Definition

What is Incident Management?

Incident management is the IT process of detecting, logging, classifying, resolving, and closing unplanned disruptions to IT services - restoring normal service operation as quickly as possible while minimising impact on the business.

- ITIL Incident Management - Complete Guide

An incident is any unplanned interruption to an IT service or reduction in its quality - a server going down, an application becoming unavailable, or a user being unable to access a critical system. Incident management provides the structured process for responding to these events consistently and efficiently.

In ITIL, incident management is one of the core service operation processes, distinct from problem management (which finds root causes) and change management (which controls planned changes).

Processes

Incident Management Process - 7 Steps

ITSM is not a single process - it is an interconnected set of disciplines that govern how IT services are delivered, maintained, and improved across the organisation.

Detection

Detection

Incident identified - via monitoring alert, user report, or automated event

Logging

Logging

Incident recorded in the service desk with all available details

Classification

Classification

Incident categorised by type, urgency, and impact to determine priority

Assignment

Assignment

Routed to the appropriate team or individual based on category and skill

Investigation

Investigation

Root cause diagnosed and workaround or fix identified

Resolution

Resolution

Service restored - fix applied or workaround implemented

Closure

Closure

Incident closed after user confirmation, record updated with resolution details

Comparisons

Incident vs Problem vs Change

TermWhat it manages
Incident An unplanned disruption to a service - focus is on restoring service quickly
Problem The underlying root cause of one or more incidents - focus is on permanent elimination
Change A planned modification to the IT environment - focus is on controlled implementation
Realtionship Incidents trigger problem investigations; problems may result in change requests
Metrics

Incident Management Metrics

01

Mean Time to Detect (MTTD)

Average time from incident occurrence to detection

→
02

Mean Time to Acknowledge (MTTA)

Average time from detection to assignment

→
03

Mean Time to Resolve (MTTR)

Average time from detection to full service restoration

→
04

First Call Resolution (FCR):

Percentage of incidents resolved at the first point of contact

→
05

SLA compliance rate

Percentage of incidents resolved within defined service level targets

→
FAQ

Frequently Asked Questions

A major incident is a high-impact, high-urgency incident that causes significant disruption to critical business services. Major incidents typically require a dedicated response team, a separate communication channel, and a post-incident review (PIR) after resolution.
Incident management focuses on restoring service as quickly as possible - the immediate response. Problem management focuses on finding and eliminating the root cause to prevent the incident from recurring. An incident is the symptom; the problem is the underlying cause.
An incident response calculator estimates the cost and time impact of IT incidents based on factors like affected users, hourly business cost, and average resolution time. It helps IT leaders quantify the business value of improving incident management processes.
An SLA (Service Level Agreement) in incident management defines the target response and resolution times for incidents based on their priority. For example, a P1 critical incident might have a 15-minute response SLA and a 4-hour resolution SLA, while a P3 low-priority incident might have a 4-hour response and 5-day resolution target.
The ITIL incident management process follows 7 steps: (1) Detection - the incident is identified via monitoring alert, user report, or automated event; (2) Logging - the incident is recorded in the service desk with all available details; (3) Classification - categorised by type, urgency, and impact to determine priority; (4) Assignment - routed to the appropriate team or individual; (5) Investigation - root cause diagnosed and workaround or fix identified; (6) Resolution - service restored by applying the fix or workaround; (7) Closure - incident closed after user confirmation and the record updated with resolution details.
Incident management tools are IT Service Management (ITSM) platforms that centralise the detection, logging, routing, resolution, and tracking of IT incidents. Key features to look for include automated ticket creation from monitoring alerts, SLA tracking and escalation, priority-based routing, a knowledge base for known fixes, real-time dashboards for MTTR and FCR metrics, and integration with monitoring and communication tools. Examples include ITSM platforms like Infraon, ServiceNow, and Jira Service Management.