Processes and Operational Capabilities
Designing Incident Management Processes
The operational process of managing incidents
Without a documented process, each incident is handled in an improvised way and the result depends on who's on duty that day. A well-designed incident management process covers, at a minimum, detecting and recording the event, classifying it by severity, containment to limit the damage, eradicating the root cause, recovering the affected systems and a formal closure with lessons learned. Each phase must have clear entry and exit criteria, and defined owners, to keep an incident from getting "stuck" with no owner. This process isn't written once: it's adjusted after each real incident, incorporating what worked and what caused delays or confusion, until it becomes a proven, reliable procedure.