Incident management
Quick answer
Incident Management is the flagship ITSM process and where most people first meet ServiceNow. Its ITIL goal is precise: restore normal service operation as quickly as possible and minimise business impact, while keeping users informed. It is deliberately about speed of restoration, not root cause; that is Problem Management's job.
Key takeaways
- What an incident is (and isn't)
- Priority is derived, not typed
- The lifecycle
- Major incidents
- How incident connects to everything else
Incident Management is the flagship ITSM process and where most people first meet ServiceNow. Its ITIL goal is precise: restore normal service operation as quickly as possible and minimise business impact, while keeping users informed. It is deliberately about speed of restoration, not root cause; that is Problem Management's job.
What an incident is (and isn't)
An incident is an unplanned interruption or degradation of a service. It lives on the incident table, which extends task, inheriting number, assignment group, state and priority, and adding caller, category, impact, urgency, resolution code/notes. Crucially, a request for something new is not an incident, it belongs in the Service Catalog.
Priority is derived, not typed
Agents don't pick priority directly, it is calculated from a Priority lookup of Impact x Urgency, keeping prioritisation consistent org-wide:
The mapping is a Priority Data Lookup table you can tune per organisation.
The lifecycle
State movement is governed by UI/data policies and business rules (e.g. resolution notes become mandatory at Resolved), and timers are tracked by SLAs.
Major incidents
How incident connects to everything else
- A recurring incident feeds Problem Management to find root cause.
- A fix that changes production requires a change.
- A known fix is captured as a knowledge article to deflect the next one.
- An Event Management alert can open incidents automatically.
Common mistakes
- Using incidents for service requests, those belong in the catalog.
- Letting agents override priority instead of setting impact/urgency correctly.
- Resolving without a resolution code, so trend reporting is useless.
- No MIM process, so major outages are coordinated over ad-hoc chat.
Want to learn this properly?
Our live, instructor-led ServiceNow Training covers this hands-on, with real projects and a certification path.
Check your understanding
Priority in ServiceNow is derived from which two fields?
- A. Impact and urgency
- B. Category and state
- C. Caller and group
Show answer
A. Impact and urgency
The priority matrix multiplies impact by urgency.
Which state means work is paused waiting on the caller or a vendor?
- A. Resolved
- B. On Hold
- C. New
Show answer
B. On Hold
On Hold pauses the incident clock while you wait.
An incident is best described as:
- A. A request for new hardware
- B. An unplanned service interruption
- C. A scheduled change
Show answer
B. An unplanned service interruption
Incidents are unplanned interruptions to service.