Incident management USUP
Coordinating responses to incident reports, minimising negative impacts and restoring service as quickly as possible.
Updates for SFIA 9
- There is an updated version of this skill for SFIA 9.
- Theme(s) influencing the updates for this skill: Making SFIA easier to consume (enhance readability/guidance/descriptions), Support for cyber security working practices (both specialised and general), Making SFIA easier to consume (updates to skill name/skill description), Making SFIA easier to consume (new levels).
- New levels have been added at levels 1 and 6.
- Content changes have been made to levels 2, 3, 4, and 5.
- You can move to SFIA 9 when you are ready - SFIA 8 skill descriptions will still be available to use.
- Previous SFIA assessments or skills mapping may be impacted by this change.
Guidance notes
Activities may include — but are not limited to:
- designing and implementing different processes and procedures for different categories of incidents including — but not limited to — major incidents, information or cybersecurity incidents, complex incidents, low impact incidents
- establishing incident response teams or security incident response teams
- routing requests for help to appropriate functions for resolution
- monitoring resolution activity
- informing users, customers and key stakeholders of progress towards service restoration.
Incidents can impact many areas — such as but not limited to — business operations, information security, IT systems, services, employees, customers, or other vital business functions.
Different roles/groups may be needed to diagnose and resolve incidents — such as — users, subject matter experts, service desk, support teams, suppliers, partners. Although they play a part in the incident management process, they do not necessarily need incident management skills.
Understanding the responsibility levels of this skill
Where lower levels are not defined...
- Specific tasks and responsibilities are not defined because the skill requires a higher level of autonomy, influence, and complexity in decision-making than is typically expected at these levels. You can use the essence statements to understand the generic responsibilities associated with these levels.
Where higher levels are not defined...
- Responsibilities and accountabilities are not defined because these higher levels involve strategic leadership and broader organisational influence that goes beyond the scope of this specific skill. See the essence statements.
Developing skills and demonstrating responsibilities related to this skill
The defined levels show the incremental progression in skills and responsibilities.
Where lower levels are not defined...
You can develop your knowledge and support others who do have responsibility in this area by:
- Learning key concepts and principles related to this skill and its impact on your role
- Performing related skills (see the related SFIA skills)
- Supporting others who are performing higher level tasks and activities
Where higher levels are not defined...
- You can progress by developing related skills which are better suited to higher levels of organisational leadership.
Click to learn why SFIA skills are not defined at all 7 levels.
Show/hide extra descriptions and levels.
Level 1
Incident management: Level 2
Follows agreed procedures to identify, register and categorise incidents.
Gathers information to enable incident resolution and allocates incidents as appropriate.
Incident management: Level 3
Provides first line investigation and gathers information to enable incident resolution and allocate incidents.
Advises relevant persons of actions taken.
Incident management: Level 4
Ensures that incidents are handled according to agreed procedures.
Prioritises and diagnoses incidents. Investigates causes of incidents and seeks resolution. Escalates unresolved incidents.
Facilitates recovery, following resolution of incidents. Documents and closes resolved incidents.
Contributes to testing and improving incident management procedures.
Incident management: Level 5
Develops, maintains and tests incident management procedures in agreement with service owners.
Investigates escalated, non-routine and high-impact incidents to responsible service owners and seeks resolution.
Facilitates recovery, following resolution of incidents. Ensures that resolved incidents are properly documented and closed.
Analyses causes of incidents, and informs service owners to minimise probability of recurrence, and contributes to service improvement. Analyses metrics and reports on the performance of the incident management process.