ITIL 4 IM key terms

An unplanned interruption to a service or reduction in the quality of a service. It may be reported by users, detected by monitoring, or raised by suppliers, and it always requires a coordinated response.

The practice that aims to minimize the negative impact of incidents by restoring normal service operation as quickly as possible, balancing speed of recovery against cost, risk and the need for permanent fixes.

An incident with significant business impact that demands a separate, elevated response: dedicated coordination, prioritized resourcing, heightened communication to leadership and stakeholders, and often a formal post-incident review.

A temporary way to restore service or reduce the impact of an incident when a permanent resolution is not yet available. Workarounds are documented so they can be reused and later replaced by a permanent fix.

A problem or incident that has been analysed and has a documented root cause and, usually, a documented workaround, but for which a permanent resolution has not yet been implemented.

The practice that reduces the likelihood and impact of incidents by identifying actual and potential causes of incidents, and by managing workarounds and known errors so recurring incidents are addressed at source.

The relative importance assigned to an incident, normally derived from its impact and urgency, which determines response times, escalation paths and the level of resources applied to resolution.

A measure of the effect of an incident on business processes, users or services. It reflects how much is affected, how critical the affected component is, and how visible the disruption is to customers.

A measure of how quickly an incident's impact on the business will grow if it is not resolved, or how soon a resolution is needed. It is judged separately from impact when setting priority.

The act of moving an incident to a higher level of authority, expertise or management attention. Functional escalation adds technical skills; hierarchical escalation engages management attention, often for major or overdue incidents.

The initial point of contact, typically the service desk, where incidents are logged, diagnosed using scripts and knowledge, and resolved or escalated to specialist teams when skills or access are insufficient.

Specialist groups with deeper technical or domain expertise. Second-line teams handle escalations needing product knowledge; third-line teams, often internal engineering or external suppliers, handle the most complex defects and changes.

The person accountable for managing an individual incident through its lifecycle, keeping records accurate, coordinating actions and communication, and confirming that service has been restored before closure.

The principle that every incident has one named person responsible for its progress and communication at any time. Ownership may transfer on escalation but must never be ambiguous or shared.

The single point of contact between the service provider and users for reporting incidents, requesting services and seeking information. It captures, classifies, prioritizes and resolves or routes incidents.

A temporary group of people, often drawn from several teams, assembled to restore service for a specific high-impact or major incident, coordinated by an incident owner or incident manager.

A collaborative working style in which a group of people with the right competences works together on an incident until it is resolved, rather than passing it through sequential support tiers.

The end-to-end sequence an incident passes through: detection and logging, classification and prioritization, diagnosis and escalation, resolution and recovery, then closure with user confirmation and record updates.

The point at which a disruption is noticed, whether by a user report, automated monitoring, supplier notification or a colleague. Faster detection shortens the period of undetected business impact.

Recording an incident with enough detail to enable consistent handling: reporter, symptoms, affected service, time, impact and urgency. Accurate logging underpins prioritization, reporting and later analysis.

Assigning an incident to defined categories and, where relevant, to a known error or problem record, so that trends can be analysed, specialist teams routed correctly and reports produced.

The investigation to establish what has failed and why, using symptoms, knowledge articles, diagnostic tools and specialist expertise, so that a resolution or workaround can be selected.

The action that removes the cause of an incident and restores the service to its agreed state, as distinct from a workaround that only temporarily reduces impact.

The steps taken after a fix to bring the service back to normal operation, such as restarting components, reconciling data, verifying functionality and confirming with users that service quality is acceptable.

The final step in which the incident record is completed, the resolution is confirmed with the user, classification is checked and any follow-up actions, such as a problem record, are raised.

A structured, blameless examination after a significant incident of what happened, how it was handled and what should change in technology, process or organization to reduce recurrence or impact.

The data held about a single incident, including its reference, description, classification, priority, owner, actions taken, communications and resolution. It is the authoritative source for reporting and audit.

The practice of maintaining and improving the useful, accurate and available information used to handle incidents, such as diagnostic scripts, known-error entries and workaround instructions.

Any detectable or discernible occurrence that has significance for the management of a service or its components. Monitoring tools generate events, some of which become incidents when they indicate a disruption.

The practice that systematically observes services and components, records events and interprets them, enabling early detection of incidents and providing data for their diagnosis.

Use of portals, chatbots and automated workflows so users can report and track incidents and common fixes can be applied without human intervention, reducing effort and resolution time.

A documented agreement between a provider and a customer that identifies required services and the expected level of service, including incident response and restoration targets that shape prioritization.

The practice of setting clear business-based targets for service levels and ensuring delivery against them, using incident performance data to negotiate, monitor and report on commitments.

The practice of aligning an organization's practices and services with changing business needs through ongoing improvement, often using incident trends, root causes and review findings as inputs.

The set of interconnected activities an organization performs to deliver value, within which incident handling contributes mainly to the engage, deliver and support, and improve activities.

A specific combination of activities and practices that creates value for a defined scenario or stakeholder, such as the flow from a user reporting a failure to restored service.

Confirming, after an incident fix or a change, that the service actually works as users need and that the incident's symptoms are gone, rather than assuming restoration from technical checks alone.