Skip to tutorial content
Rate module 5.0/5 (1)

What Makes an Incident Major at SNWR

4 min read
On this page

In this lesson, you will learn:

  • What a major incident is
  • SNWR’s major incident criteria
  • Why P1 and major are separate decisions
  • Who decides if an incident is major

🔁 Quick look back: Last time: Legacy Agent Experiences: UI16 and Agent Workspace. You learned how to recognize the classic form and the older Agent Workspace, and why new setups use Service Operations Workspace.

1 It’s 9:40 on Monday

SNWR Email stops working at Mumbai HQ.

  • Forty people log incidents in ten minutes.
  • Three agents work on it separately.
  • Nobody tells Anita. She finds out from her own team.

🎯 The problem: A big outage handled like a normal incident means chaos: no leader, no plan, no updates.

👉 The fix: agree clear criteria for a major incident, so everyone knows when to switch to the major incident process.

2 What is a major incident?

Key term: Major incident

An incident so big that it needs a leader, a team and regular updates, not just one agent.

Key term: Major incident manager

The person who leads a major incident. At SNWR, that’s Daniel.

Key term: Major incident criteria

The agreed rules for when an incident counts as major.

ServiceNow doesn’t decide what’s major for you. Each company sets its own criteria.

3 SNWR’s criteria

SNWR's major incident criteria. An incident is major if any one of these is true: a key service is down, such as SNWR Email or the VPN, for a whole office. A whole office or more than 50 people can't work. There's a security or safety risk. Or there's a big money or reputation impact, such as a customer-facing system down. A note says priority 1 alone isn't enough; Daniel decides.
Figure 1. Any one of these makes an incident major.

📝 Note: Daniel signed these off as decision DD-015.

4 P1 is not the same as major

Case Priority Major?
SNWR Email down for all of Mumbai HQ P1 Yes
The CFO’s laptop won’t start before a board meeting P1 or P2 (high urgency) No: one person, one agent can fix it
A suspected data leak, only 3 users so far P2 Yes: security risk

Priority sets the SLA and the queue order. Major status starts a different process: a leader, a team, a plan and updates.

⭐ Remember: Priority says how fast. Major says how we organize.

5 Quick recap

  • A major incident needs a leader, a team and regular updates
  • Each company sets its own criteria
  • SNWR: key service down, many people stopped, security risk or big business impact
  • P1 isn’t automatically major, and a P2 can be major
  • Daniel, the major incident manager, decides

6 Check yourself

Think of your answer first. Then tap to check.

1 Does ServiceNow decide what counts as a major incident? Show answer

No. Each company sets its own criteria.

2 Is every P1 a major incident? Show answer

No. Priority and major status are separate decisions.

3 A suspected data leak affects only 3 users. Could it be major? Show answer

Yes. A security risk is one of SNWR’s criteria.

4 Who decides if an incident is major at SNWR? Show answer

Daniel Okafor, the major incident manager.

Nice work! You know when an incident is major at SNWR. 🎉
Next up: Proposing and Promoting a Major Incident

Was this lesson helpful?

Have a question or doubt?

Ask here and get help from instructors and fellow learners.

0 / 300

Only logged-in learners can post.