Live incident // INITIATE
The Unopened Door
Access request to an internal vendors space. The requester claims not to know the link, but the record shows the link found its way to them.
Documented decision
01 / 03
Evidence coverage0%
Documented decisions0/3
Draft impactNot set
Incident frame
The support team received an alert: a temporary employee opened a vendors space link. This employee does not have the vendors role and says they did not know the space name or link.
Examine the trail first. Identify what should be contained and what should be preserved before interpreting intent or blaming someone.1
EvidenceOpen these items first
2
DraftChoose an option after reviewing evidence
3
DocumentDocument decision and continue
Decision 01Evidence still required
Preserve the incident
What is the first action before interpreting the user's intent?
Open these items first: Access log
Current draftChoose an option after reviewing evidence