IT incident

A user reports an incident. The service desk logs it and decides whether it's a major incident, which goes to a separate procedure. Otherwise the desk investigates, and escalates to the support group if it can't resolve it or if the response SLA is breached. Once a fix is applied, the desk checks with the user, and reopens the investigation if the fix didn't work.

This is the IT incident management template. To open it in the app, select Templates in the rail, then IT incident management.

process IT incident management
lanes Service desk | Support group

lane Service desk
start:message Incident reported
user Log and categorize incident
xor Major incident?
  yes -> Start major incident procedure
  no (default) -> #investigate

call Start major incident procedure
end Handed to major incident team

xor #investigate
user Investigate and diagnose
  on:timer(PT4H) Response SLA breached -> #escalate
xor Resolved at first line?
  yes -> #fix
  no (default) -> #escalate

lane Support group
xor #escalate
user Escalate to support group
user Diagnose in depth
lane Service desk
xor #fix
service Apply fix
user Confirm resolution with user
xor User confirms fix?
  yes -> Close incident
  no -> #investigate

service Close incident
end Incident closed

What to noticeCopy Anchor Link

• A call activity. The major incident procedure is a process of its own, so it's a call step here rather than more steps in this diagram.
• Merges with ids. #investigate, #escalate and #fix are merge gateways with no names. Arrows reach them from several places.
• A boundary event that points to a merge. The four-hour timer on the investigation goes to #escalate, the same place as "no" from the first-line decision.
• A loop back. If the user doesn't confirm the fix, the flow returns to #investigate, in front of the investigation.