Skip to main content

ServiceNow ITSM: Incident, Problem, and Continual Improvement Management

Introduction to ITSM

ITSM (IT Service Management) solutions help modernize service delivery and management. ServiceNow's cloud-based ITSM platform offers automation, reporting, and a centralized tool for managing IT services. Examples of services include laptop requests and IT support requests.

Key Benefits of ServiceNow ITSM:

  • Automation: Automates many ITSM processes.
  • Reporting: Provides robust reporting for capacity planning and performance tracking.
  • Centralized Platform: Manages all ITSM activities in one tool.

ITSM Modules in ServiceNow (Focus Areas):

  • Incident Management: Handling unplanned interruptions to IT services.
  • Problem Management: Identifying and resolving the root causes of incidents.
  • Change Management: Managing changes to the IT infrastructure.
  • Asset Management: Tracking and managing IT assets.
  • Service Catalog: Providing a user-friendly interface for requesting services.
  • Knowledge Management: Creating and sharing knowledge articles.

Incident Management

What is an Incident?

An incident is defined as:

  1. Unplanned Interruption: Any unexpected disruption to an IT service (e.g., email server outage, hardware failure).
  2. Reduction in Quality: A decrease in the quality of an IT service (e.g., slow internet due to router issues).
  3. Configuration Item Failure: A failure to a Configuration Item.
  4. Proactive Incident Creation: An incident may be raised proactively if a potential issue is identified before it impacts service (e.g., a technician notices a failing router).

What is Incident Management?

Incident Management is the process of:

  • Restoring Services Quickly: Minimizing the impact of unplanned interruptions.
  • Investigating Root Causes: Identifying the underlying cause of incidents.
  • Resolving Incidents within SLAs: Meeting agreed-upon service level agreement (SLA) timelines.
  • Preventing Recurrence: Implementing solutions to prevent similar incidents from happening again.

ServiceNow's Role: ServiceNow facilitates the ITIL-based incident management process with automation, trend analysis, and predictive intelligence.

Benefits of Incident Management

  • End-User Benefits:

    • Rapid service restoration.
    • User-friendly service desk interactions (notifications, updates).

  • IT/Business Benefits:

    • Faster service restoration.
    • Root cause identification to minimize recurrences.
    • Improved efficiency through the use of ServiceNow.

Incident Management Process Steps

  1. Breakdown: A configuration item or IT service fails.
  2. Reporting: The incident is reported through various channels:
    • Phone call to the service desk.
    • Self-service portal.
    • System integrations.
  3. Managing:
    • Investigation: Determining the cause of the incident.
    • Assignment: Assigning the incident to the appropriate team or individual.
    • Assessment: Evaluating the incident and developing a resolution plan.
  4. Resolving: Implementing the solution to restore the service. This may be a recurring process or a one-time fix.
  5. Closure

Key Roles in Incident Management (ITIL Roles)

  • ITIL: The basic role for help desk technicians and anyone involved in resolving incidents. Allows users to open, update, and close incidents, problems, and changes.
  • ITIL_admin: An elevated role typically assigned to team leads or managers, providing additional permissions (e.g., deleting records, other administrative functions).
  • Major_incident_manager: Responsible for managing major incidents. This includes:
    • Approving and owning major incidents.
    • Communicating with stakeholders.
    • Ensuring SLA compliance.
    • Involvement in the entire incident lifecycle.

Incident States

Incident states are crucial for tracking progress and managing SLAs.

  • New: The initial state when an incident is created.
  • In Progress: The incident is assigned and being actively worked on.
  • On Hold: Work is temporarily suspended, often while waiting for information from the user or another team. SLAs may be paused during this state (depending on company configuration). Reasons for being on hold include:
    • Awaiting Caller
    • Awaiting Change
    • Awaiting Problem
    • Awaiting Vendor
  • Canceled: The incident is deemed invalid, a duplicate, or resolved without intervention.
  • Resolved: The issue has been addressed, and the service is restored.
  • Closed: The incident is formally closed after confirmation from the user (manual closure) or automatically after a set period (auto-closure). The closure method depends on company policy.

Incident Management Lifecycle (Stages)

  1. Creation and Classification:

    • Logging: Recording the incident (via call, portal, integration).
    • Detailing: Providing specific information about the incident (description, affected service, configuration item).
    • Classifying: Categorizing the incident (e.g., software, hardware, network).
    • Assigning: Assigning the incident for investigation (service desk, L1 team, or automated assignment).

  2. Investigation and Diagnosis:

    • Locating Assignment Group: Identifying the appropriate team.
    • Assigning to Individual: Assigning the incident to a specific team member.
    • Investigating Symptoms: Analyzing the impact and symptoms of the incident.
    • Diagnosing Cause: Determining the root cause. This may involve creating incident tasks for other teams.
    • Updating Status and Work Notes: Keeping the incident record up-to-date with progress and relevant information.

  3. Resolution and Closure:

    • Restoring Service: Implementing the solution.
    • Updating Incident Activity: Documenting actions taken by the technician.
    • Communicating Resolution: Notifying the end-user.
    • Closing Incident: Manually or automatically closing the incident.

ServiceNow Incident Management Demo

This section covers a demonstration of the ServiceNow interface for Incident Management.

List View

  • Navigation: Filter Navigator -> Incident -> All.
  • Elements:
    • Incident Number: Unique identifier.
    • Opened: Date and time the incident was created.
    • Short Description: Brief summary of the issue.
    • Caller: The user who reported the incident.
    • Priority: The priority level (e.g., Critical, High, Medium, Low).
    • State: The current state of the incident (New, In Progress, etc.).
    • Category: The type of incident (e.g., Software, Hardware).
    • Assignment Group: The team assigned to the incident.
    • Assigned To: The individual assigned to the incident.
  • Filtering:
    • Search Box: Search for specific text within fields.
    • Condition Builder: Create complex filters using multiple criteria (e.g., Short Description contains "email" AND Priority is Critical).
    • Right-Click Filtering: "Show Matching" or "Filter Out" based on a selected value.
  • Editing: Double-click on certain fields to modify them directly in the list view.
  • Grouping: Right-click on a field (e.g., State) and select "Group By" to see incidents grouped by that field.
  • Exporting: Right-click and select "Export" to export the list in various formats (XLS, CSV, XML, JSON, PDF).
  • Visual Task Board: Right-click and select "Show Visual Task Board" to view incidents in a Kanban board format.
  • Sorting: Click on column headers or use the Condition Builder to sort the list.
  • Pagination: Navigate between multiple pages.

Form View (Creating a New Incident)

  • Navigation: Click "New" in the list view or "Create New" in the Incident menu.

  • Fields:

    • Caller: Select the user reporting the incident.
    • Category/Subcategory: Classify the incident (dependent fields).
    • Service/Service Offering: Specify the affected service.
    • Short Description/Description: Provide details about the issue.
    • Impact/Urgency: Determine the priority (priority is often calculated automatically).
    • State: Initially set to "New."
    • Contact Type: How the incident was reported (Email, Phone, Self-Service, Walk-in).
    • Assignment Group/Assigned To: Assign the incident.
    • Work Notes: Internal notes for technicians (not visible to the customer).
    • Additional Comments: Notes visible to the customer.
    • Watch List/Work Notes List: Add users to receive notifications.

  • Related Lists:

    • Task SLAs: Show SLAs associated with the incident.
    • Affected CIs: List configuration items impacted by the incident.
    • Incident Tasks: Child tasks of the incident.

  • Sections: Notes, Related Records, Resolution information.

Working on an Incident (Impersonation)

The demo shows impersonating a user (Incident Manager) to demonstrate the workflow.

  • Assigning: Assign the incident to a group and individual.
  • Investigating: Update work notes with investigation details.
  • Resolving:
    • Update the state to "Resolved."
    • Provide resolution notes.
    • Set the resolution code (Solved Remotely, Solved by Workaround, etc.).
  • Closure: Incident is closed manually or automatically.

Incident Data Structure

  • Task Table (Parent): The base table for incidents and other tasks. Contains common fields like Number, State, Short Description, etc.
  • Incident Table (Child): Inherits fields from the Task table and adds incident-specific fields (Caller, Category, etc.).
  • Incident Task Table (Child): Used for assigning sub-tasks to different teams. One incident can have multiple incident tasks.
  • Data Types: String, Integer, Reference, HTML, etc.

Problem Management

What is a Problem?

A problem is the underlying cause of one or more incidents. The root cause is often unknown when the problem is initially created.

What is Problem Management?

Problem Management is responsible for:

  • Investigating: Determining the root cause of incidents.
  • Resolving: Implementing solutions to prevent future incidents.
  • Minimizing Impact: Reducing the impact of incidents that cannot be prevented.

Problem States

  • New: The initial state when a problem is created.
  • Assess: The problem is being evaluated.
  • Duplicate/Canceled: The problem is deemed a duplicate or invalid during assessment.
  • Root Cause Analysis (RCA): The root cause is being actively investigated.
  • Accepted Risk: The problem is acknowledged, but a fix is not feasible or too risky. A workaround may be in place. This often leads to a "Known Error" record.
  • Fix in Progress: A solution is being implemented. This might involve a change request.
  • Resolved: The root cause has been addressed.
  • Closed: The problem has been fixed.

Problem Management Lifecycle (Stages)

  1. Detection and Logging:

    • Reactive: Identifying a problem based on multiple related incidents.
    • Proactive: Identifying a potential problem before it causes widespread incidents.
    • Creating Record: Creating a new problem record.
    • Prioritizing/Categorizing: Setting priority and category.

  2. Investigation and Diagnosis:

    • Conducting RCA: Performing root cause analysis.
    • Problem Tasks: Creating problem tasks for other teams if necessary.
    • Documenting: Recording the root cause, workaround, and fix.

  3. Resolution and Closure:

    • Confirming Workaround: Verifying that the workaround (if any) is effective.
    • Confirming Fix: Verifying that the permanent fix resolves the issue.
    • Implementing Change: Using change management to implement the fix if required.
    • Closing Problem: Closing the problem record (manually or automatically).

Problem Management Pictorial Representation

This section describes a diagram illustrating the problem management process.

  • Problem Creation: Problems can originate from:
    • Incident Management
    • Event Management
    • Technical Support
    • Development Code Review
  • Logging/Categorization/Prioritization
  • Known Error Check: Determining if the problem is already a known error.
  • Diagnosis:
    • Workaround Availability: A workaround is crucial for creating a known error or proceeding with resolution.
  • Resolution: Review and closure.

ServiceNow Problem Management Demo

List View

Similar to the Incident list view, the Problem list view offers filtering, sorting, grouping, and exporting capabilities.

Form View (Creating a New Problem)

  • Fields:

    • First Reported By: May be linked to an incident.
    • Category/Subcategory: Classify the problem.
    • Configuration Item: Specify the affected CI.
    • Problem Statement/Description: Describe the problem.
    • Assignment Group/Assigned To: Assign the problem.
    • Related Incidents: Link related incidents.
    • Problem Tasks / Change Requests: Create or associate related records.

  • Sections: Notes, Analysis Information, Resolution Information.

Working on a Problem (Impersonation)

  • Assigning: Assign the problem to a group and individual.
  • Marking Duplicate: Mark the problem as a duplicate of an existing problem.
  • Confirming: Confirm that the issue is indeed a problem
  • Accepting Risk: Acknowledge the problem, but choose not to fix it (creating a known error).
  • Creating Problem Tasks: Assign tasks to other teams for investigation.
  • Starting Fix: Initiate the fix process.
  • Re-analyze
  • Resolving: Document the cause and fix, and mark the problem as resolved.
  • Complete

Creating a Problem from an Incident

Demonstrates creating a problem directly from an incident record (right-click -> Create Problem).

Problem Data Structure

  • Task Table (Parent): The base table.
  • Problem Table (Child): Inherits fields from Task and adds problem-specific fields (Cause Notes, Fixed Notes, Workaround, etc.).
  • Problem Task Table (Child): Used for assigning sub-tasks. One problem can have multiple problem tasks.
  • Data Types:

Continual Improvement Management (CIM)

What is Continual Improvement Management?

CIM is a method for identifying and implementing improvements to IT processes and services. It involves:

  • Identifying Opportunities: Finding areas for improvement.
  • Planning and Executing: Developing and implementing improvement initiatives.
  • Measuring and Sharing: Tracking the effectiveness of improvements.

Key Concepts

  • Service, Process, and Function Improvements: CIM can target improvements in services, processes, or specific IT functions.
  • Improvement Initiatives: Contain goals, phases, and tasks to guide the improvement effort.
  • Measurement: Objectively measuring the impact of improvements.

Benefits of CIM

  • Optimize the value of processes, people, and/or tools.
  • Improve business efficiency.

CIM Roles

  • Improvement Requester: Submits improvement requests.
  • Improvement Manager: Analyzes, plans, and executes improvements.
  • Improvement Coordinator: Coordinates the overall improvement effort.

CIM Process Flow

  1. Identify Improvement Opportunities: Discover potential improvements (through meetings, analysis, etc.).
  2. Plan and Execute: Align the improvement with strategy, set goals, and execute.
  3. Measure and Share: Track and report on the business value of the improvement.
  4. Continuous Cycle: Identify further opportunities for improvement.

CIM Process Steps

  1. Recognize Need: Identify the need for improvement.
  2. Submit Initiative: Create a new improvement initiative.
  3. Review and Accept: Evaluate and approve the initiative.
  4. Assign and Coordinate: Assign the initiative to a coordinator, create phases and tasks, and manage progress.
  5. Review and Close: Review the completed improvement and close the initiative.
  6. Measure Value: Assess the impact and identify further opportunities.

CIM Sources

Improvements can originate from:

  • Incident/Problem Management
  • Demand Management
  • Service Level Agreements (SLAs)
  • Benchmarks
  • Analytics
  • Tasks
  • Process Optimization
  • Idea Portal

ServiceNow CIM Demo

Plugin Installation

  • CIM requires installing a plugin (System Definition -> Plugins).
  • Continual Improvement Management: A paid plugin (may be available for free in personal developer instances).
  • Automated Test Framework (ATF) Quick Start Tests: A free plugin.

Creating an Improvement Initiative (From Incident/Problem)

Demonstrates creating an improvement initiative from an incident or problem record.

  • Fields:

    • Business Service/Offering: Specify the area for improvement.
    • CIM Coordinator: Assign a coordinator (may need to create a new user with the role).
    • Approval Group: Assign an approval group.
    • Strategy: Select the improvement strategy (e.g., Cost Saving).
    • Priority/Effort/Benefit: Assess the impact and value of the improvement.
    • Business Justification: Explain the reason for the improvement.
    • Success Measurement Method: Choose how to measure success (PA Indicator, Assessment, Manual, Report).
    • KPI Improvements

  • Related Lists: CIM Tasks, CIM Phases.

Working on an Improvement Initiative

  • Accepting/Rejecting: The Improvement Manager approves or rejects the initiative.
  • Creating Tasks: Create tasks for specific actions.
  • Assessing: Evaluate
  • Waiting for Approval: The initiative requires approval.
  • In Progress/Review/Closed: The states of the initiative as it progresses.

User Roles (Example)

Demonstrates assigning CIM roles (Improvement Manager, Improvement Coordinator) to a user.

Workbench/Dashboard

CIM provides a workbench or dashboard for monitoring the progress and impact of improvements.

Key Takeaways

  • ServiceNow provides a comprehensive ITSM platform for managing incidents, problems, and continual improvement.
  • ITIL principles are integrated into ServiceNow's processes.
  • Understanding roles, states, and lifecycles is crucial for effective ITSM.
  • ServiceNow offers automation, reporting, and a user-friendly interface.
  • CIM helps organizations continuously improve their IT services and processes.
  • Plugins may be required for certain features (e.g., CIM).
  • Personal Developer Instances (PDIs) are valuable for learning and experimenting with ServiceNow. Remember to keep your PDI active by logging in regularly.
No Comments
Back to top