Major incident management A major incident (MI) is an incident that results in significant disruption to the business and demands a response beyond the routine incident management process. Major incidents have a separate procedure with shorter timescales and urgency that is required to accelerate resolution process for incidents with high business impact. The definition of what constitutes a major incident must be determined and agreed upon. For example, a major incident could be created if a critical business service is impacted or if there is a service outage that affects a large number of users. Provides an overview of the Major Incident Management in the ServiceNow Platform. You can also create a new major incident candidate by clicking Create Major Incident Candidate from the left navigation pane. The major incident manager then analyses the candidate and decides whether a major incident is at all required. The Create major incident from candidate property (sn_major_inc_mgmt.com.snc.incident .min.major_incident_creation) provides option to create a new major incident or to promote a major incident candidate to a major incident.Note: The base system major incident trigger rules are disabled by default. You need to activate the trigger rules that define conditions under which an incident is automatically considered as a major incident candidate. When you create a new major incident from a candidate, a new incident is created and becomes the major incident. The candidate is added as the child of the major incident. The major incident is automatically assigned to the Major Incident Management group. System automatically assigns the newly created parent major incident to a user when the On-Call Scheduling plugin (com.snc.on_call_rotation) is activated, a rota is defined for the major incident management group, and a user is available for the on-call rota. If no on-call rota exists, the major incident manager decides the user for the Assigned to field. When a major incident candidate is promoted as a major incident, the incident itself is considered as a major incident. There is no new incident that is created. The value in the existing Assignment group or the Assigned to field does not change to the major incident management group or any user. The major incident manager needs to reassign the value of the fields as appropriate.