Declare
From an open incident: declaration criteria, crisis manager, video-conference link and affected items.
Modules · Major incidents
Coordinate the crisis, regain control.
Major incident management organises the response to an incident whose impact calls for crisis coordination: one person in charge, a shared crisis room and stakeholders kept informed.
Benefits
- One person in chargeThe crisis manager steers the phases and can hand over; every reassignment is traced.
- A crisis shared in real timeThe crisis room brings diagnoses, decisions and events together in a feed everyone sees live.
- Stakeholders kept informedInternal and customer messages, sent by hand or at each change of phase, with their history.
- A crisis that feeds improvementClosure requires a blameless review and a link to a problem or an emergency change.
How it works
Coordinate
The crisis room records diagnoses, decisions, communications and escalations.
Stabilise and restore
The phases follow one another: declared, coordination, containment, resolved.
Learn
Post-incident review, emergency change and major problem to correct the cause.
Related modules
- Service Desk A major incident is declared from an open ticket: the title and affected items are carried over, and the ticket shows every agent that a crisis is in progress.
- Change management The crisis manager creates the emergency change from the war room, already filled in; the change keeps track of the crisis.
- Problem management The post-incident review opens the major problem, with the cause already written up; a crisis cannot be closed without a review, nor without a linked problem if the cause has not been fixed.
- Release management A failed deployment is escalated to a major incident in one click, with the release, instance and cause already filled in.
- CMDB Affected items are carried over from the ticket and completed by searching the repository; the crisis overview can be filtered by item.
- Event management: monitoring alerts When many items go down at once, the alert console suggests a major incident and shows the incidents most affected.
Functional scope
- Declaration criteriaWide impact, critical service compromised, urgency with no workaround, financial, regulatory or reputational exposure, coordination between teams.
- ITIL phasesDeclared, coordination, containment, resolved, closed, with a way back in case of insufficient containment or relapse.
- Crisis managerA single lead at a time; handover and takeover are traced in the history.
- Crisis roomReal-time feed, filters by type of entry, link to join the video conference or phone bridge.
- CommunicationsInternal and customer audiences, standard messages, automatic notification at each change of phase.
- Post-incident reviewRoot cause and improvement actions, pre-filled from the crisis feed; closure depends on it.
- Management reportingCrisis radar, Kanban board by phase, average resolution time and rate of reviews completed.
- Affected itemsIdentified in the CMDB, taken from the original ticket.
Integrations
- Service Desk, the source of the declaration
- Change and problem management, for the chaining
- CMDB repository, for the affected items
- E-mail notifications, with editable templates
Prerequisites
- The crisis managers, to be designated
- A video-conference tool or phone bridge, whose address is entered at declaration
The essentials of this page in PDF, to keep or pass on.
Download the sheetWant to see this module on your own processes?
We will build the demonstration around your operational reality.