Operations · Service Management
Incident Management
Restoring normal service as quickly as possible after an unplanned interruption or degradation.
IntermediateUpdated 2026-09-01
Overview
Incident management prioritises restoration over explanation. Detection, logging, categorisation, prioritisation, diagnosis, resolution and closure form the flow, with major incidents adding an incident manager, communications lead and stakeholder updates.
Root cause analysis belongs to problem management afterwards. Mixing the two during an outage slows restoration.
Security considerations
- Define when an operational incident is escalated as a security incident, and who makes that call.
- Preserve evidence before rebuilding when compromise is plausible.