Incident Management Maturity Assessment
A 67-question diagnostic across 11 domains that follows an incident from detection and logging through classification, diagnosis, assignment, resolution, closure, major and security incidents, tracking and escalation, pe...
Overview
A 67-question diagnostic across 11 domains that follows an incident from detection and logging through classification, diagnosis, assignment, resolution, closure, major and security incidents, tracking and escalation, people and tools, and measurement. Written for the incident manager who needs to answer: do we restore service fast, keep people informed, learn from what breaks and can we prove it?
Detailed Description
Incident management is the IT practice the business sees most. When it works, service comes back quickly, users are kept informed and major incidents run with calm control. When it fails, tickets bounce between teams, outages run long, regulatory deadlines slip and leadership hears about problems from customers first.
The model follows the incident lifecycle in order. It starts with governance (policy, ownership, roles, interfaces, one record standard and agreed targets), then checks detection from users, monitoring and service level objective (SLO) alerts, classification and correlation, diagnosis with knowledge and incident models, assignment and swarming, resolution under change control including automated and artificial intelligence (AI) agent actions, and closure with user confirmation. It then covers major incidents, regulatory notification and the handoff of security incidents, tracking and escalation, people and tools, and measurement that drives improvement.
Each question is scored on whether the practice is Documented, Implemented and Effective. Documented without Implemented exposes paper practices, Implemented without Documented exposes practices that depend on a few people, and either without Effective exposes practices nobody measures. Depth on single practices sits in other library models: Service Desk for contact handling, Security Operations Center Cyber and Incident Response for security investigation, Knowledge Management for the knowledge lifecycle, Continual Service Improvement for the improvement program and Business Impact Analysis for impact assessment.
Assessment Details
Audience
Incident Manager / Major Incident Manager / Service Desk Manager / IT Operations Director / IT service management (ITSM) Process Owner. Secondary: Resolver Group Leads, Security Operations, Problem, Change and Configuration Managers, Service Owners, Supplier Managers and Compliance Officers.
Purpose
Shows where incident handling breaks down, from logging and priority through escalation, major incident response and regulatory notice, to whether measurement drives improvement. Results tie each gap to the document or record that proves it and to the key performance indicator (KPI) that shows progress.
Effort
Initial assessment: 5-6 hours in facilitated sessions with the incident manager, service desk leads, resolver group leads, the major incident manager, security operations, problem, change and configuration managers, and service and supplier owners. Evidence gathering: 1-2 weeks to sample incident records, reports and procedures. Reassessment: 3 hours.
Cadence
Annually, and after any major incident that exposed gaps, a missed regulatory notice, a change of ITSM tool or support model, or a new critical service or supplier. Review restoration time, target compliance, first-line resolution and reopen rate monthly.
Framework Alignment
KPIs
- Proactive Incident Detection - Share of priority 1 and 2 incidents opened by monitoring before the first user report. Target: at least 80%.
- Failed Resolutions - Share of resolved incidents found still faulty within 72 hours of resolution. Target: under 2%.
- Major Incident Recovery Within Objective - Share of major incidents crossing the continuity threshold with service recovered within the recovery time objective. Target: 100%.
- Escalated Incident Recovery - Share of escalated incidents recovered within the original or revised target time. Target: at least 80%.
- Cost-Informed Funding Decisions - Share of resilience or problem funding decisions for critical services that cite incident cost. Target: at least 80%.
Dependencies
Assessment Outline
(11 domains · 67 questions)-
1
1 Incident Management Governance
Incident management policy and scope, Incident process owner, Duty incident manager rota and authority, Roles and RACI, Practice interfaces, Single process and record standard, Agreed target times
- 1.1 Incident management policy and scope 1 questions
- 1.2 Incident process owner 1 questions
- 1.3 Duty incident manager rota and authority 1 questions
- 1.4 Roles and RACI 1 questions
- 1.5 Practice interfaces 1 questions
- 1.6 Single process and record standard 1 questions
- 1.7 Agreed target times 1 questions
-
2
2 Incident Detection and Logging
Contact channels and single point of contact, Event-driven incident creation, Service level objective burn alerts, Logging every incident, Symptom and impact capture, Service and CI linkage, Failed self-help capture
- 2.1 Contact channels and single point of contact 1 questions
- 2.2 Event-driven incident creation 1 questions
- 2.3 Service level objective burn alerts 1 questions
- 2.4 Logging every incident 1 questions
- 2.5 Symptom and impact capture 1 questions
- 2.6 Service and CI linkage 1 questions
- 2.7 Failed self-help capture 1 questions
-
3
3 Classification, Prioritization and Correlation
Category scheme, Impact and urgency priority, Incident, request or change check, Service impact correlation, Related alert and incident correlation
- 3.1 Category scheme 1 questions
- 3.2 Impact and urgency priority 1 questions
- 3.3 Incident, request or change check 1 questions
- 3.4 Service impact correlation 1 questions
- 3.5 Related alert and incident correlation 1 questions
-
4
4 Diagnosis and Knowledge Matching
Knowledge and known error matching, Incident models, First-line diagnosis, Problem registration criteria, Restoration path decision
- 4.1 Knowledge and known error matching 1 questions
- 4.2 Incident models 1 questions
- 4.3 First-line diagnosis 1 questions
- 4.4 Problem registration criteria 1 questions
- 4.5 Restoration path decision 1 questions
-
5
5 Assignment, Investigation and Swarming
Assignment matrix, Incident ownership, Swarming, Supplier-handled incidents, Provider-wide outage playbook, Investigation records
- 5.1 Assignment matrix 1 questions
- 5.2 Incident ownership 1 questions
- 5.3 Swarming 1 questions
- 5.4 Supplier-handled incidents 1 questions
- 5.5 Provider-wide outage playbook 1 questions
- 5.6 Investigation records 1 questions
-
6
6 Resolution and Recovery
Resolution recording, Change control during resolution, Automation and AI agent controls, Recovery actions, Restoration verification, Knowledge capture and feedback
- 6.1 Resolution recording 1 questions
- 6.2 Change control during resolution 1 questions
- 6.3 Automation and AI agent controls 1 questions
- 6.4 Recovery actions 1 questions
- 6.5 Restoration verification 1 questions
- 6.6 Knowledge capture and feedback 1 questions
-
7
7 Closure and User Feedback
User confirmation, Closure quality and codes, Reopen handling, Dissatisfied user follow-up, Incident complaint handling
- 7.1 User confirmation 1 questions
- 7.2 Closure quality and codes 1 questions
- 7.3 Reopen handling 1 questions
- 7.4 Dissatisfied user follow-up 1 questions
- 7.5 Incident complaint handling 1 questions
-
8
8 Major and Security Incident Management
Major incident criteria and declaration, Documented major incident procedure, Major incident manager, Response coordination, Major incident communication and status page, Regulatory notification register, Continuity invocation thresholds, Major incident exercises, Blameless major incident review, Security incident recognition, Security incident handoff and coordination
- 8.01 Major incident criteria and declaration 1 questions
- 8.02 Documented major incident procedure 1 questions
- 8.03 Major incident manager 1 questions
- 8.04 Response coordination 1 questions
- 8.05 Major incident communication and status page 1 questions
- 8.06 Regulatory notification register 1 questions
- 8.07 Continuity invocation thresholds 1 questions
- 8.08 Major incident exercises 1 questions
- 8.09 Blameless major incident review 1 questions
- 8.10 Security incident recognition 1 questions
- 8.11 Security incident handoff and coordination 1 questions
-
9
9 Tracking, Escalation and Communication
Active incident tracking and target visibility, Functional escalation, Hierarchical escalation, User progress updates, Escalation analysis
- 9.1 Active incident tracking and target visibility 1 questions
- 9.2 Functional escalation 1 questions
- 9.3 Hierarchical escalation 1 questions
- 9.4 User progress updates 1 questions
- 9.5 Escalation analysis 1 questions
-
10
10 People and Tools
Competence and training, Staffing to demand, On-call load and alert noise, Awareness of incident duties, Tool capability
- 10.1 Competence and training 1 questions
- 10.2 Staffing to demand 1 questions
- 10.3 On-call load and alert noise 1 questions
- 10.4 Awareness of incident duties 1 questions
- 10.5 Tool capability 1 questions
-
11
11 Measurement, Analysis and Improvement
KPI framework, Stakeholder reporting, Trend analysis, Business impact and cost, Improvement input
- 11.1 KPI framework 1 questions
- 11.2 Stakeholder reporting 1 questions
- 11.3 Trend analysis 1 questions
- 11.4 Business impact and cost 1 questions
- 11.5 Improvement input 1 questions
At a Glance
Still have questions? Get in touch
Business Bay, Dubai, UAE
ITSGovernance