1. Study of WLCG Incidents – A Proposal Jamie.Shiers@cern.ch

2. Introduction Through the intermediary of Bob Jones, I have been contacted by a group in Barcelona concerning learning from IT incidents – ESADA business school Actually two proposals: a)Comparative study (Tier1s); b)Best practices study (also Tier1s). “In our research project, we examine how organizations learn from different types of incidents happening to their information systems, those like the break-downs, crashes, and security threats.”

3. Comparative Study We select a couple of sites (preferably in Tier 1) and we study them how they learn from their critical incidents, what challenges they face in learning from them, what procedures, actions, and methods they use to learn from those incidents, and how this learning brings about changes and improvements in the technical and organizational factors (such as improvements of policies, procedures, and communications). This would take a few interviews with the managers and technical experts of that site and perhaps some visits. The result would be 1.reflection report on how is the state of organizational learning for them and 2.suggestions for possible ways of improvement, based on comparison with other similar organizations. The research team would offer a couple of workshops on models and mechanisms for learning from incidents, customized based on the studied cases.

4. Best Practices Study We select like 3 sites (preferably from Tier 1) that are more advanced and agile in terms of learning from incidents (whatever your team suggest) or are more likely to experience some incidents earlier that other sites (perhaps because they are more advanced in the project or whatever like that). We study them on “how” they successively learn from their critical incidents (what mechanisms, roles, responsibilities, procedures, resources, interactions, systems they use for learning process). We document these cases as successful cases for establishing a learning mechanism, analyzing why they were successful and how their experience can be taken up by other sites to improve their learning capability. The results would be a series of best practices and training workshops on how to improve the learning capability for learning from incidents. This scenario also would require only a few interviews with the managers and technical experts of each site and some visits of their work and systems (such as reporting systems and document sharing systems that they might use in the learning process).

5. Conclusions IMHO both of these proposals could be of interest We could eventually proceed sequentially, starting with proposal a) and continuing with b) if the experience was felt to be +ve On the “thorny” subject of selecting sites, propose to base this on the highest # of SIRs – CERN certainly wins this contest: include?