01 · 7 questions
1 Incident Management Governance
Incident management policy and scope, Incident process owner, Duty incident manager rota and authority, Roles and RACI, Practice interfaces, Single process and record standard, Agreed target times
IT Service Management Assessment
Incident Management Maturity Assessment
Evaluates incident management across governance, detection and logging, classification and correlation, diagnosis, assignment and swarming, resolution and recovery, closure and feedback, major and security incidents, tracking and escalation, people and tools, and measurement.
Already have an account? Log in to start
Who it is for
- Service Desk
- Technical Support and Resolver Groups
- Problem, Change and Configuration
- Security Operations
- Service Owners, Customers and Suppliers
- Process Owner/Full Model Assessor
Incident Manager / Major Incident Manager / Service Desk Manager / IT Operations Director / IT service management (ITSM) Process Owner. Secondary: Resolver Group Leads, Security Operations, Problem, Change and Configuration Managers, Service Owners, Supplier Managers and Compliance Officers.
What you will gain
Shows where incident handling breaks down, from logging and priority through escalation, major incident response and regulatory notice, to whether measurement drives improvement. Results tie each gap to the document or record that proves it and to the key performance indicator (KPI) that shows progress.
About this assessment
Incident management is the IT practice the business sees most. When it works, service comes back quickly, users are kept informed and major incidents run with calm control. When it fails, tickets bounce between teams, outages run long, regulatory deadlines slip and leadership hears about problems from customers first.
The model follows the incident lifecycle in order. It starts with governance (policy, ownership, roles, interfaces, one record standard and agreed targets), then checks detection from users, monitoring and service level objective (SLO) alerts, classification and correlation, diagnosis with knowledge and incident models, assignment and swarming, resolution under change control including automated and artificial intelligence (AI) agent actions, and closure with user confirmation. It then covers major incidents, regulatory notification and the handoff of security incidents, tracking and escalation, people and tools, and measurement that drives improvement.
Each question is scored on whether the practice is Documented, Implemented and Effective. Documented without Implemented exposes paper practices, Implemented without Documented exposes practices that depend on a few people, and either without Effective exposes practices nobody measures. Depth on single practices sits in other library models: Service Desk for contact handling, Security Operations Center Cyber and Incident Response for security investigation, Knowledge Management for the knowledge lifecycle, Continual Service Improvement for the improvement program and Business Impact Analysis for impact assessment.
What we assess: 11 domains
Each domain is a group of related questions, scored on its own and rolled up into your overall result.
02 · 7 questions
2 Incident Detection and Logging
Contact channels and single point of contact, Event-driven incident creation, Service level objective burn alerts, Logging every incident, Symptom and impact capture, Service and CI linkage, Failed self-help capture
03 · 5 questions
3 Classification, Prioritization and Correlation
Category scheme, Impact and urgency priority, Incident, request or change check, Service impact correlation, Related alert and incident correlation
04 · 5 questions
4 Diagnosis and Knowledge Matching
Knowledge and known error matching, Incident models, First-line diagnosis, Problem registration criteria, Restoration path decision
05 · 6 questions
5 Assignment, Investigation and Swarming
Assignment matrix, Incident ownership, Swarming, Supplier-handled incidents, Provider-wide outage playbook, Investigation records
06 · 6 questions
6 Resolution and Recovery
Resolution recording, Change control during resolution, Automation and AI agent controls, Recovery actions, Restoration verification, Knowledge capture and feedback
07 · 5 questions
7 Closure and User Feedback
User confirmation, Closure quality and codes, Reopen handling, Dissatisfied user follow-up, Incident complaint handling
08 · 11 questions
8 Major and Security Incident Management
Major incident criteria and declaration, Documented major incident procedure, Major incident manager, Response coordination, Major incident communication and status page, Regulatory notification register, Continuity invocation thresholds, Major incident exercises, Blameless major incident review, Security incident recognition, Security incident handoff and coordination
09 · 5 questions
9 Tracking, Escalation and Communication
Active incident tracking and target visibility, Functional escalation, Hierarchical escalation, User progress updates, Escalation analysis
10 · 5 questions
10 People and Tools
Competence and training, Staffing to demand, On-call load and alert noise, Awareness of incident duties, Tool capability
11 · 5 questions
11 Measurement, Analysis and Improvement
KPI framework, Stakeholder reporting, Trend analysis, Business impact and cost, Improvement input
KPIs to track
Measures that show whether the improvements hold.
| KPI |
|---|
| Proactive Incident Detection - Share of priority 1 and 2 incidents opened by monitoring before the first user report. Target: at least 80%. |
| Failed Resolutions - Share of resolved incidents found still faulty within 72 hours of resolution. Target: under 2%. |
| Major Incident Recovery Within Objective - Share of major incidents crossing the continuity threshold with service recovered within the recovery time objective. Target: 100%. |
| Escalated Incident Recovery - Share of escalated incidents recovered within the original or revised target time. Target: at least 80%. |
| Cost-Informed Funding Decisions - Share of resilience or problem funding decisions for critical services that cite incident cost. Target: at least 80%. |
Framework alignment
Questions are written in plain language and mapped to:
- ISO/IEC 20000-1:2018
- ISO/IEC 20000-2:2019
- ITIL 4
- COBIT 2019
- NCA ECC-2:2024
- Saudi PDPL Implementing Regulations
- Commission Delegated Regulation (EU) 2025/301
Works best with
Practices this assessment relies on. Assessing them too gives a fuller picture.
Service Level Agreements and Performance (v5.9.6): agreed targets and criticality tiers must exist before priority and target compliance mean anything.
Configuration Management: service maps and configuration item links drive impact correlation and routing.
Service Desk: contact handling and agent practice sit there; this model covers the incident record they create.
Knowledge Management: known errors and articles speed diagnosis; this model covers their use and feedback only.
Security Operations Center Cyber and Incident Response: security investigation and response depth sit there; this model keeps the handoff.
Continual Service Improvement: incident findings feed the wider improvement program assessed there.
What you get
Maturity scores
An overall score and a score for each of the 11 domains.
Gap analysis
A clear view of where current practice falls short, and why it matters.
Improvement recommendations
Prioritized next steps to move each area to the next level.
Detailed report
Results you can share with leadership and track over time.
See where you stand on Incident Management Maturity Assessment
Register, take the assessment, and get your maturity score with a clear improvement roadmap.
Start Measuring Your Maturity Today
Assessment Platform
Contact us
-
Business Bay, Dubai, UAE
-
info@itsgovernance.com
-
+971 586 697 263
Get Started
© 2026 ITSGovernance, part of SMCE. All rights reserved. Cookie settings