10 Ways to Manage Major IT Incidents

Every business has the potential to experience an IT incident. Whether it’s a natural disaster, human error, or a cyberattack, there are many factors that can lead to your technology going offline.

An IT incident can be detrimental to your company if not managed quickly and efficiently. It’s important to understand how you will address these challenges before they occur, so you are prepared in the event of an emergency.

If you are reading this post, chances are you have experienced an IT incident at some point or another in your career. Even with the best technology in place, computers break, files get corrupted, and emails go missing all the time.

Here are 10 tips on how to manage major IT incidents and recover from them as quickly as possible:

1. Have a Game Plan Beforehand

Before a major incident occurs, it is important to have a game plan in place. Establish a chain of command that outlines who will be responsible for what tasks, who will have access to what resources, and what your communication protocols are.

This will help you effectively respond to any major incident. In addition to your chain of command, it’s also helpful to have a major incident plan that outlines standard procedures and protocols for different types of incidents.

Download our free Incident Response Plan template to get started. 

2. Assign a Point Person to Manage Incidents

One of the most critical aspects of managing a major incident is communication. It is important to assign a point person to oversee the communication efforts during the incident. This person will be responsible for communicating with all teams, customers, and stakeholders relating to the incident.

3. Hold a Crisis Meeting Immediately

It is important to have an immediate crisis meeting so you can address the fears of your employees and customers. You will want to communicate the following with your employees: What happened, how long it will take to fix, how long it will take to restore any lost data, and what steps you are taking to ensure the problem does not happen again.

4. Track Down the Root Cause of the Incident

During the crisis meeting, you will want to determine the root cause of the incident so it does not happen again. You may have a team focused on restoring data, but they cannot work until they know what data they need to restore.

You will also want to make sure that your employees do not have to reset their passwords because they are locked out of their accounts.

5. Know Which Files Have Been Lost and by Whom

As soon as you know what data has been lost, it is important to know which files have been lost, who lost them, and where they were stored. This will help you prioritise which data to restore first so that your employees can get back to work as soon as possible.

It is also helpful to know who lost the data so you can follow up with them to make sure they did not lose any other files. It is important to know where the data was stored so you can look for the cause of the issue.

6. Ask your Employees What Is Most Important to Them

While you are prioritising which data to restore, it is important to ask your employees what is most important to them. If they have been impacted by the incident and their data has been lost, they may need to start from scratch.

For example, they may have been working on a very important project that was stored on the server that was impacted by the incident. In this situation, it would be helpful if you could restore that data before starting from scratch again.

7. Repurpose Content That Was Lost in an Incident

While you are prioritising which data to restore, you may find that you do not have enough time to restore everything. In this situation, you may decide to repurpose existing content, so your employees can get back to work quickly.

For example, if you have a blog post that has been lost in the incident, you can repurpose the blog post as a social media post. You can repurpose blog posts as tweets, Facebook posts, emails, etc. This will allow your employees to get their message out to customers without having to wait for you to restore certain data.

8. Ask Users to Temporarily Change Their Passwords after an Incident

In some situations, you may discover that certain employees accidentally lost data. You may also find that some employees may have maliciously lost data.

In either situation, you may need to track down which employees were responsible for the lost data and have those users change their passwords. Doing this will help you track down the cause of the incident.

After the password change has been completed, you can then reset the password back to what it was.

9. Document Everything

As an IT manager, you need to be prepared for an IT incident to occur at any time. It is important to document everything that happens throughout the incident so you can refer back to it later.

This includes the following: Who you talked with, what they told you when certain events occurred, what you were doing at each point in the incident, what decisions you made, and what the results were.

You may think that some of these things are obvious, but it is easy to forget what you did during an incident. It is also helpful to take notes on your computer or tablet so you can quickly refer back to them.

10. Be Proactive

While you are managing major IT incidents, it is also important to take steps to prevent future incidents from occurring. You can do this by identifying the cause of the incident and then taking steps to prevent it from happening again.

For example, if an employee accidentally deleted files from the server, you can set up policies and procedures to prevent other employees from making the same mistake. Likewise, if you discover that employees are maliciously deleting data, you will want to take steps to stop them from doing so.

By taking these steps, you can prevent future incidents from occurring and having a major impact on your organisation.