The different states of an incident include the following:

• Classified - An incident that has been assigned a classification. The classification helps narrow the realm of possibilities for resolving the incident. For instance, the classification can be based on platform, type of problem, component, or other information.
• Closed - The finalization of all data related to an incident, including structured data which supports analysis of incident causes, patterns, costs and resolution effectiveness.
• Communication to User - Communications with a user about the status or progress of an incident. Could be to provide status information or to solicit additional data or request some user action as part of diagnosis.
• Logged - An identified incident that has been saved in a database.
• Resolution Plan - An incident for which a resolution plan has been created or obtained. Subsequently (and beyond this activity), the resolution plan has to be applied and the outcome verified with the user.
• Resolution Unsuccessful - Information about an incident for which a workaround or fix was not provided or was unsuccessful. Normally, an incident should eventually yield a workaround or a fix for that incident. However, in some situations, no workaround or fix works to resolve the incident.
• Resolved - An incident for which a workaround or fix has been successfully applied.

Incidents are described by incident records.  Information included in an incident record may include:

• Incident # 
• Status
• Date Occurred
• Total Duration
• System Impacted
• Problem Recognition Time
• Problem Determination Start Time
• Recovery Start Time
• Incident Type
• Time Occurred
• Location
• Problem Determination End Time
• Recovery Stop Time
• Root Cause Code
• Closed By
• Descriptive Text
• Recovery Text
• Closed Date
• Symptom String
• Closing Code
• Detailed Event Chronology
• Closed Time