Incident Management · Topic 2 of 3
Incident Scoping, Priority, Assignment and Major Incidents
CIS-ITSM incident scoping: categories, the priority data lookup, assignment rules versus data lookup, and when to use Major Incident Management.
- 5 min
- Priority comes from Impact and Urgency through the priority data lookup.
- Assignment rules use conditions; assignment data lookup uses a matcher table of field values.
- Assignment rules do not overwrite a record that is already assigned.
What it is
Scoping is the part of an implementation where the implementer and the customer agree how Incident Management will be used. The goal is to meet each requirement with the base platform and as little custom work as possible.
The questions to settle are always similar. How are incidents categorized, how is priority set, who gets each incident, how fast must it be handled, and what happens when something big breaks.
How it works
Categories and subcategories
Category and Subcategory drive reporting and often drive routing. Keep the list short and meaningful to the people who choose from it.
A long list leads to agents picking "Other". That breaks assignment rules and makes trend reports useless for problem management.
Priority: Impact plus Urgency
Priority is calculated, not chosen. Impact says how widely the business is hurt and Urgency says how quickly it must be fixed. The priority data lookup maps each pair to a Priority.
| Impact \ Urgency | 1 High | 2 Medium | 3 Low |
|---|---|---|---|
| 1 High | 1 Critical | 2 High | 3 Moderate |
| 2 Medium | 2 High | 3 Moderate | 4 Low |
| 3 Low | 3 Moderate | 4 Low | 5 Planning |
If the customer wants a different matrix, change the rows of the priority lookup rules. Do not script a priority calculation.
Assignment: rules and data lookup
Two declarative features route incidents to an assignment group or person.
| Feature | How it decides | Good fit |
|---|---|---|
| Assignment rule | A condition on the record, such as Category is Network, sets an assignment group or user | A few broad routes based on any field condition |
| Assignment data lookup | A table of matcher rows, such as Category plus Subcategory, returns the group | Many combinations kept as data that a process owner can maintain |
Assignment rules only set values when the record is not already assigned, so an agent's manual choice is not overwritten. Data lookup rules are rows in a table, which makes them easy to change without touching logic.
Groups need active members with the itil role so they can work what is assigned. The CI's Support group field is another common source for assignment, because the CMDB already knows who supports each CI.
SLAs as a requirement
The customer's response and resolution targets become SLA definitions. Scoping should capture the targets per priority, the working schedule, and the conditions that pause the clock, such as waiting for the caller.
Major Incident Management
A major incident is one with a very high impact on the business that needs a separate, faster response. ServiceNow handles it with Major Incident Management.
An incident can be proposed as a candidate by an agent, or detected automatically by trigger rules. A major incident manager reviews the candidate and accepts or rejects it.
Once accepted, related incidents are grouped as children. Communication plans define who is told, how often and by which method, and they can differ by priority or audience. Resolving the major incident also resolves its child incidents and notifies their callers.
When it is resolved, a post incident report is produced for the review. The review should also create a problem for root cause analysis.
Notifications
Notifications tell the caller when an incident is opened, commented on and resolved, and tell groups when work arrives. Agree in scoping which ones the customer wants. Turning off noise is as important as adding new messages.
How the exam asks about this
- "A customer wants High impact, Low urgency incidents to be priority 2 instead of 3." Update the priority data lookup rule for that combination.
- "Routing depends on fifty Category and Subcategory pairs that the service owner will change often." Use assignment data lookup rules.
- "A data center outage needs one owner, stakeholder updates and all related incidents closed together." Use Major Incident Management.
What to remember for the exam
- Priority comes from Impact and Urgency through the priority data lookup.
- Assignment rules use conditions; assignment data lookup uses a matcher table of field values.
- Assignment rules do not overwrite a record that is already assigned.
- The CI's Support group is a strong source for routing.
- Major incidents are proposed or detected, then accepted or rejected by a major incident manager.
- Resolving a major incident resolves its child incidents.
Letting agents pick Priority directly is a classic wrong answer. The requirement is met by adjusting Impact, Urgency or the lookup rules, never by making Priority editable.
Common mistakes
Over designing categories. Deep category trees look complete in a workshop but agents stop using them. Fewer, clearer values give better routing and reports.
Scripting what a rule can do. Assignment, priority and SLA timing all have declarative features. Custom scripts add upgrade risk and are rarely the answer the exam wants.
Treating every P1 as a major incident. Priority 1 means critical impact and urgency. A major incident is a formal process decision that a major incident manager accepts.
Check yourself
How do you make a different Impact and Urgency pair produce a new priority?
Change the matching row in the priority data lookup rules. Priority stays calculated, not typed in.
When is assignment data lookup a better fit than assignment rules?
When routing depends on many combinations of field values, such as Category and Subcategory, that a process owner will maintain as data.
What happens to child incidents when a major incident is resolved?
They are resolved as well, and their callers are notified of the resolution.
Topic 2 of 3 in Incident Management
Test yourself on Incident Management
The full ServiceNow CIS-ITSM question bank has 598 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ServiceNow. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.