Guidance, practices and programmes
ITIL
IT service management practices such as change, incident and problem management.
Official source Published by PeopleCert (AXELOS). Summaries in our own words.
What it is
ITIL is a widely used body of best practice for IT service management, covering how IT services are planned, delivered, supported and improved. It exists to give organisations proven practices for managing services such as incident, problem and change management.
Who it applies to
- IT operations and service management teams
- Managed service providers and outsourcing partners
- Security teams that need to integrate with incident, change and asset processes
- Financial entities building ICT incident and change processes for DORA, where ITIL practices are a common starting point
- Status
- A proprietary best practice framework owned by PeopleCert (which acquired AXELOS). ITIL 4, introduced from 2019, is the widely used current version.
- Enforcement
- Voluntary. Individuals can be certified through PeopleCert examinations; organisations cannot be certified against ITIL, but can be certified against the related ISO/IEC 20000-1 service management standard.
Key points
- Incident management restores service quickly; problem management finds and removes root causes
- Change enablement balances speed and risk, which matters for security patching and emergency changes
- Asset and configuration management provide the inventory that security controls rely on
- Information security management is one of the ITIL practices, so security can be built into service management
- ITIL is descriptive guidance: you adapt it rather than implement it word for word
Where to start
- 1Check how your security incident process connects to the IT incident and problem processes
- 2Make sure security reviews are part of change enablement, with a defined emergency change path
- 3Link the configuration management database to vulnerability and asset management
- 4Consider ISO/IEC 20000-1 if you need certifiable service management
How it is structured
| Service value system | How components and activities work together to create value |
|---|---|
| Guiding principles | Seven principles such as focus on value and start where you are |
| Service value chain | Activities such as plan, improve, engage, design and transition, obtain or build, deliver and support |
| Management practices | General, service management and technical practices, including incident, problem and change enablement |
A plain-language overview to help you learn, written by ThreatNoir. The official source prevails; this is not legal advice.
Items explained (1)
Ordered by how often our lessons cite them.