Managing and tracking major incidents

In BMC Helix ITSM, you can manage the life cycle of an outage until restoration. You can also add the required team members, vendors, and specialists to the incident ticket so that you can identify and implement corrective measures in order to avoid recurrence of major incidents.

BMC Helix ITSM provides recommendations to Major Incident Managers for assessing whether a major incident candidate qualifies to be promoted as a major incident based on the following advanced major incident qualifiers:

Clients, financial counteracts and transactions affected
Reputational impact
Service downtime duration
Geographical spread
Data losses
Critical services affected
Economic impact

In version 25.3.00 and later, If you have enabled the advanced major incident qualifier fields on the Incident Rules form, the fields in the Service and Impacted Areas sections in the incident are mandatory.

Before you begin

As an administrator, configure the following settings:

Task	Reference
Configure functional roles for individuals	Functional roles and extended application access
Configure assignment events and rules for incident management	Configuring assignments
Enable the advanced major incident qualifier fields in the incident and configure the service downtime indicator	Configuring incident rules
Register an application in Microsoft Azure to launch MS Teams chat	Configuring-settings-to-launch-Microsoft-Teams-chat-from-incidents

To mark an incident as a major incident candidate

As a service desk agent, if you suspect that a reported incident might be a major incident, you can mark that incident as a major incident candidate.

On the Incident page, select the major incident manager Support group and Person in the Teams section of the Incident screen.

If the administrator has enabled the advanced major incident qualifier fields in the incident, perform the following steps:

Select values in the following advanced major incident qualifier fields:

Impact qualifier field	Description
Reputational impact	Select Yes if you suspect the incident to have a reputational impact on your organization. By default, the field value is set as No. If you select Yes, BMC Helix ITSM considers this advanced major incident qualifier to be likely impacted
Data losses	Select Yes if you suspect the incident will cause data loss in your organization. By default, the field value is set as No. If you select Yes, BMC Helix ITSM considers this advanced major incident qualifier to be likely impacted.
Economic impact	Select Yes if you suspect the incident will cause an economic impact on your organization. By default, the field value is set as No. If you select Yes, BMC Helix ITSM considers this advanced major incident qualifier to be likely impacted.
Service downtime (mins)	Enter the expected service downtime in minutes for the associated service due to this incident. By default, the field value is set as 0. If you enter a value that breaches its configured threshold value, BMC Helix ITSM considers this advanced major incident qualifier to be likely impacted To know more about configuring this threshold value, see Configuring incident rules.
Affected clients, finances, transactions	Select Yes if you suspect the incident affects clients, finances, and transactions of your organization. By default, the field value is set as No. If you select Yes, BMC Helix ITSM considers this advanced major incident qualifier to be likely impacted

Enter the Service details.
BMC Helix ITSM considers this advanced major incident qualifier to be likely impacted for services with High and Very High severities based on the following table:
Urgency
Impact Low Medium High Critical
Extensive Medium Medium High Very High
Significant Medium Medium High High
Moderate Low Medium Medium Medium
Minor Low Medium Medium Medium
Each cell in the table shows the severity of service(e.g., Low, Medium, High, Very High) based on the combination of impact and urgency.
In the Impacted areas section, enter the areas likely to be impacted by this incident, such as Company, Region, and Site group.
BMC Helix ITSM considers this advanced major incident qualifier to be likely impacted if you select at least one impacted area.
Click Add, and then click Save.

All of these activities are recorded and displayed in the activity note of the incident.
If two or more advanced major incident qualifiers are likely to be impacted, BMC Helix ITSM recommends classifying the candidate as a major incident and records the relevant advanced major incident qualifiers in the activity note.

To mark a candidate as a major incident

As a Major Incident Manager, you receive a notification that a service desk agent has assigned an incident to you which has been flagged as a major incident candidate. Identifying, resolving, and preventing major incidents are part of the Major Incident Management process. You analyze and identify candidate incidents, their criticality, and business impact.

When the advanced major incident qualifier fields are enabled, service desk agents fill them based on their assessment. These details help BMC Helix ITSM evaluate the incident and may trigger a recommendation to tag it as a major incident. The qualifiers and recommendations are recorded in the activity note.

As a Major Incident Manager, you can view the qualifiers and recommendations to proceed with the major incident workflow.

After you complete the assessment, you perform the following steps to accept a major incident:

On the Edit Incident screen, in Major incident, click Yes.
The assignee of the incident receives a notification.

Important
In case an agent has Major Incident Manager functional role, the agent can directly create a major incident by selecting Yes while creating the incident.
In the Team section, select Communication Coordinator support group or Person.
In the Major incident team section, click +Add team member(s).
(Optional) Select Support Group.
Select Person.
In Role, select the role of the selected person.
The available roles are SME, Vendor, and Assignee.
(Optional) Select the required permission for the person.
If you select the required permission, the person is granted the selected permission. The default permissions are access to CIs, Related items, and Tasks.

Watch the following video (2:54) to learn how to manage and track major incidents in BMC Helix ITSM:

Watch the YouTube video about managing and tracking major incidents.

To track major incidents

On the Edit incident screen, you can use the following fields to track the details associated to major incidents:

Field	Value or Description
Major incident proposed date	The timestamp when the incident was proposed as a major incident
Major incident accepted date	The timestamp when a Major Incident Manager accepted a major incident
Major incident rejected date	The timestamp when a Major Incident Manager rejected a major incident
Duration	The time lapse between the incident report time and the current time or incident closed time
Support groups engaged	Shows the list of support groups that have been added as the major incident management team.
Vendors engaged	Yes or No
Management notified	Yes or No
Security issue	Yes or No
Legal issue	Yes or No
Compliance issue	Yes or No
Cause category	The list of Generic Categorization for the incident module only
Cause	A Free text field to capture more details about the cause of a major incident
Customer notified	Yes or No
Business impact	A Free text field to capture the business impacted due to a major incident

To launch ChatOps for collaboration

As a Communication Coordinator or Major Incident Manager, you can launch Microsoft Teams chat from the Incident screen. A Microsoft Teams chat is opened and all the associated team members are invited to the chat.