ServiceNow Major Incident Management: The War-Room Patterns That Actually Hold Under Pressure
A head of IT operations at a European retailer called me on a Saturday night last quarter. Their checkout flow had been intermittent for ninety minutes, the store was three days from a public earnings update, and the war-room bridge had eighteen people on it. Six of them were vendors. Two were lawyers. Nobody was running the call. The incident commander had been pulled into a separate executive bridge to brief the CFO and had not returned. The bridge had drifted into a roundtable of vendors describing what their own monitoring did and did not show. The retailer's ServiceNow major incident management process had a beautiful page in the runbook describing the bridge etiquette. None of it was happening. This is the part of ServiceNow major incident management that nobody puts in the demo. The platform handles the workflow plumbing well. It opens the major incident record, it pages the commander, it sets the comms cadence, it logs the timeline. What it cannot do, and what nine in ten implementations get wrong, is the operating model around the workflow. The war room is a human process running on top of a technical record. If the human process is not designed, the technical record...
