How can I better prioritize IT issues?

Prioritizing IT issues while managing business operations can be overwhelming. Technology touches everything, so facing business challenges and issues means assessing their technical impact and their current and potential impact on operations. 

Part I:  The Quick Method For Prioritizing IT Issues 

Business Impact: How many people is this affecting right now? 

Urgency:  What is the impact of this issue now?  Is this issue likely to get worse without immediate attention?  Is there a reasonable workaround while it’s getting fixed?

Putting Business Impact & Urgency Together:

• Low - Schedule for Later
• Medium - Schedule Soon
• High - Do Today
• Critical - All Hands On Deck

Considerations When Evaluating IT Issues:

Security Breaches or Vulnerabilities: Any IT issue related to a security breach, potential breach, or vulnerability should be considered critical, regardless of who in your organization it affects.  Given the potential damage to the business (data loss, fines, reputation damage), expediency is key.

• Critical Priority: Data breaches, ransomware attacks, and security patching for critical systems.
• High Priority: Vulnerability scanning issues, and weak access controls.
• Medium / Low Priority: Minor permission issues, non-sensitive account management.
   

Criticality: Prioritize issues that directly impact core business processes (payment systems down, customer service interruptions).

• High Priority: Systems affecting revenue (e-commerce, payment processing, etc.) or customer service.
• Medium Priority: Internal operations or support functions (HR systems, email, main customer service phone line).
• Low Priority: Non-essential systems (e.g., an employee-facing app, printer/copier).
   

Consider the Number of Users Affected:  How many employees, customers, or systems are affected by the issue? The larger the impact, the higher the priority.
 

Downtime and Business Continuity: Consider how long the business can operate without resolving the issue.  IT Issues that would result in revenue loss or client dissatisfaction should be addressed first.  

Worsening Impact:  If not fixed, will the issue get progressively worse or widespread?   If it’s not a high priority right now, but could become a critical issue if it worsens, treat the issue as a high priority.   
 

Compliance and Regulatory Requirements:  If the issue affects compliance with industry regulations (e.g., GDPR, HIPAA), it should be prioritized higher to avoid legal and financial repercussions or data compromises.
 

Urgency & Time Sensitivity: Is this routine maintenance that could wait or be scheduled for later?  Is there a deadline for this issue that would result in a business function or application going down?  
 

Cost of Fixing vs. Cost of Not Fixing: Evaluate the financial implications of both resolving and not resolving the issue. Consider the potential loss of revenue, productivity (both time and product loss), or customers.
 

Frequency of Occurrence:  If an issue occurs repeatedly, it should be prioritized higher, as it may indicate a systemic problem that could lead to larger disruptions.
 

Availability of Workarounds (Temporary Solutions):  If a workaround is available, the issue can be deprioritized temporarily. If no workaround is possible, the issue should be addressed sooner. Workarounds such as using cell phones instead of desk phones to call internally may be acceptable while using cell phones for customer calls may not be.  
 

Strategic Importance & Business Goals: If the issue aligns with long-term business goals or strategic initiatives (e.g., digital transformation, scalability improvements), it should be prioritized accordingly.