Browse Definitions :

triage in IT

What is triage in IT?

Triage is a term referring to the assignment of priority levels to tasks or individuals to determine the most effective order in which to deal with them.

Triage originated in a military medical context and is now widely used in information technology (IT) and business environments, where it is an integral part of business process management (BPM). An IT operations department constantly triages issues to decide which problems are most urgent.

How triage in IT works

The fundamental steps in triaging an IT incident vary. However, the basic process involves the following steps:

  1. Assessment. The initial assessment of the incident identifies the problem.
  2. Categorization. The incident is categorized in terms of the type of incident and the severity.
  3. Prioritization. It's placed in the remediation lineup according to its severity rating and overall importance to the business operations and functionality.
  4. Assignment. The appropriate person is assigned to fix the issue.
  5. Closure. A report is filed on the incident.
Checklist of what's needed for an incident response plan
Triage capabilities are an important part of an overall incident response process.

Triage can be handled manually in situations where the volume of incidents is relatively small. In larger organizations and environments where there are lots of incidents, specialized trouble-ticket systems automate the triage process. Systems such as Atlassian's Jira can be programmed to assign severity levels and route tickets to specific IT staff.

Why triage is important?

IT departments face a number of problems each day. As a result, management must prioritize issues that present the greatest threat to the organization's ability to conduct its business and serve customers.

Establishing levels of severity in relation to the overall business and identifying the severity level of each item early in the process ensure the most important problems are solved first. Linking the triage process to the employees who have the requisite skills to address specific issues also moves the process along.

Typically, IT departments have a multilevel triage arrangement. For example, tier 1 issues are the simplest, least critical and easiest to fix. As such, they can be assigned to anyone on the IT staff. They can also wait longer to be acted on.

Incidents rated tier 2 or tier 3 are more complex and significant in their impact on IT and business operations. They must be addressed faster and require a higher level of experience and expertise from the technicians and engineers assigned to them.

Steps to establishing a triage capability

Establishing a triage capability requires addressing the roles of triage, how it will operate, the levels of severity, the need for automated triage technology and funding. Additional characteristics to consider for a triage process include the following:

  • Types of events. Clearly identifying what events are covered by the system is critical. These can range from simple password resets to enlisting software engineering teams to troubleshoot complex system issues.
  • Skill levels. IT help desks must have several levels of expertise, from employees with limited skills to those with years of experience.
  • Channels of support. Identifying who helps with certain issues beyond IT personnel is important. These can include vendors, carriers, consultants and others with the expertise and resources to support remediation.
  • Communications. Standard ways of communicating must be established among team members, employees, vendors and other relevant entities.
  • Service-level agreements (SLAs). The requirement and performance metrics of all existing SLAs with both customers and vendors must be factored into the triage process.

Examples of triage in IT

Triage is used in various ways in IT, including the following:

  • IT operations. Top-priority issues must be dealt with as they arise. Less important issues are attended to when no top-priority issues remain. However, that time might never come, and the least urgent problems might never be dealt with unless they are reassessed at a higher-priority level.
  • Email. Messages are designated as urgent when they need an immediate response, less important messages are deferred to a specified future time and others are simply deleted. Email triage applications and mobile apps are available to facilitate the process.
  • Agile software development (ASD). Development team requirements are typically triaged at the start of each iteration. An ASD iteration is a short development cycle, so it's crucial to deal with high-priority requirements quickly to ensure that they are fixed for the next iteration.
  • Software testing. Bug triage identifies the code errors that need immediate attention and those that can wait. Bug reports found in software testing that are assessed as low priority might be tolerated indefinitely.

Why automated triage is preferred

In a busy data center, help desks handle hundreds of trouble tickets daily, addressing a number of defects and issues. Automated systems streamline the ticket process and increase help desk efficiency.

These automation systems collect data on the root cause of an event and assign testers or a testing team to analyze it. They provide useful performance data, such as how long it takes to process a ticket to completion and how many triage team members were needed to resolve specific issues. This data is important for use by business analysts and project managers to project staffing needs and secure resources to remediate incidents in a timely fashion.

By contrast, a manual ticketing triage system is prone to human error. Tickets can easily be assigned to someone not trained in the issue or forgotten altogether.

The history of triage

The term triage comes from the French verb trier, meaning to separate out or to sort.

It was first used for medical purposes during World War I, when it referred to the way medics prioritized the treatment of soldiers wounded in battle. Triage is still used in healthcare today, particularly in emergency rooms, to determine the order of treatment for patients.

The term was adopted for business purposes in the 1990s as a way to allocate limited budgetary and other resources to competing needs. IT managers and administrators use the term both as a way to allocate limited general resources and as a methodology for deciding what issues to fix first when systems have multiple problems at the same time.

Learn everything you need to know about incident response plans, teams and tools.

This was last updated in March 2023

Continue Reading About triage in IT

  • subnet (subnetwork)

    A subnet, or subnetwork, is a segmented piece of a larger network. More specifically, subnets are a logical partition of an IP ...

  • Transmission Control Protocol (TCP)

    Transmission Control Protocol (TCP) is a standard protocol on the internet that ensures the reliable transmission of data between...

  • secure access service edge (SASE)

    Secure access service edge (SASE), pronounced sassy, is a cloud architecture model that bundles together network and cloud-native...

  • cyber attack

    A cyber attack is any malicious attempt to gain unauthorized access to a computer, computing system or computer network with the ...

  • digital signature

    A digital signature is a mathematical technique used to validate the authenticity and integrity of a digital document, message or...

  • What is security information and event management (SIEM)?

    Security information and event management (SIEM) is an approach to security management that combines security information ...

  • product development (new product development)

    Product development -- also called new product management -- is a series of steps that includes the conceptualization, design, ...

  • innovation culture

    Innovation culture is the work environment that leaders cultivate to nurture unorthodox thinking and its application.

  • technology addiction

    Technology addiction is an impulse control disorder that involves the obsessive use of mobile devices, the internet or video ...

  • organizational network analysis (ONA)

    Organizational network analysis (ONA) is a quantitative method for modeling and analyzing how communications, information, ...

  • HireVue

    HireVue is an enterprise video interviewing technology provider of a platform that lets recruiters and hiring managers screen ...

  • Human Resource Certification Institute (HRCI)

    Human Resource Certification Institute (HRCI) is a U.S.-based credentialing organization offering certifications to HR ...

Customer Experience
  • contact center agent (call center agent)

    A contact center agent is a person who handles incoming or outgoing customer communications for an organization.

  • contact center management

    Contact center management is the process of overseeing contact center operations with the goal of providing an outstanding ...

  • digital marketing

    Digital marketing is the promotion and marketing of goods and services to consumers through digital channels and electronic ...