content_image/493898.jpg
<img src='content_image/493898.jpg'>

• regulatory or legislative breaches. 

Document code: Security level: Effective date: ICT Governance 

PRO-0027.06 Internal 15/01/2019 

As a note, in case the term major incident  is used in the ticketing tools, this always refers to Category C Incidents in ICT Governance. 

Investigation, Diagnosis, Escalation and Resolution / Recovery 

The Service’s Technical Documentation illustrates the roles and teams involv ed in the investigation and diagnosis of incidents and in the fulfilment of Service Requests, as well as the conditions of escalation from one support level team to the next. 

The focus is on restoring the functioning of the parts of the Service that have been affected in a major way. This a different goal than finding the source of the problem and correcting it, and can be performed for example by finding and implementing a workaround. 

If the investigation and diagnosis with the currently involved resources does not produce a solution candidate, the incident should be escalated either to the next support level or to the management of the Information System Directorate. 

Once a solution candidate is produced, it is applied and tested. If the solution does not resolve the incident, further investigation, diagnosis, escalation and solution testing steps are taken until a satisfying solution is found. 

## Closure 

When the incident recovery or request fulfilment has been completed, the person responsible for managing the ticket verifies that all relevant information (cause, responsibilities and final resolution) is properly stored and sets the ticket to resolved state. 

ECHA Ticketing Tool should be set to close the ticket automatically 7 days after the ticket is resolved. 

Any specific categorisations to be used when resolving the ticket are specified in the service’s Technical Service Description. 

## 3.6.6. Communication about Incidents 

See later section in this document regarding communication methods and formulation of communication messages in general. 

Some specific aspects regarding Incident Management: 

• The Incident Manager is in charge of the communication about the Incident. 

• When the Incident appears complicated, the resolution seems largely unknown or the incident has an effect on more than a few customers, 

o the first communication should be given immediately when this is recognised, 

