ITIL, as I use it

Not the book. The four practices that decide whether a major incident is run, or just suffered. Then a card, then a check.

The map

Incident
Restore the service. Tell the truth on a clock. The mistake is investigating the cause while customers are still down.
Problem
Stop the same failure coming back. The mistake is a new incident every time, and nobody owning the cause.
Change
The controlled way something new reaches production. The mistake is an emergency change with no rollback and no record.
Continuity
What you do when the primary path is gone. The mistake is a document nobody has rehearsed.

ITIL 5, for the room

ITIL 5 does not replace the bridge. The practices are still incident, problem, change and continuity. What it asks, and what ITIL 4 teams skip, is whether the number you report is the number the business feels, whether those four practices share one set of facts, and whether someone owns the outcome after the bridge closes. Mean time to restore is not the whole story if customers were in the dark for most of it.

This is my reading, from running the room. It is not PeopleCert’s text.

Cheat sheet

Visible here. Download it for a team drill.

Download practice card

Xavier Bennet · major incident

Before the first bridge

1Declare when customer impact is real, or when you cannot rule it out in minutes. Do not wait for a perfect severity.
2One bridge. One incident commander. Everyone else contributes. They do not chair.
3First update: impact, what we are doing, next clock. No cause.
4The next update is a time, not “soon”.
5Freeze further change unless it is the restore.
6A second occurrence is a problem, not another incident with the same title.
7Emergency change still needs a rollback and a record.
8A post-incident review without an owner and a date did not produce an action.
9If the crisis or DR path has not been spoken out loud this year, you do not have one.

The empty templates: P1 comms · Crisis brief · Post-incident review

Would this survive a review?

Twelve questions. Yes or no, for the team you actually have. This does not certify anyone. It is what I would ask in the first hour.

0 of 12 answered

Incident

Someone is named incident commander before the bridge fills up.
The first update to customers or executives has a clock, not the word “soon”.
Further change is frozen unless it is the thing that restores service.

Problem

A failure that has happened twice has a problem record, not just another incident.
That problem has a named owner and a date. It is not a parking lot.
Actions from the last post-incident review were checked after the meeting.

Change

A change that can take the service down has a rollback someone has actually tried.
Emergency change is still recorded, including who approved it.
When a change causes an incident, the two records point at each other.

Continuity

You have a written order for which services you would restore first.
Someone who is not on the day-to-day bridge has rehearsed the crisis or DR brief in the last year.
Executives and the bridge are looking at the same three facts: impact, action, next clock.

Answer all twelve. The result stays on this page. Nothing is sent or stored.