Incident management USUP

(unchanged)

Coordinating responses to incident reports, minimising negative impacts and restoring service as quickly as possible.

SFIA 9 is in development

SFIA 9 beta due in early July 2024
SFIA 9 planned for publication October 2024

This is a prototype for SFIA 9. It is subject to change before publication.

Guidance notes

(modified)

Activities may include, but are not limited to:

designing and implementing different processes and procedures for different categories of incidents including, but not limited to, major incidents, information or cybersecurity incidents, complex incidents, low impact incidents
establishing incident response teams or security incident response teams
routing requests for help to appropriate functions for resolution
monitoring resolution activity
informing users, customers and key stakeholders of progress towards service restoration.

Incidents can impact many areas, such as but not limited to, business operations, information security, IT systems, services, employees, customers, or other vital business functions.

Different roles/groups may be needed to diagnose and resolve incidents, such as, users, subject matter experts, service desk, support teams, suppliers, partners. Although they play a part in the incident management process, they do not necessarily need incident management skills.

Understanding the responsibility levels of this skill

Where lower levels are not defined...

Specific tasks and responsibilities are not defined because the skill requires a higher level of autonomy, influence, and complexity in decision-making than is typically expected at these levels. You can use the essence statements to understand the generic responsibilities associated with these levels.

Where higher levels are not defined...

Responsibilities and accountabilities are not defined because these higher levels involve strategic leadership and broader organisational influence that goes beyond the scope of this specific skill. See the essence statements.

Developing skills and demonstrating responsibilities related to this skill

The defined levels show the incremental progression in skills and reponsibilities.

Where lower levels are not defined...

You can develop your knowledge and support others who do have responsibility in this area by:

Learning key concepts and principles related to this skill and its impact on your role
Performing related skills (see the related SFIA skills)
Supporting others with tasks (generic examples are provided by the essence statements for each level)

Where higher levels are not defined...

You can progress by developing related skills which are better suited to higher levels of organisational leadership.

Levels

Defined at these levels:

Click to learn why SFIA skills are not defined at all 7 levels.

Show/hide extra descriptions and levels.

Incident management: Level 1

Level 1 - Follow: Essence of the level: Performs routine tasks under close supervision, follows instructions, and requires guidance to complete their work. Learns and applies basic skills and knowledge.

(new)

Follows agreed procedures to identify, register and categorise incidents.

Gathers information to enable incident resolution and allocates incidents as appropriate.

Incident management: Level 2

Level 2 - Assist: Essence of the level: Provides assistance to others, works under routine supervision, and uses their discretion to address routine problems. Actively learns through training and on-the-job experiences.

(modified)

Provides first line investigation and gathers information to enable incident resolution and allocate incidents.

Advises relevant people of actions taken.

Incident management: Level 3

Level 3 - Apply: Essence of the level: Performs varied tasks, sometimes complex and non-routine, using standard methods and procedures. Works under general direction, exercises discretion, and manages own work within deadlines. Proactively enhances skills and impact in the workplace.

(modified)

Prioritises and diagnoses incidents. Investigates causes of incidents and seeks resolution.

Escalates unresolved incidents.

Facilitates recovery, following resolution of incidents. Documents, communicates outcomes and closes resolved incidents.

Incident management: Level 4

Level 4 - Enable: Essence of the level: Performs diverse complex activities, supports and supervises others, works autonomously under general direction, and contributes expertise to deliver team objectives.

(modified)

Monitors incident queues. Ensures that incidents are handled according to agreed procedures.

Contributes to developing, testing, and improving incident management procedures.

Ensures that resolved incidents are properly documented and closed.

Supports team members in the correct use of the incident process.

Incident management: Level 5

Level 5 - Ensure, advise: Essence of the level: Provides authoritative guidance in their field and works under broad direction. Accountable for achieving workgroup objectives and managing work from analysis to execution and evaluation.

(modified)

Responsible for the operation of the incident management process.

Leads incident communications, ensuring al parties are aware of incidents and their role in the process.

Leads the review of major incidents and informs service owners of outcomes. Ensures incident resolution within service targets. Analyses metrics and reports on the performance of the incident management process.

Develops, maintains and tests incident management policy and procedures.

Level 6

Level 6 - Initiate, influence: Essence of the level: Has significant organisational influence, makes high-level decisions, shapes policies, demonstrates leadership, fosters organizational collaboration, and accepts accountability in key areas.

Level 7

Level 7 - Set strategy, inspire, mobilise: Essence of the level: Operates at the highest organisational level, determines overall organisational vision and strategy, and assumes accountability for overall success.