ITIL Incident Management
When an IT service goes down, every minute carries a cost. This ITIL Incident Management SOP gives your service desk a single, repeatable path from the moment a disruption is detected — by a monitoring tool or a user — through to a verified, documented closure, so outages are resolved quickly and consistently instead of by whoever happens to pick up the ticket.
The workflow enforces the escalation logic that keeps service desks healthy: L1 attempts a knowledge-base fix first, anything beyond their reach routes to L2/L3 specialists, and a "major incident" branch hands communications to an Incident Manager so engineers can focus purely on restoration. Built-in loops re-work a failed fix and reopen a disputed resolution, so nothing is closed prematurely.
Import this template into Essoflo to wire in your own ITSM tool, monitoring platform, and SLA thresholds, assign the L1/L2/L3 and Incident Manager roles to your team, and adapt the categorisation and closure steps to your environment.
- Purpose
- Restore normal IT service operation as quickly as possible while minimising business impact, with clear logging, escalation, and closure.
- Scope
- Applies to all unplanned IT service disruptions reported to the service desk or detected by monitoring, across L1, L2/L3, and major-incident handling.
- Steps
- 11 steps & decisions
- Roles & tools
- Service Desk Agent (L1), Technical Specialist (L2/L3), Incident Manager, End UserITSM Ticketing System, Monitoring & Alerting, Knowledge Base, CMDB
Step-by-step walkthrough
The same procedure as the diagram above, in reading order — decisions show where each answer leads.
- 1
Detect & log incident
Capture incident details, timestamp it, and generate a unique ticket number.
Who: Service Desk Agent (L1)·Tools: ITSM Ticketing System, Monitoring & Alerting
- 2
Categorise & prioritise
Assign category (network, software, etc.) and set urgency and business impact; the SLA timer starts.
Who: Service Desk Agent (L1)·Tools: ITSM Ticketing System
- 3
Major incident?
High urgency and high organisational impact triggers the major-incident path.
True → Engage Incident Manager & own comms·False → Initial diagnosis (L1)
Who: Service Desk Agent (L1)
- 4
Engage Incident Manager & own comms
Incident Manager takes ownership and handles all stakeholder communication so engineers focus on restoration.
Who: Incident Manager·Tools: ITSM Ticketing System
- 5
Initial diagnosis (L1)
Run first-line troubleshooting using knowledge-base checklists and scripts.
Who: Service Desk Agent (L1)·Tools: Knowledge Base
- 6
Resolved at L1?
Did first-line troubleshooting fix the issue?
True → Close & verify with user·False → Escalate & route to L2/L3
Who: Service Desk Agent (L1)
- 7
Escalate & route to L2/L3
Route the ticket to the right specialist team based on categorisation and CMDB.
Who: Service Desk Agent (L1)·Tools: ITSM Ticketing System, CMDB
- 8
Investigate & apply fix (L2/L3)
Find root cause and apply a patch, rollback, or hardware replacement.
Who: Technical Specialist (L2/L3)
- 9
Fix verified?
Does the system pass functionality tests after the fix?
True → Close & verify with user·False → Investigate & apply fix (L2/L3)
Who: Technical Specialist (L2/L3)
- 10
Close & verify with user
Record resolution notes and confirm functionality with the original reporter.
Who: Service Desk Agent (L1)·Tools: ITSM Ticketing System
- 11
User confirms resolution?
Is the user satisfied that service is restored?
True → Incident resolved & closed·False → Initial diagnosis (L1)
Who: End User
Related templates
ITIL Change Management
Introduce changes to production safely: classify the change, assess risk, get CAB approval, deploy with a rollback path, and run a post-implementation review.
ITData Backup & Recovery
Backups that actually restore: run the job, verify integrity, replicate offsite, and prove recovery works with scheduled restore drills.
HREmployee Onboarding
A repeatable first-week onboarding flow that gets new hires set up, trained, and productive — covering accounts, equipment, and role-specific training.
Prefer to start from scratch? Try the free RACI matrix builder or the onboarding program builder — no sign-up needed.