---
sourceDocument: Australia IT Service Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/it-service-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Service Management

ft:clusterId :

    - itsm

bundleId :

    - itsm

workflow :

    - Technology


---

# Major Incident Management process

# Major Incident Management process {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
A major incident is a highest-impact, highest-urgency incident that affects a large
number of users, depriving the business of one or more crucial services. Given the urgency of
the situation, a well-coordinated response process is required to accelerate the resolution and
minimize the business impact.  
The goal of an organization is to have an effective and efficient system for responding to major incidents. The requirements are to:

* Minimize the impact of service interruptions.
* Ensure that an appropriate Incident Manager/Major Incident Team/Management Group are in place to manage a major incident.
* Ensure that stakeholders are well-informed of service interruptions, degradations, and resolutions.
* Conduct a review of each major incident once service is restored. Its purpose is to analyze the incident, and understand what can be done to prevent a similar incident in the future. This review also provides an opportunity to evaluate the incident response process and identify areas for improvement.
* Create a problem for root cause analysis.
{#major-incident-management-process__ul_qqr_sy2_ndb}  
Keeping the goals in mind, a major incident management process can be broadly classified into the following phases:

Identification
:   The first step in the process is to identify a potential major incident. A potential
    major incident can be identified automatically based on trigger rules or an existing
    incident can be proposed as a major incident candidate. These incidents are classified
    as major incident candidates and are reviewed by major incident managers who initiate
    the major incident response process.

Communication and Collaboration

:   Timely communication during a major incident is crucial to ensure that the IT teams, business stakeholders, end users, and customers are informed about the impact and progress of the incident. An occurrence of a major incident requires a comprehensive communication plan that includes who is contacted, the methods and frequency of communication, messaging, and so on. The communication plan enables the incident response team to focus their efforts on the resolution process and sets expectations for any future communications.You can define one or more communication plans based on the
    type, priority of the incident, or the target audience. For example, communication
    plans for a P1 major incident could have more frequent communication than a
    communication plan for a P2 major incident.

    Throughout the life cycle of the
    major incident, notifications and status updates are sent to the stakeholders to keep
    them informed and involved.

Resolution
:   In this phase, the agreed upon path to resolution is followed to resolve the issue.
    Resolving a major incident resolves all associated child incidents, and the individual
    callers receive a notification about incident resolution.

Post incident review

:   This is the final phase of a major incident life cycle. After the major incident is resolved, a post-incident review is conducted. Its purpose is to analyze the incident and understand what can be done to prevent a similar incident in the future. This review also provides an opportunity to evaluate the incident response process and identify areas for improvement. To streamline the process, a post-incident report is created
    when an incident is resolved. The post-incident report can be reviewed and updated
    during the review process before it is shared with stakeholders.

A major incident progresses through different states during its life cycle. The following
diagram illustrates the different states involved in a major incident management:  
Figure 1. Major Incident Management state flow