Without limiting the rights under copyright, no part of this document may be

reproduced, stored in or introduced into a retrieval system, or transmitted in any form

or by any means (electronic, mechanical, photocopying, recording, or otherwise) or
for any purpose, without the express written permission of Synergycentric Sdn Bhd.
Synergycentric may have patents, patents applications, trademarks, copyrights, or
other intellectual property rights covering subect matter in this document. !xcept as
expressly provided in any written license agreement Synergycentric, the furnishing of
this document does not give you any license to these patents, trademarks,
copyrights, or other intellectual property.
Standard Operating Procedure:
Incident Management
Prepared for: Synergycentric Sdn. Bhd.
Prepared by: Tradewinds Malaysia IT Outsourcing Project
Transition Team
ate: !
ST
October "#!$
%ersion: !
Standard Operating
Procedure (SOP)
TRADEWINDS Incident
Management
Incident Management Release 1 1
st
October 2014
Release and Reision Record
"he following information is being used to control and track modi#cations made to
the document.
Revision Date Section(
s)
Versio
n
Page
Number(
s)
Summary of Changes(s)
$
st
%ctober &'$( )ll $ $* +nitial ,raft
& Synergycentric Sdn Bhd' (ersion ! Page " of !)
Incident Management Release 1 1
st
October 2014
Document !ontrol
Author )bdul -a#. )ri/n
File Name &(01*&2*3.doc
Created Wednesday, $
st
%ctober &'$(
ast !dited Wednesday, $
st
%ctober &'$(
D"S#R"$%#"&N
$. Synergycentric Sdn. Bhd.
#RAD!'"NDS "# &%#S&%RC"N( PR&)!C# #RANS"#"&N #!A*
)bdul -a#. )ri/n
Service )ssurance Specialist
4ee Boon 5hong
Service ,elivery 6anager
PR!PAR!D $+ R!V"!'!D $+
S+N!R(+C!N#R"C SDN, $-D,
4ee Boon 5hong
Service ,elivery 6anager
ACC!P#!D $+
& Synergycentric Sdn Bhd' (ersion ! Page * of !)
Incident Management Release 1 1
st
October 2014
TA"#E O$ !ONTENT
., "N#!N#"&N &F #-! S&P,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,/
.,. "ntention of the S&P,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,/
0, Princi1les,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,/
0,. Princi1les,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,/
2, Res1onsibilities,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,/
2,. Res1onsibilities,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,/
3, Re4uirements,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,5
3,. Re4uirements,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,5
6, Procedure,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,7
6,. Procedure,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,7
8, References,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,.8
8,. References,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,.8
/, &ther S&P9 document9 la:s and rules to consider,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,.8
/,. &ther S&P9 document9 la:s and rules to consider,,,,,,,,,,,,,,,,,,,,,,,,.8
5, ;ey %sers,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,.8
5,. ;ey %sers,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,.8
7, #raining < "m1lementation Plan,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,./
7,. #raining < "m1lementation Plan,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,./
.=, A11endices,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,./
.=,. A11endi> . ? Service evel Agreement,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,./
& Synergycentric Sdn Bhd' (ersion ! Page $ of !)
Incident Management Release 1 1
st
October 2014
#IST O$ TA"#E
7% ")B4! %8 8+9:;!S !7";+!S 8%:7,.
#IST O$ $I%&RE
Figure .? "ncident *anagement Process Flo:,,,,,,,,,,,,,,,,,,,,,,,7
., ., "ntention of the S&P "ntention of the S&P
.,."ntention of the S&P
& Synergycentric Sdn Bhd' (ersion ! Page + of !)
Incident Management Release 1 1
st
October 2014
"he intention of this S%< is to describe +ncident 6anagement process.
0, 0, Princi1les Princi1les
0,.Princi1les
"he goal of the +ncident 6anagement process is to restore a normal service
operation as =uickly as possible > with permanent solutions or temporary
workarounds ? in order to minimi.e the impact on business operations. "his is
to ensure that the best possible levels of service =uality and availability are
maintained. )ll incidents should be solved within the pre>de#ned Service
4evel )greement (S4)) to maintain service =uality.
2, 2, Res1onsibilities Res1onsibilities
2,.Res1onsibilities
!nd %sers
;aise incident with "radewinds +" ,epartment when an issue being
encountered
%btain an incident log reference or ticket number for ease of future
reference
Synergycentric -el1des@ (First evel)
<rovides a single contact point for "radewinds +" for escalation
@erify end users support entitlement
4og, track, and close issues raised by end users
<rovide initial support and assign priority
5on#rm with end users on resolution
!scalation of incident to the +ncident 6anagement team
& Synergycentric Sdn Bhd' (ersion ! Page , of !)
Incident Management Release 1 1
st
October 2014
<rovide regular and time performance report (weekly, and monthly)
Princi1al Su11ort (Second evel)
<erform second troubleshooting on incident and veri#ed with end>user
on the resolution
"o validate the types of incident and escalate to the respective support
group or vendor if failed to resolve the incident at the second level
Su11ort !ngineer (including Des@to1 Su11ort)
"he role of Support !ngineer is to resolve all the incident
4og in an incident ticket if re=uired in the event that there is issue with
the +" infrastructure that aAected the services
8ul#ll the delivery re=uest
"ncident *anagement #eam
!scalation of incident to the +" %peration "eam
%wn and track the progress of the incident until resolved
!scalation to third party vendor or principle support ? if re=uired
+nitiate <roblem 6anagement ? if re=uired
3, 3, Re4uirements Re4uirements
3,.Re4uirements
Service ,esk software, which if available. +f not, at least -elpdesk software.
7oteB 5urrently Synergycentric is using :lysses 5;6Cs +ntegrated Service
6onitoring
& Synergycentric Sdn Bhd' (ersion ! Page ) of !)
Incident Management Release 1 1
st
October 2014
6, 6, Procedure Procedure
"his chapter would describe in detailed what are the processes re=uired and
how they are being used in +ncident 6anagement to manage the incidents
logged.
6,.Procedure
Figure .? "ncident *anagement Process Flo:
& Synergycentric Sdn Bhd' (ersion ! Page - of !)
Incident Management Release 1 1
st
October 2014
., Raise "ncident
"radewinds +" or end user contacts Service ,esk ? via phone D email
> to raise an incident
Note? besides end users, +" %perations team may also raise
incident for the issues that they encountered during operation, e.g.
when server team observed one of the hard disk is defunct during
daily morning health check.
0, !scalate to 0
nd
evel Su11ort
+" %peration "eam or end user contacts helpdesk to raise an
incident and will be escalated to Synergycentric
2, Create #ic@et
9ather information ? based on input re=uirement of the -elpdesk
software > from the end user in order to create a ticket.
)ssign appropriate classi#cation to the ticket based on categori.ation
and problem type.
)ssign appropriate priority to the ticket based on the Service 4evel
)greement (S4)).
3, #roubleshooting
"roubleshooting activity will be done to resolve the issue.
& Synergycentric Sdn Bhd' (ersion ! Page . of !)
Incident Management Release 1 1
st
October 2014
6ay involve multiple groups to investigate the root cause and identify
an action plan
6ay involve many steps in order to get the incident closed within the
S4).
6, "ncident ResolvedA
+f the incident can be resolved, con#rm the resolution with the end
user to see whether the incident can be closed or not
+f the incident could not be resolved, escalate the incident to
Service ,esk (second level) team for further troubleshooting.
8, Princi1al !scalation
+f 3rd party support is re=uired, proceed by escalating to respective
vendorDprinciple.
:pdate the incident ticket with information on what actions have
been taken so far in providing onsite troubleshooting for that
particular incident.
/, ConBrm Resolution :ith %ser
Service ,esk software sends an email to the end user re=uesting
the user to acknowledge the email if the incident is con#rmed
resolved and can be closed
"he con#rmation can also be obtained from the end user over the
phone by the Service ,esk and update in the Service ,esk software
5, Close "ncident
& Synergycentric Sdn Bhd' (ersion ! Page !# of !)
Incident Management Release 1 1
st
October 2014
:pdate information ? based on input re=uirement of the Service
,esk software > in order to close the ticket
5lose the incident
7, #roubleshoot and reconBrm :ith user
Service ,esk (second level) would call back the +" %peration "eam
or the end user perform further troubleshooting and recon#rmed
with user on resolution
.=, "ncident ResolvedA
+f the incident can be resolved, con#rm the resolution with the end
user and close the incident
+f the incident could not be resolved, check if the incident is a
desktop issue or not
8, 8, References References
8,.References
"he input for the development of this document is as followB
+" +nfrastructure 4ibrary (+"+4) references
"he output for the development of this document is as followB
Standard %perating <rocedure, +ncident 6anagement
& Synergycentric Sdn Bhd' (ersion ! Page !! of !)
Incident Management Release 1 1
st
October 2014
/, /, &ther S&P9 document9 la:s and rules to consider &ther S&P9 document9 la:s and rules to consider
/,.&ther S&P9 document9 la:s and rules to consider
Standard %perating <rocedure, <roblem 6anagement
Standard %perating <rocedure, +ncident 6anagement
5, 5, ;ey %sers ;ey %sers
5,.;ey %sers
Synergycentric Service ,esk
Synergycentric +ncident 6anagement "eam
7, 7, #raining < "m1lementation Plan #raining < "m1lementation Plan
7,.#raining < "m1lementation Plan
Eey users listed in 5hapter 1 needs to be briefed on the procedures.
.=, .=, A11endices A11endices
.=,. A11endi> . ? Service evel Agreement
& Synergycentric Sdn Bhd' (ersion ! Page !" of !)
Incident Management Release 1 1
st
October 2014
.,.,. Severity ClassiBcation and Service Commitments
Severity <$
%rgency 5ritical
Res1onse #ime $ -our
Resolution #ime $& -ours
Descri1tion )n +ncident will be assigned as F<riority 4evel $G if
the +ncident is characterised by any of the
followingB
6aor impact incident aAecting more than or
e=uivalent to H' )uthorised :sers
preventing them from accessing production
business applications.
"he aAected environment is production and
supports the core business functions of the
";),!W+7,S with many users aAected, and
no workaround is available.
"here is the potential of a health, safety or
security issue in terms of technology to
occur or it has already occurred to the
Business.
"here is the potential of a maor loss of
revenue to ";),!W+7,S.
) critical production business system,
application or function is completely
unavailable, severely corrupted, or severely
degraded which aAects multiple
departments.
Descri1tion of
urgency
CCriticalD
+t is the level that causes huge impact across the
enterprise. "hese issues are 6ission 5ritical and
damages reputation of the concern. Stakeholders
are badly aAected. "hey have greatest #nancial
riskIloss. !.g.B>
@irus attack
,atabase 5orruption on a Business 5ritical
& Synergycentric Sdn Bhd' (ersion ! Page !* of !)
Incident Management Release 1 1
st
October 2014
)pplication (ie., WBS or ,%) ,B corrupted)
8ailure of S)7 or Server hardware
4)7 failure impacting J H' users
7etwork down on "ier $ site where no
network redundancy exists (e.g. Business
operations aAecting at 5!% level)
4oss of connectivity to both Business
)pplication database nodes
Severity <&
%rgency -igh
Res1onse #ime $ -our
Resolution #ime $ Business ,ay
Descri1tion )n +ncident will be assigned as F<riority 4evel &G if
the +ncident is characterised by any of the
followingB
+ncident aAecting less than H' )uthorised
users and more than $' users, preventing
them from accessing production business
applications.
"he aAected environment is production and
supports the core business functions of
";),!W+7,S with many users aAected but
workaround is available.
)n entire non>business critical department
or building is unable to work due to service
unavailability.
<otential for loss of revenue to
";),!W+7,S.
4oss of redundancy in a maor production
system or application, although service to
the business area is still available.
)Aected user is a @+< user of ";),!W+7,S.
& Synergycentric Sdn Bhd' (ersion ! Page !$ of !)
Incident Management Release 1 1
st
October 2014
Descri1tion of
urgency C-ighD
+t is the level that aAects the whole high level
organi.ation or the core operational department of
a speci#c business.
!.g.B>
;edundancyDSecondary server of the critical
business application crashed
Service degradation caused by hardware failure
where redundancy exists
4oss of connectivity to one among two Business
)pplications database node
7etwork connectivity to a department 9eneral
6anager aAected.
Severity <3
%rgency 6edium
Res1onse #ime $ -our
Resolution #ime 3 Business ,ays
Descri1tion ) +ncident will be assigned as F<riority 4evel 3G if
the +ncident is characterised by any of the
followingB
+ncident aAecting less than $' )uthorised
users and more than 3 users.
"he aAected environment is a production
environment which supports non>core
business functions and no workaround is
available.
) short term backup or bypass has been
made available, and the service level is
acceptable.
) minimal service impact to users like the
performance is impaired.
& Synergycentric Sdn Bhd' (ersion ! Page !+ of !)
Incident Management Release 1 1
st
October 2014
7o ;evenue 4oss to ";),!W+7,S.
Descri1tion of
urgency
C*ediumD
+t is the level that aAects a team
!.g.
) network disconnects to 3>$' business
users and they would not be able to access
the applications.
) slow network performance issue which
degrades the operations of a particular
branch.
Severity <(
%rgency 4ow
Res1onse #ime $ -our
Resolution #ime H Business ,ays
Descri1tion ) +ncident will be assigned as F<riority 4evel (G if
the +ncident is characterised by any of the
followingB
+ncident aAecting '>3 )uthorised users of
";),!W+7,S.
"he aAected environment is a production
environment which supports non>core
business functions and workaround is
available
)n alternate solutionDplanDresource etc is
available.
7o ;evenue 4oss to ";),!W+7,S.
Descri1tion of
urgency Co:D
+t is the level aAecting individuals
!.g.B>
)utomation tool error installed on individual
& Synergycentric Sdn Bhd' (ersion ! Page !, of !)
Incident Management Release 1 1
st
October 2014
<5 or 7otebook
<roblem with speci#c con#guration of the
desktop
+ndividual user access issues
-ardware 8aulty > work around available e.g.
printing problems
& Synergycentric Sdn Bhd' (ersion ! Page !) of !)