Major incidents need faster response times and broader communication than regular tickets. This guide walks you through configuring the separate major incident workflow and response process.
Why major incidents need special handling
Regular incident management breaks down when something takes down payroll or the customer portal. The same analyst who handles password resets is suddenly coordinating with executives, vendors, and multiple teams while users flood the helpdesk. Without a separate process, high-impact incidents get the same priority queue treatment as routine issues, and critical stakeholders don't get the communication they need until damage is done.
How major incident processing works
ServiceNow separates major incidents using a state field that triggers different SLAs, notifications, and workspaces. When you mark an incident as major, it gets its own workbench with stakeholder management, communication templates, and task tracking. The major incident manager role gets special permissions and becomes responsible for coordinating the response. You'll configure the state transitions, set up the communication plans, and define who can declare incidents major.
Building beyond basic major incident handling
A working major incident process handles escalation and basic communication. Production-quality implementations add automated stakeholder identification based on affected services, integration with external communication tools like Slack or Teams, and post-incident review workflows that capture lessons learned. Many teams also build custom dashboards for executives and add automated status page updates for customer communication.
Before you start
- •ITSM Roles plugin activated
- •major_incident_manager role assigned to appropriate users
- •Incident Management application access
Sourdough: ServiceNow Monitoring and Analytics
A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.
Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.
Step by step
Configure the Major incident state field
Navigate to Incident > Administration > Dictionary and open the Major incident state field on the Incident table. Set the field to Active and configure the choice list values: Accepted, Resolved, Closed, and Cancelled. The Accepted state triggers major incident processing, while the others align with standard incident states for reporting consistency.
Leave the field blank by default — users must explicitly mark incidents as major to prevent accidental escalation.
Set up major incident SLAs
Go to Service Level Management > SLA Definitions and create a new SLA Definition for major incidents. Set the Table to Incident and add a condition where Major incident state is Accepted. Configure aggressive target times — typically 15 minutes for first response and 4 hours for resolution. These SLAs override standard incident SLAs when the major incident state is active.
Enable the major incident workbench
Navigate to Incident > Views and locate the Major Incident Workbench view. If it doesn't exist, create it by copying the standard incident form and adding related lists for Tasks, Communications, and Stakeholders. Add fields specific to major incident management: Communication plan, Incident commander, and Stakeholder notifications. Save the view and set it as the default for users with the major_incident_manager role.
Configure major incident notifications
Go to System Notification > Email > Notifications and create notifications for major incident events. Build separate notifications for incident declaration, status updates, and resolution. Set recipients to include the major incident manager, affected service owners, and executive stakeholders. Use the incident's affected service to dynamically determine additional recipients through the CMDB.
Create communication plan templates
Navigate to Incident > Major Incident > Communication Plans and create templates for different incident types. Include stakeholder matrices, escalation timelines, and message templates for internal and external communication. Link these plans to service categories or CI types so the system can suggest the appropriate plan when an incident is declared major.
Build templates for common scenarios like application outages, network issues, and security incidents — each needs different stakeholders and messaging.
Set up automatic task creation
Create a Business Rule that fires when Major incident state changes to Accepted. Have it automatically create standard response tasks: Stakeholder notification, Status page update, Vendor engagement, and Post-incident review scheduling. Assign these tasks to the appropriate groups and set due dates based on your response timeline requirements.
Configure major incident dashboard
Go to Self-Service > Dashboards and create a Major Incidents dashboard with widgets showing active major incidents, SLA performance, communication status, and stakeholder actions. Make this available to the major_incident_manager role and executive stakeholders. Include filters for time ranges and affected services so leadership can track response effectiveness over time.
Best practices
Create clear criteria for what constitutes a major incident — without objective thresholds, every incident becomes major during stressful situations.
Set up automated stakeholder identification through CMDB relationships rather than manually maintained lists — services change ownership and manual lists go stale.
Build communication templates that include specific information requirements — responders under pressure skip important details without structured guidance.
Configure the major incident state to automatically revert if no action is taken within a defined timeframe — prevents incidents from staying in major state indefinitely.
Separate the major incident manager role from day-to-day incident assignment groups — they need different permissions and shouldn't be handling regular tickets during major incidents.
Test Your Knowledge
Quick 3-question quiz — see how your ServiceNow skills stack up.
A list view on a table with millions of records is slow. Best fix?
Select an answer to continue