---
title: Propose, promote, and link incident records
description: Propose or promote security incidents as major security incidents when incidents are identified as critical threat to the organization.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/promoting-sir-to-msim.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: concept
last_updated: "2026-03-12"
reading_time_minutes: 2
breadcrumb: [Use, Major Security Incident Management, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Propose, promote, and link incident records

Propose or promote security incidents as major security incidents when incidents are identified as critical threat to the organization.

Once Major Security Incident Management is installed on your ServiceNow instance, you can handle the transition of security incidents to major incidents as follows:

-   Propose a security incident to major security incident candidate to initiate a review process.
-   Directly promote a security incident to a major security incident without a review process.
-   Reject a security incident proposed as a major security incident.

You can also link a security incident as a child incident to the major security incident so that all related security incidents can be tracked together.

-   **[Propose as a Major Security Incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/propose-as-msi.md)**  
Propose a security incident to a major security incident.
-   **[Promote to a Major Security Incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/promote-msi.md)**  
Promote a security incident to a major security incident or reject promoted proposals through the Major Security Incident Management \(MSIM\) Workspace.
-   **[Link to Major Security Incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/link-si-msi.md)**  
Link security incidents to a major security incident.

**Parent Topic:**[Using Major Security Incident Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/major-security-incident-setup.md)

**Related topics**  


[Using MSI List view in the MSIM workspace]()

[View Major Security Incident impact metrics]()

[View Major Security Incident trend charts]()

[Update Major Security Incident details]()

[Link additional records to Major Security Incident]()

[Unlink records from Major Security Incident]()

[Manage tasks in a Major Security Incident]()

[Track collaboration activity via MSIM workspace]()

[Create and distribute MSIM Status Reports]()