1. ServiceNow Implementation Workshop Incident Management

2. Workshop Day 1 Description The ServiceNow platform supports the Incident Management process with capabilities to record incidents, create knowledge from incidents, request changes, assign to appropriate groups, escalate, and manage through to resolution and reporting. Introduction & Roles Objectives & Outcomes Current State Assessment Incident Management Best Practice Overview Brief introduction by the team members, and understanding roles in the workshops Brief overview of workshop deliverables and high level goals of each attendee Current state review, challenges, opportunities, controls and measures Level setting and overview of what Incident Management is, benefits, and roles & responsibilities

3. Workshop Approach Understand how Incident Management can help your organization Understand the roadmap to get the most value out of Incident Management Document requirements and design based on workshop participation

4. Executive Summary UCSD is looking to implement ServiceNow as their Enterprise Service Management software of choice. The Incident Management process works to restore normal service operation as quickly as possible and minimize the adverse impact on business operations, thus ensuring that the best possible levels of service quality and availability are maintained, and will include configuration of the following Incident components, as needed: Develop a model of Incident/ticket entry points such as portal/phone/email/chat etc. Form Fields and values such as Category, Priority, State, User Information Assignment, escalation processes, and SLA(s) Notifications for end users, managers, business owners, service owners, and support groups Reporting and Operational Dashboards Mobile device support

5. ChallengeDescription No one to manage and escalate Incidents Specialist support staff being subject to constant interruption Specialist support staff being asked to fix low level issues. Lost, or incorrectly or badly managed Incidents Our End Users Are Not Very Happy Poorly managed incident response and ownership results in an ineffective support organization, with high costs and low employee motivation, since similar Incidents have to be resolved repeatedly and structural solutions are not provided. When incidents are resolved, information about the resolution is not recorded. There is little information to speed up the resolution time and identify workarounds, resulting in specialist staff being assigned a large volume of incidents. This results in less time to work on business critical systems, updates, project work. Specialist staff are fixing paper jams, diagnosing issues that are repeated and can be predicted with the right information and training. The bouncing incident record End users do not trust the service desk and bypass traditional support channels. Current Challenges

6. ServiceNow Enterprise Cloud Cloud Management Orchestration Discovery Event Management Service Mapping HR Facilities Marketing Legal Finance Change Incident Problem Financial Management Risk Audit Vendor SDLC Demand Resource Project Security Operations Customer Service Field Asset Test More CMDB Security Application Logic Application Development Analytics User Experience Vulnerability Response

7. Process Review 1.Lets review the process framework. 2.Don’t hesitate to ask questions.

8. Create new incident Verify Caller information Capture incident details Categorize incident Prioritize incident Perform incident matching Apply documented resolution Associate incident to related record Assign incident to appropriate support group Acknowledge incident assignment Investigate and diagnose Update incident record Document and submit RFC Implement resolution or workaround Validate initial categorization Ensure incident is fully documented Initiate Problem record Send Incident resolution confirmation email Confirm Incident resolution Close Incident Incident Management Incident Detection Recording Classification & Initial Support Investigation & Diagnosis Resolution & Recovery Incident Closure

9. Incident Management An incident is defined as an unplanned interruption or a reduction in the quality of an IT service or a failure of a configuration item (CI) that has not yet impacted an IT service. Incidents can include failures or degradation of services reported by users, technical staff, third-party suppliers and partners, or automatically from monitoring tools. Incident management is responsible for managing the lifecycle of all incidents. The ServiceNow platform supports the incident management process with the ability to log incidents, classify according to impact and urgency, assign to appropriate groups, escalate, and manage through to resolution and reporting. Any ESS user can log in to ServiceNow to record the incident and track it through the entire incident life cycle until service has been restored and the issue has been completely resolved. Within the platform, incidents are handled with the task record system. Each incident is generated through a variety of methods as a task record, and populated with the pertinent information in individual fields. These tasks can be assigned to appropriate service desk members, who will deal with the task as appropriate. Once the incident has been properly dealt with, it is closed. An incident is defined as an unplanned interruption or a reduction in the quality of an IT service or a failure of a configuration item (CI) that has not yet impacted an IT service. Incidents can include failures or degradation of services reported by users, technical staff, third-party suppliers and partners, or automatically from monitoring tools. Incident management is responsible for managing the lifecycle of all incidents. The ServiceNow platform supports the incident management process with the ability to log incidents, classify according to impact and urgency, assign to appropriate groups, escalate, and manage through to resolution and reporting. Any ESS user can log in to ServiceNow to record the incident and track it through the entire incident life cycle until service has been restored and the issue has been completely resolved. Within the platform, incidents are handled with the task record system. Each incident is generated through a variety of methods as a task record, and populated with the pertinent information in individual fields. These tasks can be assigned to appropriate service desk members, who will deal with the task as appropriate. Once the incident has been properly dealt with, it is closed. Goals Objectives The objectives of the incident management process are to: Ensure that standard methods and procedures are used for efficient and prompt incident response, analysis, documentation, ongoing management, and reporting. Increase visibility and communication of incidents to business and support staff. Enhance business perception of IT through use of a professional approach in quickly resolving and communicating incidents when they occur. Align incident management activities and priorities with those of the business. Maintain user satisfaction with the quality of IT services. The objectives of the incident management process are to: Ensure that standard methods and procedures are used for efficient and prompt incident response, analysis, documentation, ongoing management, and reporting. Increase visibility and communication of incidents to business and support staff. Enhance business perception of IT through use of a professional approach in quickly resolving and communicating incidents when they occur. Align incident management activities and priorities with those of the business. Maintain user satisfaction with the quality of IT services. The primary goal of the incident management process is to restore normal service operation as quickly as possible and minimize the adverse impact of incidents on business operations, thus ensuring that the best possible levels of service quality and availability are maintained. Normal service operation is defined here as an operational state where services and CIs are performing within agreed service and operational levels. Description

10. Related ProcessInputs to Incident ManagementOutputs from Incident Management Problem Management Change Management Configuration Management Service Level Management Knowledge Management Information about known errors and their workarounds is used to diagnose and resolve recurring incidents faster. Can detect and resolve incidents that arise from changes. Change management is responsible for keeping the Service Desk informed of all scheduled changes. The configuration management system underpins all incident management activities. It not only hosts the incident and other service management records, but contains details of the infrastructure vital to efficient call handling. SLM defines the acceptable levels of service within which incident management works, including: Incident response times Impact definitions Target fix times Service definitions Rules for requesting services Incident matching against existing known errors is performed during problem investigation and diagnosis to see if the problem has already been identified. Problems can be initiated from an incident when determining the root cause of the incident needs further investigation. Incident information is proactively analyzed to detect trends in service behavior that may be indicative of an underlying problem. A request for change (RFC) can be submitted in order to implement a workaround or a resolution. Problems are linked to relevant CI record(s). Defines measurable responses to service disruptions. Provides historical data that enables SLM to review service level agreements (SLAs) objectively and regularly. Assists SLM in defining where services are at their weakest so that SLM can define actions as part of the service improvement plan (SIP). Known errors and workarounds are documented and published in the knowledge base. Incident Management Inputs/Outputs

11. RoleDescription Process Owner Incident Manager Service Desk Level 2/ Level 3 Support A Senior Manager with the ability and authority to ensure the process is rolled out and used by the entire IT organization. Responsible for: Defining the overall mission of the process. Establishing and communicating the process mission, goals, and objectives to all stakeholders. Resolving any cross-functional (departmental) issues, including resource availability. Ensuring consistent execution of the process across the organization. Reporting on the effectiveness of the process to senior management. Initiating any process improvement initiatives. Responsible for: Managing the day-to-day activities of the process. Gathering and reporting on process metrics. Tracking compliance to the process. Escalating any issues with the process. Responsible for: Recording, ownership, monitoring, tracking, and communication about incidents. Investigating and diagnosing incidents. Providing resolutions and workarounds from standard operating procedures and existing known errors. Escalating incidents to incident support. Closing of incidents. The person who creates the problem record. This is frequently done from within the incident management process. Incident Management Roles

12. Quickly Resolve IncidentsMaintain IT Service QualityImprove Business and IT Productivity Percentage reduction in average time to respond to a call for assistance from first-line operatives Percentage increase in the Incidents resolved by first line operatives Percentage increase in the Incidents resolved by first line operatives on first response Percentage reduction of Incidents incorrectly assigned Percentage reduction of Incidents incorrectly categorized Reduced mean elapsed time for resolution or circumvention of Incidents, broken down by impact code Increased percentage of Incidents resolved within agreed (in SLAs) response times by impact code. Reduction in the service unavailability caused by Incidents Increased percentage of Incidents resolved within target times by priority Increased percentage of Incidents resolved within target times by category Percentage reduction in the average time for second line support to respond Reduction of the Incident backlog Percentage increase in the Incidents fixed before Users notice Percentage reduction in the Incidents reopened Percentage reduction in the overall average time to resolve Incidents Reduction in the number of Incidents requiring more than one second line support team. Percentage reduction in average cost of handling incidents Improve percentage of business incidents dealt with first line operatives Percentage reduction number of times first line operatives bypassed Percentage improvement in average number of incidents handled by each first line operatives No delays in the production of management reports Improved scores on CSS responses. Percentage improvement in CSS responses on the Incident Management service Percentage reduction in length of queue time waiting for Service Desk response Percentage reduction in the number of lost Service Desk calls Percentage reduction of the number of revised business instructions issued. Incident Key Performance Indicators

13. Create new incident Verify Caller information Capture incident details Categorize incident Prioritize incident Perform incident matching Apply documented resolution Associate incident to related record Assign incident to appropriate support group Acknowledge incident assignment Investigate and diagnose Update incident record Document and submit RFC Implement resolution or workaround Validate initial categorization Ensure incident is fully documented Initiate Problem record Send Incident resolution confirmation email Confirm Incident resolution Close Incident Incident Detection & Recording Incident Detection Recording Classification & Initial Support Investigation & Diagnosis Resolution & Recovery Incident Closure

14. Incident Detection & Recording IDTasksProcedurePrimary RoleInputOutput INC 1.1Create New Incident From the Incident application, create a new incident record. See Inbound Email Actions for a description of how to allow callers to log an incident via email. The ServiceNow Service Desk Call feature can be used to capture call information before making a decision about whether the call is an incident or service request. Service DeskInbound and manually entered Emails, Calls, Walk- ins, Self Service, Chat, IM, Monitoring New incident record INC 1.2Verify Caller Information Use the lookup list to identify the person reporting the incident. Ensure that the caller’s contact information is accurate by verifying: Phone number Email address Department Location Associated CIs Update information when necessary. Service DeskNew incident recordIncident record with identified source and accurate caller information Incident details from Service Desk or event management systems are the inputs for Incident Management. All relevant information relating to the nature of the incident must be logged so that a full historical record is maintained – and so that if the incident has to be referred to other support group(s), they will have all relevant information to hand to assist them. Resultant actions are to: Record basic details of the Incident Alert specialist support group(s) as necessary Start procedures for handling the service request.

15. Incident Detection & Recording IDTasksProcedurePrimary RoleInputOutput INC 1.3Capture Incident Details Summarize the incident symptoms in the Short Description field. In the Notes and Additional comments sections, describe the symptoms of the incident: What the caller is trying to do What is happening What actions were taken by the caller When the incident occurred Service DeskIncident record with identified source and accurate caller information Incident with detailed symptom information INC 1.4Categorize Incident Assigning incident tickets to categories and subcategories can greatly improve the clarity and granularity of report data. For example, without good categorization of incidents, you'd never know how many network-related versus telephone-related incidents you had from week to week. The platform can also use an incident's category/subcategory to automatically assign it to a specific fulfillment group to work on it (i.e., "Network" tickets should automatically go to the Network group, without anyone having to do anything more than assign the category Service DeskIncident with detailed symptom information Categorized incident INC 1.5Prioritize Incident ITIL uses three metrics for determining the order in which incidents are processed. All three are supported by Incident forms: Impact: The effect an incident has on business. Urgency: The extent to which the incident's resolution can bear delay. Priority: How quickly the service desk should address the incident. Service DeskCategorized incidentPrioritized incident

16. Create new incident Verify Caller information Capture incident details Categorize incident Prioritize incident Perform incident matching Apply documented resolution Associate incident to related record Assign incident to appropriate support group Acknowledge incident assignment Investigate and diagnose Update incident record Document and submit RFC Implement resolution or workaround Validate initial categorization Ensure incident is fully documented Initiate Problem record Send Incident resolution confirmation email Confirm Incident resolution Close Incident Classification & Initial Support Incident Detection Recording Classification & Initial Support Investigation & Diagnosis Resolution & Recovery Incident Closure

17. Classification & Initial Support IDTasksProcedurePrimary RoleInputOutput INC 2.1Perform Incident Matching Search opened incidents with the same CI to determine if a duplicate incident exists. If the affected CI has been identified, see BSM Map for a description of how to use the ServiceNow business service management map feature to easily identify open incidents. Look for existing resolution action by searching for existing problems and known errors with corresponding category and symptoms. Look for potential resolutions by searching knowledge articles. Service DeskPrioritized incident Related Lists associated with the Incident (other Incidents, Problems, CI’s, Tasks) Identified: Duplicate incident RFC as the cause of the incident Corresponding active problem Corresponding known error or workaround Classification is the process of identifying the reason for the Incident and hence the corresponding resolution action. Many Incidents are regularly experienced and the appropriate resolution actions are well known. This is not always the case, however, and a procedure for matching Incident classification data against that for Problems and Known Errors is necessary. Successful matching gives access to proven resolution actions, which should require no further investigation effort. Resultant actions are: Matching against Known Errors and Problems Informing Problem Management of the existence of new Problems and of unmatched or multiple Incidents Assigning impact and urgency, and thereby defining priority Assessing related configuration details Providing initial support (assess Incident details, find quick resolution)

18. Classification & Initial Support IDTasksProcedurePrimary RoleInputOutput INC 2.2Apply Documented Resolution If a corresponding known error exists, apply the documented workaround or resolution as described. Service DeskIdentified corresponding known error or workaround Resolved or unresolved incident INC 2.3Associate Incident to Related Record Associate the related record to the incident if: An identical active incident (same error on the same CI) exists. Or An active problem record related to the incident exists. Or The applied workaround, known error, or resolution information resolved the incident. Or The incident was caused by the implementation of a change. Service DeskDuplicate incidents Corresponding active problem record Identified RFC as a cause of the incident Or Resolution information from known error or workaround applied successfully Existing related records associated to incident INC 2.4Assign Incident to Appropriate Support Group If no documented known error or workaround exists, or if identified documented resolution did not resolve the incident, select the appropriate assignment group. Service DeskExisting related records associated to incident Or Unresolved incident Incident escalated to Incident Support

19. Create new incident Verify Caller information Capture incident details Categorize incident Prioritize incident Perform incident matching Apply documented resolution Associate incident to related record Assign incident to appropriate support group Acknowledge incident assignment Investigate and diagnose Update incident record Document and submit RFC Implement resolution or workaround Validate initial categorization Ensure incident is fully documented Initiate Problem record Send Incident resolution confirmation email Confirm Incident resolution Close Incident Investigation & Diagnosis Incident Detection Recording Classification & Initial Support Investigation & Diagnosis Resolution & Recovery Incident Closure

20. Investigation & Diagnosis IDTasksProcedurePrimary RoleInputOutput INC 3.1Acknowledge Incident Assignment Each 2 nd -level support group is responsible for monitoring their respective queues for assigned incidents. Assign incident to specific support team member. Or Reassign to another support group, if appropriate. Incident state is Active Assignment Group Schedules will affect timer. ITILIncident escalated to Incident Support Active incident (under investigation) As soon as it becomes clear that the Service Desk is unable to resolve the incident itself (or when target times for first-point resolution have been exceeded – whichever comes first!) the incident must be immediately escalated for further support. Once the Incident has been assigned to a support group, it should: Accept assignment of the Incident, specify the date and time (preferably automatically), ensuring: the Incident status and its history are regularly updated the Customer via the Service Desk is kept informed of progress towards resolution the current status of the Incident is reflected (e.g. work in progress, and so on) Advise the Service Desk/Customer of any identified Work-around, if it is possible to provide one immediately Review the Incident against Known Errors, Problem, solutions, planned Changes or knowledge bases If necessary, ask the Service Desk to re-evaluate the assigned business impact and priority, adjusting them as required, based on agreed service levels

21. Investigation & Diagnosis IDTasksProcedurePrimary RoleInputOutput INC 3.2Investigate and Diagnose Each support group involved with handling the incident investigates and diagnoses what has gone wrong. Incident SupportActive incident (under investigation) Investigation and diagnosis findings INC 3.3Update Incident Record In the Work notes section, document all activities, including details of any actions taken to try to resolve or re-create the incident, so that a complete historical record of all activities is maintained at all times. Incident SupportInvestigation and diagnosis findings Identified solution or workaround Incident record documented with investigation and diagnosis findings

22. Create new incident Verify Caller information Capture incident details Categorize incident Prioritize incident Perform incident matching Apply documented resolution Associate incident to related record Assign incident to appropriate support group Acknowledge incident assignment Investigate and diagnose Update incident record Document and submit RFC Implement resolution or workaround Validate initial categorization Ensure incident is fully documented Initiate Problem record Send Incident resolution confirmation email Confirm Incident resolution Close Incident Resolution & Recovery Incident Detection Recording Classification & Initial Support Investigation & Diagnosis Resolution & Recovery Incident Closure

23. Resolution & Recovery IDTasksProcedurePrimary RoleInputOutput INC 4.1Document and Submit RFC If a change is needed, initiate a new RFC from the incident record.Incident SupportIdentified solution or workaround requesting an RFC RFC submitted to Change Management INC 4.2Implement Resolution or Workaround Follow the documented procedure and implement the resolution or workaround. If the service is restored, change the incident state to Resolved. If the implemented resolution or workaround does not restore the service, return to INC 3.2 – Investigate and Diagnose. Incident SupportIdentified solution or workaround ready to be implemented Resolution or workaround implemented successfully Or Additional investigation and diagnosis required After successful execution of the resolution or some circumvention activity, service recovery can be effected and recovery actions carried out, often by specialist staff (second- or third-level support). The Incident Management system should allow for the recording of events and actions during the resolution and recovery activity. Actions: Resolve the Incident using the solution/Work-around or, alternatively, to raise an RFC (including a check for resolution) Take recovery actions.

24. Resolution & Recovery IDTasksProcedurePrimary RoleInputOutput INC 4.3Validate Initial Categorization Ensure the initial incident CI and call type (categorization) still corresponds to the nature of the incident. Adjust if necessary. Incident SupportResolution or workaround implemented successfully Active incident properly categorized INC 4.4Ensure Incident is Fully Documented Ensure the incident contains full historic information at a sufficient level of detail. If the incident has previously been associated to a known error or problem, set the incident state to Resolved or Pending Resolution Verification Populate Incident Cause for trend reporting Incident SupportActive incident properly categorized Fully documented incident set to the Resolved state Or Fully documented incident with no identified root cause INC 4.5Initiate a Problem If the incident was resolved with no root cause being identified, a problem record can be initiated to begin Root Cause investigation. Incident SupportFully documented incident with no identified root cause New problem record related to the incident

25. Create new incident Verify Caller information Capture incident details Categorize incident Prioritize incident Perform incident matching Apply documented resolution Associate incident to related record Assign incident to appropriate support group Acknowledge incident assignment Investigate and diagnose Update incident record Document and submit RFC Implement resolution or workaround Validate initial categorization Ensure incident is fully documented Initiate Problem record Send Incident resolution confirmation email Confirm Incident resolution Close Incident Incident Closure Incident Detection Recording Classification & Initial Support Investigation & Diagnosis Resolution & Recovery Incident Closure

26. IDTasksProcedurePrimary RoleInputOutput INC 5.1Send Incident Resolution Confirmation Email When an incident is set to a Resolved incident state, an email notification is sent to the caller and state is changed to Pending Resolution Verification. ServiceNow (System) Fully documented incident set to the Resolved state Incident resolution confirmation notification by email INC 5.2Confirm Incident Resolution If satisfied with the resolution, may ignore the notification, as no additional action is required. ServiceNow automatically closes the incident 3 days after the notification has been sent. Callers using Self- Service will be provided a list of open and resolved Incidents for their review and closure. If not satisfied with the resolution, reopen the incident by clicking on the link within the email notification. CallerIncident resolution confirmation notification by email Incident reopened by caller Or Incident at the Resolved state for X hours/days INC 5.3Close Incident ServiceNow automatically closes the incident if the caller has not disagreed with the resolution after 3 days (this allows for the three notifications to be sent and provides the customer with the opportunity to close the ticket or indicate lack of resolution. ServiceNow (System) Incident at the Pending Resolution Confirmation state for 3 days Closed incident record and closed incident email notification When the Incident has been resolved, the Service Desk should ensure that: Details of the action taken to resolve the Incident are concise and readable Classification is complete and accurate according to root cause Resolution/action is agreed with the Customer - verbally or, preferably, by email or in writing

27. Questions?