
Get their perspectives of what is important to the business, and how they would like to have IT respond in the event of a service interruption. Conduct formal discussions with senior managers and key stakeholders to understand how they use IT services on a day-to-day basis. Interview and survey senior managers and key stakeholders.

And if higher levels of availability are required for a service, that would imply that an incident involving those services should have a higher level of impact and urgency assigned. ITIL describes a VBF as “the part of a business process that is critical to the success of the business.” The identification of VBFs is used as input into availability designs for an IT service, as those services that support VBFs will require higher levels of resiliency and redundancy.

One of the outputs from a BIA is a suggested recovery order and timeframes for business systems. A BIA quantifies the importance of business components and suggests the appropriate funding for measures to protect those components. A BIA is a formal assessment to determine and evaluate the potential effects of an interruption to business operations as a result of a disaster, accident, or emergency.

This means that business colleagues, not the IT organization, must define the prioritization matrix. Instead, defining an incident prioritization matrix must be a thoughtful, purposeful exercise that results in outcomes that meet business requirements, drives end-user satisfaction, and enables IT to be successful in managing an incident. But how can such an approach reflect the needs of the business? Sadly, it probably doesn’t.ĭefining an Incident Prioritization Matrix However, many IT organizations will arbitrarily define a prioritization matrix with no input from colleagues outside of IT. The intention is that higher-rated incidents are worked on, and resolved, before lower-rated incidents.įigure 1 – Example Incident Priority Matrixĭefining an incident prioritization matrix should not be a haphazard exercise. And where the impact rating intersects with the urgency rating determines the priority assigned to an incident. These ratings are then compared to the values found in a priority table or matrix. Based on these criteria, an impact rating and an urgency rating are assigned to an incident. Typically, IT organizations will define criteria for evaluating the harm caused by an incident, as well as determining the timeframe for resolving the incident. The combination of these two factors determine the priority of an incident, based upon business needs.

