Incident management
Restore service fast when something breaks, the most-used process in ServiceNow.
Incident Management is the flagship ITSM process and where most people first meet ServiceNow. Its ITIL goal is precise: restore normal service operation as quickly as possible and minimise business impact, while keeping users informed. It is deliberately about speed of restoration, not root cause; that is Problem Management's job.
- What an incident is (and isn't)
- Priority is derived, not typed
- The lifecycle
- Major incidents
- How incident connects to everything else
Incident Management is the flagship ITSM process and where most people first meet ServiceNow. Its ITIL goal is precise: restore normal service operation as quickly as possible and minimise business impact, while keeping users informed. It is deliberately about speed of restoration, not root cause; that is Problem Management's job.
What an incident is (and isn't)
An incident is an unplanned interruption or degradation of a service. It lives on the incident table, which extends task, inheriting number, assignment group, state and priority, and adding caller, category, impact, urgency, resolution code/notes. Crucially, a request for something new is not an incident, it belongs in the Service Catalog.
Priority is derived, not typed
Agents don't pick priority directly, it is calculated from a Priority lookup of Impact x Urgency, keeping prioritisation consistent org-wide:
The mapping is a Priority Data Lookup table you can tune per organisation.
The lifecycle
State movement is governed by UI/data policies and business rules (e.g. resolution notes become mandatory at Resolved), and timers are tracked by SLAs.
Major incidents
How incident connects to everything else
- A recurring incident feeds Problem Management to find root cause.
- A fix that changes production requires a change.
- A known fix is captured as a knowledge article to deflect the next one.
- An Event Management alert can open incidents automatically.
Common mistakes
- Using incidents for service requests, those belong in the catalog.
- Letting agents override priority instead of setting impact/urgency correctly.
- Resolving without a resolution code, so trend reporting is useless.
- No MIM process, so major outages are coordinated over ad-hoc chat.
Authoritative sources
- ServiceNow Incident Management docs - Incident application reference
- ITIL 4 (Axelos) - Incident-management practice definition
Practice challenge
FAQ
What is ITSM in ServiceNow?
ITSM (IT Service Management) is ServiceNow's original and best-known set of applications for running IT as a service: incident, problem, change, request and knowledge management, all on one workflow engine and data model.