Templates and records · ISO 20000 · Clause 8.6.1

ISO 20000-1 IT incident log

Every unplanned interruption to a service or loss of its quality, from detection to closure, with special handling for major ones.

In one sentence

The incident log records each interruption or degradation of a service with its classification, its priority based on impact and urgency, escalation, actions taken, resolution and closure, and handles major incidents through a documented procedure with an assigned owner, notification of top management and a post-incident report, because clause 8.6.1 of ISO/IEC 20000-1 requires every incident to be recorded, classified, prioritised, escalated, resolved and closed.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 20000 · Clause 8.6.1 Clauses are cited using the numbering of ISO/IEC 20000-1:2018, the current edition and the same one the Academy uses.
Type of information: Mandatory record Record of each incident and the actions taken (8.6.1)
Who fills it in: Service desk Support groups resolve; the major incident manager coordinates where applicable
When: As soon as it is detected or reported Including those detected by monitoring before the customer notices
How long it is kept: Set by the organisation The standard requires control of the retention and disposition of documented information (7.5.3) without setting periods. It is usual to cover at least the three-year certification cycle, or the term of the customer contract if longer.

What the standard requires

What ISO 20000 demands and what it leaves to your judgement

Incidents are recorded and classified, prioritised taking into account their impact and urgency, escalated if needed, resolved and closed. The record is updated with the actions taken.

The organisation defines what a major incident is. These are managed through a documented procedure: top management is informed, a person is assigned responsibility and, once resolved, a report is produced and opportunities for improvement are reviewed.

The standard separates incidents from service requests (8.6.2): a request to create a user account is not an incident and should not count towards incident SLAs.

Read it in context: Service delivery and support, in the ISO 20000 Academy

Structure

Fields the template should include

Number, date and time logged
Source: user, monitoring, supplier
Service and configuration item affected
Description and symptoms
Category
Impact, urgency and resulting priority
Assigned group and escalations
Actions taken and communications to the user
Resolution, apparent cause and link to problem
Resolution time, user confirmation and closure
If major: owner, notification of management and post-incident report

Example

Example: major incident caused by an email outage

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Number	INC-26-0318 · 14 April 2026, 09:02 · monitoring alert
Service	SRV-04 email and collaboration · item CI-MAIL-01
Symptoms	Email clients cannot connect: certificate error
Priority	High impact (all users) · high urgency · P1 · major
Owner	Major incident manager · management notified at 09:10
Resolution	Certificate renewed at 10:20 · service restored
Duration	78 minutes · within the P1 target, but it affects monthly availability
Report	Major incident report of 16 April · problem PRB-26-021 opened

At the audit

Mistakes auditors commonly flag

Requests and queries logged as incidents, distorting the indicators.
Priority set by whoever calls rather than by impact and urgency.
Incidents closed without user confirmation.
Major incidents with no post-incident report or review of improvements.
Recurring incidents not linked to a problem.

In Kimobox

How this record is kept in Kimobox

1Each incident is recorded with its priority and resolution time.
2Recurring incidents are linked to a problem record with its root cause analysis.
3Service requests are handled from the customer or employee portal.
4Performance against the SLA is shown on the dashboard.

Frequently asked questions

What people ask us before getting started

What is the difference between an incident and a service request?

An incident is an unplanned interruption or loss of quality of a service; a request is a request for something the service already provides for, such as a new user account or a password reset. ISO/IEC 20000-1 deals with them in separate clauses.

Who decides what a major incident is?

The organisation, with documented criteria — for example the number of users affected or critical services down — often agreed with the customer.

Keep your ISO 20000 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring