An incident is an unplanned interruption to a service, or reduction in the quality of a service.

Below are some common issues which can be considered as Incidents :
1. Outlook is not working : Not able to recieve/send an email.
2. Printer is not working.
3. VDI is running very slow.

Incident Management restores normal service operation while minimizing impact to business operations and maintaining quality.

Major Incident : A major incident (MI) is an incident that results in significant disruption to the business and demands a response beyond the routine Incident Management.

Incident : An incident is an unplanned interruption to a service, or reduction in the quality of a service. We could say it has less impact or urgency as compare to Major Incident.

Security Incident : An Incident which is related to security of an Organisation can be considered as Security Incident. Example : Phishing attack email - > When you report phishing emails, many organisation automate to generate Security Incident in the backend.

There are five steps in an incident management plan:
Incident identification
Incident categorization
Incident prioritization
Incident response
Incident closure

However, ServiceNow Incident Management supports the process in the following steps:
Incident Identification
Incident Logging
Incident Categorization
Incident Prioritization
Incident Assignment
Initial diagnosis
Escalation, as necessary, for further investigation
Incident resolution
Incident closure

When you populate the ‘Business Service’ and the ‘Configuration Item’ fields on the incident form and save the record, the selected values appear on the “Impacted Services/CIs” and “Affected CIs” related lists respectively.

If we want to add multiple affected CIs or impacted services, we can do it by adding multiple records in related lists.

OOTB there is system property "Number of days (integer)", this property stores integer value, based on the value resolved incidents are automatically closed after those many days. We can set this property value to 3 to close it after 3 days of resolution.

There is OOTB scheduled job "Autoclose Incidents" which runs every hour and uses this property to auto close resolved incidents.

Impact is a measure of the extent of the issue and of the potential damage caused by the incident before it can be resolved. This can be based on several factors including the number of affected users, potential financial losses, and criticality of affected services.

Urgency is a measure of the business criticality of an incident, when there is an effect upon business deadlines. The urgency reflects the time available to restore service before the impact is felt by the business.

On an Incident form, by default, the ‘Priority’ field is read-only and must be set by selecting the ‘Impact’ and ‘Urgency’ values.

Raise an incident when there is any unplanned interruption or degradation in the quality of an existing IT service and create a request when you want to put a formal request to the IT service desk to provide something. A request can be for a new hardware or application, information, training etc.

Example: If the existing RAM in your system is malfunctioning, then raise an incident but if you want a new RAM for your system, raise a request.

Incident Requests are requests that denote the failure or degradation of an IT service. For example, unable to print, unable to fetch mails and so on.

Service Requests on the other hand are requests raised by the user for support, delivery, information, advice or documentation. Some examples are installing software in workstations, resetting lost password, requesting for hardware device and so on.