An Incident. Action Log is used to document the process of recovering the services from the time that the initial incident occurred (or was discovered) through to the eventual return to normal
An Incident. This is classified as an unplanned interruption to an IT service or a reduction in the quality of IT services. Failure of a configuration item that has not yet impacted service is also an incident. For example, failure of one disk from a mirror set. All incidents will have a service level target to provide a resolution to the existing issue or a work around if no immediate fix is available. Support technicians or teams should respond to an incident based on information supplied by the user and aim to resolve the loss of service as quickly as possible. Another example of an incident is a customer not being able to access a printing resource.
An Incident. Action Log is used to document the process of recovering the services from the time that the initial incident occurred (or was discovered) through to the eventual return to normal 10.1.2 The log should be used for both real disaster situations and during test of the disaster recovery arrangements. 10.1.3 It should contain: a) the sequence of events in chronological order for reference and reporting purposes b) information which can assist in any post-disaster/test appraisal of the adequacy of the Plan. 10.1.4 The log will be a useful aid to another member of staff who may have to take over control of a disaster/situation. When in use, the log should be held and maintained by the Managing Director or Location Manager so that a single, definitive record exists of the progress of recovery actions and any problems encountered. Under no circumstances should the MD or Location Manager write in the log himself. Someone specifically appointed, at the time, to fulfil this role should perform the writing. This is so that, if necessary, the log can be used as a legal document in any subsequent investigation of the incident. 10.1.5 Occasions may arise where a second "disaster incident" occurs before the first one has been cleared by a return to normal. In these circumstances it is for the Managing Director to decide whether: a) the second incident constitutes a "new" disaster and to create a new Incident/Action log, or b) the second incident is an "extension" of the first and any resulting action should be recording in the existing log. 10.1.6 The log should consist of one form per incident/action. It is suggested that the completed forms should be inserted into the master disaster plan folder in chronological order so that they build up to create a complete picture of recovery process and the actions which had to be carried out in order to achieve recovery. 10.1.7 Any incident that may result in the Business Continuity Plan being put into effect should be recorded on the form, as should any incident, which occurs, or action taken during the emergency or recovery process. 10.2
An Incident accident investigation shall be conducted for any injuries or equipment/property damage events. Copies shall be provided to Swinerton. Designate individual responsible to conduct incident/accident investigations and provide copies to Swinerton. Name: Title:
