IRP.SP 1.2 Establish an Incident Management System
Summary
Establish and maintain an incident management system for processing and tracking incident information.
Description
An incident management system includes the storage media, procedures, and tools for accessing the incident management system. These storage media, procedures, and tools can be automated but are not required to be automated. For example, storage media might be a filing system where documents are stored. Procedures can be documented on paper and tools can be hand tools or instruments for performing work without automated help.
A collection of historical data covering addressed incidents, underlying causes of incidents, known approaches to addressing incidents, and workarounds should be available to support incident management.
Example Work Products
- An incident management system with controlled work products
- Access control procedures for the incident management system
Subpractices
1. Ensure that the incident management system allows the escalation and transfer of incidents among groups.
Incidents may need to be transferred or escalated between different groups because the group that entered the incident may not be best suited for taking action to address it.
2. Ensure that the incident management system allows the storage, update, retrieval, and reporting of incident information that is useful to the resolution and prevention of incidents.
- Indexed physical files of customer complaints and resolutions
- Bug or issue tracking software
- Help desk software
3. Maintain the integrity of the incident management system and its contents.
- Backing up and restoring incident files
- Archiving incident files
- Recovering from incident errors
- Maintaining security that prevents unauthorized access
4. Maintain the incident management system as necessary.
Maintenance should include removing obsolete information and consolidating redundant information that accumulates over time.