An incident in ITIL is any unplanned interruption to an IT service, or a reduction in the quality of that service that disrupts normal business operations.

Quick Scoop

In ITIL, you can think of an incident as “something broke (or is behaving worse than normal) and users/business are affected right now.”

The purpose of Incident Management is to restore normal service as quickly as possible and minimize impact on the business, not necessarily to find and fix the deep technical root cause.

Formal ITIL-style definition

  • An incident is an unplanned disruption to an IT service, or a reduction in the quality of an IT service.
  • It can be anything from a slow application or single-user issue to a full-blown outage of a critical system.

Example:

Users cannot access the CRM system, or it is so slow that they cannot work effectively – that is an incident in ITIL terms.

Incident vs problem vs service request

  • Incident : Unplanned disruption or degradation (e.g., server crash, network outage, email down).
  • Problem : The underlying cause or potential cause of one or more incidents (e.g., a buggy software module that keeps crashing the app).
  • Service request : A standard request for something (e.g., new software install, access to a system) without any disruption.

A common way to phrase it:

“Incident = outage or degradation; problem = root cause; service request = ‘please give me something’.”

Types and severity of incidents

Organizations often classify incidents to decide how urgently to respond:

  • Minor: Affects one user or a small group; limited business impact.
  • Major: Affects business‑critical services, often many users or departments.
  • Critical: Complete outage of a key service with severe business disruption.

This classification influences priority, escalation, and response targets (SLAs).

Incident lifecycle in ITIL

Typical stages in the incident lifecycle include:

  1. Logging: Capture the incident with details (who, what, when, impact).
  2. Categorization and prioritization: Classify type and set priority based on impact and urgency.
  3. Initial diagnosis: Service desk or first‑line support investigates and tries standard fixes.
  4. Escalation (if needed): Hand over to specialist teams or higher support tiers.
  5. Resolution: Apply workaround or permanent fix to restore service.
  6. Closure: Confirm with the user, document the solution, and close the ticket.

The key success measure is how fast and effectively normal service is restored while keeping business impact low.

TL;DR:
In ITIL, an incident is any unplanned disruption or drop in quality of an IT service that affects users or business, and Incident Management is all about getting things back to normal quickly rather than deeply analyzing the root cause.

Information gathered from public forums or data available on the internet and portrayed here.