Review the incident record.  Collect information from all available sources.  Examples include configuration information, change information, problem information, the requestor, etc.

Obtain any information needed to determine how to resolve the incident. This may or may not involve understanding the root cause of the incident. The primary objective is restoring service or restoring the affected CIs.

Diagnose the incident to determine what went.  This may involve recreating what went wrong.  However, this may not always be possible.

Review, validate and update Incident details as needed and action as appropriate including:

• notifying stakeholders
• initiating parallel activities, such as engage additional support groups, including third party suppliers