© 2016 ServiceNow All Rights ReservedConfidential © 2016 ServiceNow All Rights ReservedConfidential
Applying the Principles of Major Incident Management to IT
Troy DuMoulinVP, Research & DevelopmentPink Elephant
© 2016 ServiceNow All Rights Reserved 2Confidential
Business Impact of IT Incidents
© 2016 ServiceNow All Rights Reserved 3Confidential
Cynefin System Sense Making Model
SimpleThe relationship between cause and effect is obvious to all and can be categorized based on established
procedure
SENSE – CATEGORIZE – RESPONDApply Best Practice
ComplicatedThe relationship between cause and effect
requires analysis or some other form of investigation and/or application of expert
knowledge SENSE – ANALYZE – RESPOND
Apply Good Practices
ComplexThe relationship between cause and effect can
only be perceived in retrospect
PROBE – SENSE –RESPONDDefine Emergent Practices
ChaoticNo relationship between cause and effect at
a systems level
ACT – SENSE – RESPONDAnalyze Lessons Learned
Disorder
David Snowden & Mary Boone “A Leaders Framework For Decision Making” HBR 2007
© 2016 ServiceNow All Rights Reserved 4Confidential
Major Incident Response
Triage
Activate
Assess
Stabilize
Restore
Post-Mortem
© 2016 ServiceNow All Rights Reserved 5Confidential
Triage – Establishing Initial Priority
Triage is the process of determining the priority of patients' treatments based on the severity of their condition. This rations
patient treatment efficiently when resources are insufficient for all to be treated immediately.
© 2016 ServiceNow All Rights Reserved 6Confidential
Priority 1 = Major Incident?
It Depends On Your Priority Model
© 2016 ServiceNow All Rights Reserved 7Confidential
Priority Model Example
Core Business Services
(High)
Support Services
(Medium)
Non-Urgent Services(Low)
Department/LOB/Branch/Group of VIPs
(High)Critical High High
Small Group of Users or VIP
(Medium)Critical High Medium
Single User
(Low) High Medium Low
Impa
ctUrgency
© 2016 ServiceNow All Rights Reserved 8Confidential
Activate the Major Incident Process
Contact And Bring Together Major Incident Team For Briefing And Assignment Of Tasks
© 2016 ServiceNow All Rights Reserved 9Confidential
Potential Stakeholders• Service Desk Owner• Service Owners• Problem Management• Technical Subject Matter Experts• Business Relationship Managers• IT Sr. Leadership
• Business Leadership Points of Contact• Third party suppliers• Information Security• IT Architecture • Corporate Communications• Other?
© 2016 ServiceNow All Rights Reserved 10Confidential
Major Incident Response
Triage
Activate
Assess
Stabilize
Restore
Post-Mortem
© 2016 ServiceNow All Rights Reserved 11Confidential
Post Mortem – RCA OverviewCreate a problem statement
Analyze the data and information
Identify possible causes
Evaluate possible causes
Verify the root cause
Gather data and information
Brainstorming
Affinity Mapping
Ishikawa Diagrams
Five Whys
Kepner-Tregoe Problem Analysis
© 2016 ServiceNow All Rights Reserved 12Confidential
Learn More
Get the recording to this entire webinar here!