---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Propose as a Major Security Incident

# Propose as a Major Security Incident {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Propose a security incident to a major security incident.

## Before you begin

Role required: sn_si.analyst

## Procedure

1. Navigate to WorkspacesSecurity Incident Response WorkspaceSecurity IncidentsLists.
2. Select the security incident in the related category that you want to propose as a major security incident.
3. Select the More Actions icon and select Propose as Major Security Incident.
4. In the Propose as Major Security Incident dialog box, fill in the fields.
   1. Detection Date: Date when the major security incident was first created or proposed.
   2. Justification: Provide the justification for proposing the incident.
   3. Potential impact: Indicate the impact of the incident.
   {#propose-as-msi__substeps_otq_jlb_sqb}
5. Select Propose.

## Result

The incident is proposed and the following actions occur:

* In the security incident record, a verification banner message is displayed
  and the defined Major Security Incident tag appears.

* The record appears in the Major Security Incident related list in the
  incident record, with the state listed as Proposed, and in the MSIM
  Workspace Candidates list.

* The Activity section in the MSIM Workspace shows that the security incident has been proposed to be promoted as a major security incident.
* A message is sent to those in the defined notification list that contains a
  link to the incident record and the Details tab for the incident.

{#propose-as-msi__ul_nhp_slb_sqb}
**Related tasks**   

* [Promote to a Major Security Incident](https://servicenow-prod.fluidtopics.net/AthhVItLh5ohnsxWvMMSaQ "Promote a security incident to a major security incident or reject promoted proposals through the Major Security Incident Management (MSIM) Workspace.")
* [Link to Major Security Incident](https://servicenow-prod.fluidtopics.net/QSupANeHEuMHdWLwo8J2nw "Link security incidents to a major security incident.")

*[\>]: and then