Operational Procedures

Ticketing system

A system used to document, assign, track, resolve, and report technical issues.

Triage (ticketing system)

The process of prioritizing and categorizing tickets based on urgency and impact.

Initial support ticket information

User information, device information, and a description of the problem.

Post-gathering ticket assessment

Determining category, severity, and whether escalation is required.

What does ticket category refer to?

The task being performed or problem being solved.

Ex:

• Change request

• Hardware request

• Problem investigation

• Hardware failure

• Onboarding/offboarding

Ticket severity levels

Low, medium, high, and critical.

Escalation

Handing a difficult, unique, or specialized problem to another support tier or specialist.

Progress notes (ticket)

Documentation of troubleshooting steps, changes, and additional information gathered while resolving an issue.

What is listed in problem-resolution documentation?

The exact solution so it can be referenced if the problem occurs again.

Standard Operating Procedure (SOP)

Documented instructions on how specific organizational tasks should be performed.

Why are standard operating procedure checklists?

So critical, but sometimes less frequently performed tasks like managing finances and security are done properly.

Configuration Management Database (CMDB)

A database that records configuration items and their relationships.

Inventory list

A record of hardware and software assets including equipment types, quantities, and identifying information.

CMDB vs. inventory list

A CMDB (Configuration Management Database) focuses on configuration items and their relationships, whereas an inventory list records organizational assets.

What is the procurement life cycle

The end-to-end process used to request, approve, acquire, and distribute IT equipment.

Incident report

Documentation describing what led to an incident, what happened, and how the organization responded.

Onboarding

The process of preparing a new employee with accounts, policies/agreements, access, and hardware.

Offboarding

The process of handling an employee's accounts, data, access, and hardware when they leave an organization.

Service Level Agreement (SLA)

An agreement defining the expected level of service between a service provider and customer.

SLA scope (internal vs. external)

SLAs may exist internally between departments or externally between an organization and a third-party provider.

Key components of an SLA

• Expected service levels

• Allowable downtime

• Issue-resolution expectations

• Customer responsibilities

Internal knowledge base

A searchable collection of institutional knowledge about an organization's systems and resources.

External knowledge source

Documentation from outside an organization regarding the IT products or resources being used.

Change management

A controlled process for planning, evaluating, implementing, and potentially reversing changes to IT systems.

Primary goal of change management

To reduce risk and avoid unnecessary downtime or disruption.

What is a change request?

A formal request documenting a proposed change to IT systems.

Key factors in evaluating a change request

Purpose, scope, schedule, consequences, and risk.

What are different purposes of a change?

• Adding features

• Fixing bugs

• Improving performance

• Improving security

Scope of a change

The systems, users, services, and other resources that may be affected by the change.

Importance of scheduling in change management

Allows changes to occur during appropriate windows to minimize disruption and downtime.

Change window

A scheduled period during which changes are permitted or planned.

What is a change freeze?

A period during which changes are restricted or prohibited.

Rollback plan

Procedures for returning a system to its previous working configuration if a change fails.

Purpose of a rollback plan prior to change implementation

Ensures the original configuration can be quickly restored if the change causes unforeseen problems.

Sandbox testing

Testing a change in an isolated environment before deploying it to production.

Purpose of using a sandbox

To identify problems and bugs without affecting production systems or active users.

Standard change

A common, low-risk, pre-approved change.

Normal change

A non-emergency change that must follow the standard change-management process.

Emergency change

An urgent change that must be implemented quickly, often to address a serious problem or vulnerability.

Risk analysis (change management)

Evaluating both the risks of implementing a change and the risks of not making it.

Full backup

A backup containing all selected data.

Differential backup

A backup containing all data changed since the most recent full backup.

Differential backup restoration requirements

The most recent full backup plus the most recent differential backup.

Incremental backup

A backup containing data changed since the most recent backup (full or incremental).

Incremental backup restoration requirements

The initial full backup plus all subsequent incremental backups in the chain.

Differential vs. incremental backup

Differential backs up all changes made since the last full backup; incremental backs up only changes made since the most recent backup of any type.

Synthetic full backup

A full backup created by combining existing backup data rather than pulling a full copy directly from the source system.

Backup testing

Verifying that backed-up data can be successfully restored.

In-place / overwrite recovery

Restoring data directly over the original data or system files.

Alternative-location recovery

Restoring a backup to a destination other than its original location.

Advantage of onsite backup

Fast local data availability without requiring an Internet or WAN connection.

Advantage of offsite backup

Preserves data availability even if a physical disaster impacts the primary site location.

Benefit of combining onsite and offsite backups

Onsite backups provide fast, convenient local recovery, while offsite backups protect against site-wide disasters.

Grandfather-Father-Son (GFS) backup rotation

A rotation strategy using monthly (Grandfather), weekly (Father), and daily (Son) backup generations.

Grandfather (GFS rotation)

Monthly backups.

Father (GFS rotation)

Weekly backups.

Son (GFS rotation)

Daily backups.

3-2-1 backup rule

Keep 3 total copies of data on 2 different media types, with 1 copy stored offsite.

Static electricity

An imbalance or accumulation of electrical charge on the surface of an object.

Electrostatic discharge (ESD)

The sudden transfer of static electrical charge between two objects.

Danger of ESD to computers

It can permanently damage sensitive electronic components.

Environmental factor increasing ESD risk

Low humidity.

Antistatic wrist strap

A device used to safely dissipate accumulated static charge while working with electronic components.

Examples of antistatic equipment

Wrist straps, mats, pads, and antistatic bags.

Proper component handling for ESD prevention

Hold components by their outer edges and utilize proper ESD protection equipment.

Importance of cable management

Reduces trip hazards, maintains organization, and prevents cable damage or disconnection.

Safety precaution before servicing electrical hardware

Follow established safety procedures and completely disconnect or remove power.

Computer equipment with high voltage hazards

Power supplies, displays, laser printers, and components containing charged capacitors.

Electrical grounding

Provides a safe dissipation path for electrical current, reducing the risk of shock and equipment damage.

Extinguishing an electrical fire

Use an extinguisher specifically rated for electrical fires (Class C); never use water on energized equipment.

Use of safety goggles in IT

Required when working around chemicals, toner, battery acid, or flying debris.

When should you use a protective mask in IT?

When working in environments with excessive dust or airborne printer toner.

Safety Data Sheet (SDS)

A document containing detailed safety and hazard information regarding chemicals or hazardous materials.

Former name of Safety Data Sheet (SDS)

Material Safety Data Sheet (MSDS).

IT materials requiring SDS (safety data sheet)

Batteries, displays, and printer toner.

Key contents of a Safety Data Sheet (SDS)

Product/manufacturer info, chemical composition, hazards, first-aid measures, fire-fighting procedures, and safe handling guidelines.

Proper disposal of batteries and toner

Follow applicable recycling regulations, hazardous-waste protocols, manufacturer guidelines, and local law.

Importance of IT equipment ventilation

Prevents excessive internal heat buildup and hardware overheating.

Risk of extremely low humidity

Significantly increases the likelihood and accumulation of electrostatic discharge (ESD).

Risk of excessively high humidity

Promotes moisture condensation and component corrosion.

Uninterruptible Power Supply (UPS)

A device that provides continuous backup power and power conditioning during power outages or fluctuations.

Three main types of UPS

Standby, line-interactive, and online.

Surge suppressor

A device designed to absorb excess electrical energy and protect equipment from sudden voltage spikes.

What does a higher Joule rating of a surge protector mean?

A higher rating indicates a greater capacity to absorb energy spikes before failing.

How should let-through voltage in a surge protector be set up?

Lower voltage is better, as it means less excess voltage reaches connected equipment.

Chain of custody

A documented chronological record showing the collection, control, transfer, analysis, and disposition of evidence.

Importance of chain of custody

Preserves and proves the integrity, security, and traceability of legal evidence.

First-response actions during an incident

Identify the issue, report it through designated channels, and protect/collect relevant evidence.

What is a hardware write blocker?

When is it used?

A device that prevents write commands from altering original drive storage.

Used during forensic imaging.

What kind of copy is performed for forensic drives?

A bit-for-bit (forensic image) copy.

Purpose of hashing digital evidence

To verify data integrity and confirm that the evidence has not been altered or tampered with.

Primary priority when copying digital evidence

Preserving the integrity and originality of the target source data.

In what order is digital evidence collected?

It must be collected in order based on how rapidly the data disappears or changes.

Software license

A legal agreement outlining the terms, conditions, and permissions governing software usage.

Per-seat license

A licensing model assigned to an individual named user or specific computer seat.

Concurrent licensing model

A model permitting a maximum specified number of active users to share licenses simultaneously from a pool.

Personal software license

A license intended solely for non-commercial, personal, or home use.

Corporate-use license

A license granting permission for organizational or commercial business operations.

Perpetual license

A license granting indefinite use of a specific software version without ongoing subscription fees.

Free and Open Source Software (FOSS)

Software whose license grants access to its source code along with rights to inspect, modify, and redistribute it.