 5.4.Team Leader changed to User in 2 places in the figure and in 3 places in the TableUnder 5.5.1.Removed the line * Status update for p1 tickets at all stages (open, escalated, closed, breached calls) will be provided through SMS.
Under 5.7.Changed 120 seconds to 180 seconds
Under 6Changed Customer Leverage application to IMS in 2 places
Ver 1.1 to 1.2 Below Changes made on 2nd Oct 2006:Removed the LTSB referencesAdded the version number in the Annexure BChanged the “Help Desk” to “Service Desk” in all the references.
Ver 1.2 to 1.3 Template Changed to reflect organization name changeChanged tag to “monitor” on page 3 Typo error SPOC on page 15Process Flow chart updated
Changed “An incident resulting in the complete outage of a service. To “ ( Any incident impacting more than 30% of Production Users)
Ver 1.3 to 1.4 Escalation Matrix – Escalation Points heading added with ‘max’6.5.2 – Priority heading added with ‘max’
Firstsource © 2006 | Restricted 15
Ver 1.4 to 1.5 Modified the self service URL to the following current location http://itsm.firstsource.com/SelfService/ Modified the definition of the Incident Manager in 4.2 for better clarity based on the Internal Audit observationFixed the spelling mistake of word “updated” in the service classification paragraphModified the Security incident URL reference to the latest address http://security.firstsource.com/Web-sec-docs/ISMS_TREE_2004/Policies-2006/PL-ISMS-ENT-004.doc The US toll free number has been changed to +1 201 520 3157The SLA & Escalation matrix update comment has been added
