Enterprise Major Incident & Monitoring Communications in Banking

The Challenge

Managing Critical IT Communications Across a Global Banking Environment

Citi operates in a highly regulated, high-availability financial environment where operational downtime, delayed response, or missed communications can have significant business and compliance consequences.

Across a 250,000-user global deployment spanning NAM, APAC, and EMEA, Citi needed a communication platform that could integrate directly with its existing IT operational infrastructure, automate escalation, and provide full governance and auditability without compromising on security or deployment model.

Specifically, the organisation required:

• Automated Major Incident Management (MIM) communications triggered from ServiceNow
• Real-time monitoring event notifications routed to on-call engineers, with rota-based escalation and acknowledgement writeback
• A secure, on-premises deployment model
• 24/7 enterprise-grade support

Existing notification methods could not deliver this. They lacked automation, integration with ITSM workflows, rota-based escalation logic, and the governance controls required in a regulated financial environment. Separately, routine tasks such as deploying updated desktop wallpaper across the estate required IT change management processes and group policy updates, a cycle that could take over a year from approval to deployment.

The Solution

Heed worked with Citi to architect and implement a custom on-premises solution, integrated directly into Citi's IT operational infrastructure.

The platform supports four distinct communication workflows:

• Major Incident Management (MIM): automated notification workflows triggered by ServiceNow via Kafka
• Monitoring Event notifications: rota-based on-call alerting with acknowledgement writeback, integrated with Netcool via Tibco and Kafka
• Crisis communications: manually triggered desktop alerts and tickers to keep staff informed during live incidents
• Desktop wallpaper management: centralised deployment across the global estate without IT change requests or group policy updates

How It Works

Major Incident Management

When a major incident is raised in ServiceNow, the event is passed to Heed via Kafka. Heed immediately dispatches governed notifications to the relevant support teams, following defined escalation paths based on incident severity. All notifications are auditable, ensuring Citi can demonstrate compliance throughout the incident lifecycle.

Find out more about Heed's incident management solution.

Monitoring Event Notifications

Citi's event correlation system, Netcool, continuously monitors infrastructure across the global estate. When Netcool determines that a monitoring event requires human intervention, it passes the event to Heed via Kafka along with the relevant group name.

Heed resolves the on-call rota for that group and begins rotating through engineers, sending desktop alert notifications until the event is acknowledged. Once an engineer acknowledges, Heed writes that acknowledgement back into Netcool via Kafka, closing the loop without any manual intervention.

This bidirectional Kafka-mediated integration means Heed operates as a native part of Citi's operational toolchain rather than a separate notification bolt-on.

Crisis Communications

As Citi continues to expand its use of Heed, crisis communications has recently been brought into scope. During a live incident, communications managers can manually trigger desktop alerts and scrolling tickers to keep broader teams informed, providing real-time situational awareness beyond the immediate on-call group. This capability is actively being adopted across the organisation.

Find out more about Heed's crisis communication solution.

Desktop Wallpaper Deployment

Before Heed, deploying a new desktop wallpaper across Citi's global estate required IT change management approval and group policy updates, a process that could take well over a year. With Heed, wallpaper updates are deployed centrally through the platform with no GPO changes required, reducing deployment time from over a year to a matter of weeks.

Scale

• 250,000 desktop client deployments globally
• ~10,000 notifications delivered per month
• Coverage across NAM, APAC, and EMEA
• 24/7/365 enterprise support SLA

Governance & Compliance

As a global financial institution, Citi required strict governance controls across all notification workflows. Heed's on-premises deployment model ensures all data remains within Citi's own infrastructure. Structured approval layers, severity-based SLA response frameworks, and full notification auditability allow Citi to demonstrate compliance with internal governance requirements and external regulatory expectations.

The Impact

• Major incident communications fully automated and integrated with ServiceNow, eliminating manual notification overhead
• On-call engineers alerted and escalation active within seconds of a Netcool monitoring event
• Acknowledgements written back to Netcool automatically, removing manual status updates between systems
• Around 10,000 notifications delivered per month across three global regions
• Crisis communications capability now being rolled out, giving incident managers real-time broadcast reach across the organisation
• Desktop wallpaper deployment reduced from over a year to weeks, with no IT change requests or group policy updates required