2016 survey report: major incident management trends

50% 25%

25%

MAJOR INCIDENT MANAGEMENT TRENDS

Survey Report

100% 68%

80%25%

15%

75%

85% 100%

SURVEY

www.xMatters.com | 2MIM SURVEY REPORT

100% 68%

80%25%

15%

75%

85% 100%

Only 52%

of companies have a major incident team

Only 44%

of companies staff major incident teams with dedicated personnel

In the absence of a major incident team, various roles lead the major incident response

76%

of business stakeholders are tolerant that major incidents are an unavoidable fact of business

87%

say executives must be informed during major incidents

64%

have target resolution times

76%

frequently miss those target resolution times

Reliance on digital infrastructures has dramatically increased the impact and frequency

of major incidents. In fact, more than 90% of large businesses report major incidents

occur at least several times a year and nearly 60% report major incidents occur

at least monthly. A survey of more than 400 IT professionals reveals that IT and business

leaders within individual companies are mostly aligned on what constitutes major incidents

and how to resolve them. However, standard definitions and processes are lacking between

companies and across industries. Without these standards, IT departments lack benchmarks

and best practices to help drive improvements

A more complete picture reveals itself when we combine our recent survey results with our

customers’ experience and our own expertise. In this report we will attempt to put the results

of the latest survey in context for better analysis.

Introduction

Key Findings

SURVEY


100% 68%

80%25%

15%

75%

85% 100%

Businesses do recognize the importance of rapid and

effective response to major incidents. However, they differ

in how they define a major incident and organize response

teams.

A number of factors determine whether an event rises to

the level of a major incident.

Most respondents still choose traditional indicators like

length of an outage and customer impact. However, some

of our customers recognize even degraded service or

specific system outages as major incidents, and these

views are reflected in the results as well.

Industry Standards

For your company what factors determine whetheran incident is classified asa Major Incident?

Numerous Factors Determine When an Incident Becomes a Major Incident

29%

32%

38%

50%

53%

55%

61%

77%

81%

0% 10% 20% 30% 40% 50% 60% 70% 80% 90%

Number of calls to the call center

Performance threshold surpassed

SLA is exceeded

Number of services or apps affected

Executive management becomes involved

Specific services or apps affected

Employee impact

Customer impact

Length of outage

Numerous Factors Determine When an Incident Becomes a Major Incident

For your company what factors determine whether an incident is classified as a Major Incident?

SURVEY


100% 68%

80%25%

15%

75%

85% 100%

Barely half of companies have a major incident team,

and our survey respondents bear out that a major

incident team is still not universally the norm.

Aligning with what customers and other businesses tell us,

larger companies are more likely to have major incident

teams.

Only 52% of Companies Have a Major Incident Team

Company Size vs. Major Incident Team Y/N

Does your company have a Major Incident Management team?

Does your company have a Major Incident Management team?

Only 52% of Companies Have a Major Incident Team

Yes 52%

No 48%

Company Size vs. Major Incident Team Y/N

67%

67%

52%

41%

52%

33%

33%

48%

59%

48%

0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

More than 10,000

5,000 - 10,000

1,000 - 5,000

500 - 1,000

All

Yes

No

SURVEY


100% 68%

80%25%

15%

75%

85% 100%

For companies without a major incident team, leadership

falls to any number of roles, including IT operations and

IT executives. Interestingly, all responses were in the IT

department but only a quarter indicated the IT service

desk.

The size of major incident teams varied as well, but

80% of teams in our survey have 10 employees or fewer.

However, fewer than half the businesses in our survey have

dedicated personnel on their major incident teams.

In keeping with our customers, though, the result varies

by company size and bigger companies are more likely to

have employees dedicated to major incident management.

In the Absence of Dedicated Team Various Roles Lead the Major Incident Response

For those members of the Major Incident Management team, how many have this as a full time role?

Only 44% of Companies Staff Major Incident Teams with Dedicated Personnel



Only 44% of Companies Staff Major Incident Teams with Dedicated Personnel

56%

2%

9% 7%

19%

7%

0%

10%

20%

30%

40%

50%

60%

None, they have other responsibilities beyond major incident response

1 2 3 4 More than 5 None, they have other responsibilities beyond incident response

Who manages and coordinates the responses to Major Incidents?

In the Absence of Dedicated Team Various Roles Lead the Major Incident Response

24%

29%

35%

44%

56%

0% 10% 20% 30% 40% 50% 60%

IT service desk

It depends who is available at the time

It varies by the incident type

IT executive

IT operations

It depends who is available at the time

SURVEY


100% 68%

80%25%

15%

75%

85% 100%

Company Size vs. MIM Team Being a Full-Time Role

64% Have Target Resolution Times

Are there specified target times to resolve a Major Incident?

Company Size vs. MIM Team Being a Full-Time Role

56%

2%

9% 7%

19%

88%

0%

6%

0%

6%

0%

48%

4% 9% 9%

26%

4%

20%

0%

20% 20%

40%

0%

40%

0%

10% 10% 10%

30%

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

None, they have other responsibilities beyond major incident response

1 2 3 4 More than 5

All

500 - 1,000

1,000 - 5,000

5,000 - 10,000

More than 10,000

Many IT executives, managers, and employees are assessed

based on their ability to limit the number, duration, and

severity of incidents. Most companies in our survey have

SLAs in place, but many report that they breach their SLAs

regularly.

Nearly two-thirds of respondents have SLAs, but the time

frames target resolution times vary. However, more than

75% of respondents say they exceed their SLAs.

Major Incident Response

Are there specified target times to resolve a Major Incident?

64% Have Target Resolution Times

Yes 64% No

36%

SURVEY


100% 68%

80%25%

15%

75%

85% 100%

Wide Range of Resolution Target Times for Major Incidents

76% Frequently Miss Target Resolution Times

How fast are the target times to resolve a Major Incident?

How often are resolution targets missed?

How fast are the target times to resolve a Major Incident?

Wide Range of Resolution Target Times for Major Incidents

7%

17%

29% 29%

19%

0%

5%

10%

15%

20%

25%

30%

35%

Less than 15 minutes 15 – 30 minutes 30 – 60 minutes 60 – 90 minutes Longer than 90 minutes

13% 63% 23% 1%

0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

Most of the time

Some of the time

Rarely

Never

SURVEY


100% 68%

80%25%

15%

75%

85% 100%

Most companies report several major incidents a year,

but results vary by company size. For instance, 51% of

companies with 5,000 to 10,000 employees and 30% of

companies with more than 10,000 employees report a

major incident at least monthly.

Some of our larger clients report several major incidents

per week, and the discrepancy could be a result of

different definitions of a major incident.

1%

12% 13%

42%

18%

13%

1% 0%

14%

24%

85%

40%

35%

3%

13%

62%

34%

72%

12%

0% 0% 0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

Daily Weekly Monthly Several times a year Yearly Fewer than once a year Never

All

500 - 5,000

More than - 5,000

Company Size vs. # of Major Incidents

Automated notification platforms are fairly popular,

but we were surprised that more than half use manual

communication methods.

Again, though, larger companies are more likely to use

automated notifications. Nearly two-thirds of companies

with at least 5,000 employees report using an automated

notification platform.

Regardless of the system, 40% of respondents send

mass notifications to everyone in IT instead of to specific

resolution team members.

It’s no wonder that companies are automating their

notifications, especially since more than 82% of respondents

say business application downtime significantly affects

revenue. To be honest, this was kind of a no-brainer

response because many of our customers consider revenue

risk a major factor in declaring a major incident.

SURVEY


100% 68%

80%25%

15%

75%

85% 100%

How are IT team members notified in the case of a major incident?

Which best describes your company’s notification process for a major incident?

How are IT team members notified in the case of a major incident?

We use an automated communications

solution 49%

Team members are manually contacted

49%

Other 2%

Which best describes your company’s notification process for a major incident?

A mass notification sent to everyone in IT

40%

An issue specific notification is sent

only to select teams 45%

Specific individuals are contacted

15%

An issue specific notification is sent only to

select teams 45%

Specific individuals are contacted 15%

A mass notification is sent to everyone in IT 40%

We use an automated communications

solution 49%

Team members are manually contacted 49%

Other 2%

82% Confirmed Downtime Equals Revenue Risk

Almost Half of Companies Use Mass Notifications for Major Incidents

Less Than Half Use an Automated Communications Platform For Notification

For your company, does business application downtime have a significant impact on revenue?



Yes 82%

No 18%

No 18%Yes 82%

SURVEY


100% 68%

80%25%

15%

75%

85% 100%

Definitions and opinions vary widely across industries and

business areas, but they seem pretty well aligned within

individual companies. This is a promising trend because

aligned lines of business can only help companies resolve

major incidents faster.

Over 80% of respondents say IT and the business are

aligned on what constitutes a major incident. There is

even stronger agreement on the need for IT to keep the

business informed during a major incident.

In fact, executives accept that major incidents are a fact of

doing business, but they have no tolerance for being left in

the dark while incidents are happening.

In relating to the question about what constitutes a major

incident, nearly 100% of respondents said service outage

or security breach. But more than half of respondents also

included intermittent service outages, and a large minority

pointed to service degradation, a sign of lower tolerance

for anything below optimal service.

More than 75% of business stakeholders accept that major

incidents occur. In fact, they voice more frustration over

lack of communication during a major incident than they

do for the occurrence of a major incident.

Companies Do Have Areas of Agreement

82% Say IT and Business are Aligned

In your opinion are the IT teams and the business aligned on what constitutes a Major Incident?



Yes 82%

No 18%

No 18% Yes 82%

SURVEY


100% 68%

80%25%

15%

75%

85% 100%

For your company which of the following are considered Major Incidents?

Outages and Security Breaches Are Major Incidents, as is Basic Service Interruptions

42%

52%

95%

98%

0% 20% 40% 60% 80% 100% 120%

Performance degradation

Intermittent service availability

Security breach

Service outage

Outages and Security Breaches Are Major Incidents, as is Basic Service Interruptions

87% Stated The Business Must Be Informed During Major Incidents

For your company which of the following are considered Major Incidents?

Are business stakeholders and management OK with being kept completely in the dark until Major Incident is fully resolved?

Are business stakeholders and management OK with being kept completely in the dark until Major Incident is fully resolved?

87% Stated The Business Must Be Informed During Major Incidents

Yes, the business is willing to patiently wait

13%

No, the business demands regular status updates

87%

SURVEY


100% 68%

80%25%

15%

75%

85% 100%

IT departments have been concerned with major incident

management for many years, but it’s a new and maturing

area of focus for business leaders. As companies find their

own way and create their own definitions and processes,

it’s only natural that they won’t always agree.

By peeking behind the curtain, we learn that executives

have come to grips with the occurrence of major incidents,

but they insist on effective communication. Over the

next few years, we expect more definitions to become

standardized. Right now there is no one right way to

organize teams or resolve major incidents.

Hopefully these findings give you a look where you stand

in relation to your peers.

In your experience which of the following is more frustrating to the businessstakeholders?

Businesses are More Frustrated about Lack of Information Than the Actual Incident

The occurrence of a Major Incident

44%

Lack of timely communication during

the Major Incident. 56%

Businesses are More Frustrated about Lack of Information Than the Actual Incident

In your experience which of the following is more frustrating to the business stakeholders?

Lack of timely communication during

the Major Incident 56%

The occurrence of a Major Incident 44%

Conclusion

100% 68%

80%25%

15%

75%

85% 100% SURVEY


Methodology and ParticipantsCompanies Represented

Location

United States or Canada 80%

Europe 10%

Australia or New Zealand 2%

Asia 4%

Mexico, Central America, or South America

3%

Middle East or Africa 1%

Companies Represented

Size Industry

500 - 1,000 26%

1,000 - 5,000 36%

5,000 - 10,000 14%

More than 10,000 24%

7%

1%

2%

2%

3%

4%

5%

7%

9%

13%

16%

16%

16%

0% 5% 10% 15% 20%

Other

Hospitality

Non-profit

Telecommunications

Retail

Transportation

Energy and Utilities

Services

Education

Healthcare

Technology

Manufacturing

Financial Services

About UsContacts

xMatters’ cloud-based solutions enable any business process or application to trigger two-way communications (text, voice, email, etc.) throughout the extended enterprise during time-sensitive events. With over a decade of experience in rapid communication, xMatters serves more than 1,000 leading global firms to ensure business operations run smoothly and effectively during incidents such as IT failures, product recalls, natural disasters, dynamic staffing, service outages, medical emergencies and supply-chain disruption. xMatters is headquartered in San Ramon, CA with additional offices in London and Sydney.

CORPORATE HEADQUARTERS12647 Alcosta Blvd., Suite 425 San Ramon, CA 94583 USA | +1 877.XMATTRS (962.8877)

EMEA HEADQUARTERS20 Little Britain London, EC1A 7DH UK | +44 (0) 203 427 6326

APJ HEADQUARTERSLevel 29 Chifley Tower, 2 Chifley Square, Sydney, NSW 2000 AU | +61 2 9238 8023

Copyright 2016 xMatters. All rights reserved. All other products and brand names are trademarks or registered trademarks of their respective holders.

100% 68%

80%25%

15%

75%

85% 100% SURVEY

Role with IT

I am a front-line IT or technology professional 64%

I manage a team of IT or technology professionals

36%

About Dimensional ResearchDimensional Research® provides practical marketing research to help technology companies make their customers

more successful. Our researchers are experts in the people, processes, and technology of corporate IT and understand

how IT organizations operate. We partner with our clients to deliver actionable information that reduces risks, increases

customer satisfaction, and grows the business. For more information visit www.dimensionalresearch.com.

Participant Demographics

2016 survey report: major incident management trends

Documents