Posted: Thu Mar 06, 2008 12:18 am Post subject: Major Incident - Always High Priority???
Please let me have your views on whether or not a Major Incident must always be a high priority incident.
Lets say that a high priority incident is characterised as such because it is affecting the business continuity.
If this is the case, would a mail server outage be regarded as a Major Incident? With the mail server down, users can still do their daily work such as HR duties, Accounts etc. The mail server is offline but this has not impacted other production servers and so is not necessarily a business critical issue. In such circumstances, I feel that the incident should be logged as a Major Incident as there will undoubtedly be numerous calls relating to the same issue. The question is - should the Major Incident ALWAYS be high priority?
e-mail is one of the main communication systems in a busines these days. If it goes down it does have a big impact on business - granted the world does not stop - but consider just one scenario.
Mail service goes down. Most everybody else can work and do other things. However Billing cannot process invoices to customers as their system auto emails the bills from another system - that would be an issue. No invoices out - no money in. Same with contracts if you you use email to issue them.
You should look at it on a per service point of view - email baing a service to the business. if it is down - major incident and a possible problem record to follow also. _________________ Mark O'Loughlin
ITSM / ITIL Consultant
Joined: Mar 04, 2008 Posts: 1893 Location: Helensburgh
Posted: Thu Mar 06, 2008 2:15 am Post subject:
You mustn't get hung up on words like "major". they mean different things to different people. You should always assign resources to the tasks that will save or gain the organization the most benefit. That is how to determine priorities.
Service Management should have agreed with the business which are the most critical systems (sometimes it depends on the time of day/week/month/year just how critical a service is).
If you want, you can define a Major incident as seriously affecting any of these services. Then it will correlate well with high priority.
I agree with Mark that email is almost certainly a vital service. In some organizations, losing the email service can cost a fortune if it is not recovered very quickly. I would suggest that if you get a large number of calls about a lost service, then it is already beginning to cost your organization.
Thanks. I appreciate your opinions and do agree with you about the email being an important service. I am still not entirely sure that a Major Incident must always be a high priority incident.
I am trying to draw up a Major Incident Process that will be used when numerous users call the Helpdesk about the same issue. In such an instance I envisage a Parent Incident and numerous Child Incidents being created in the call logging system.
Whilst I agree that in the majority of cases the issue will be business critical, will that be the case every time? Email was not the best example as if the mail server is down, it will in most cases affect the business negatively.
Perhaps a better example might be users not being able to access personal webmail. In a large organisation, the Helpdesk might receive many calls from users about not being able to access webmail. Should the Major Incident Process be used in such instances? If it should be used then surely such an issue is not a high priority?
regards webmail - again it depends how critical it is to the business. If you have very senior people travelling and need access to webamail - and the service is expected to be available and it is not - it might well be considered a major incident.
If you have a number of users that cannot access webmail but can access email client by dialing in - maybe its just an incident.
What have you signed up to from an SLA point of view regard importance and the critical nature of the service? If you have no SLA with this defined then you are always wide open to someone demanding it be treated as a major incident all the time. _________________ Mark O'Loughlin
ITSM / ITIL Consultant
Joined: Sep 16, 2006 Posts: 3452 Location: London, UK
Posted: Fri Mar 07, 2008 7:53 pm Post subject:
And to follow up on Mark's comment...
hm... he usually does that to mine
What is defined as the criteria for a major incident in your policy documents for incident management and problem management and service desk _________________ John Hardesty
ITSM Manager's Certificate (Red Badge)
Change Management is POWER & CONTROL. /....evil laughter
Posted: Tue Apr 01, 2008 11:07 am Post subject: Major Incident - Always High Priority???
I agree as well.
SLA is the best way to define the standard best for your organization. You are doing well by exploring different scenarios that will do well for you when you start discussing SLAs. As you are devising your Major Incident process, many different scenarios will help you bullet proof it.
One note, all my ITIL material does refer to a Major Incident as something of significance. From what you describe with a parent/child, those can vary from anything (personal sharepoint is down, and you are tracking one, with multiple child tickets for each individual impacted..but that wouldn't be Major).
Good luck! _________________ -----------------
Bank of America
ITIL Practitioner (blue badge)
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum