ITIL 4 InfoSec cheat sheet

ITIL 4 treats information security management as a management practice within the service value chain, not as a separate lifecycle stage; its purpose is to keep the organization's information and services confidential, intact, and available.

The four dimensions of service management (organizations and people, information and technology, partners and suppliers, value streams and processes) must each be assessed for security implications; a control gap in any dimension weakens the whole service.

Confidentiality, integrity, and availability (CIA) are the core information security objectives; ITIL 4 adds the service relationship dimension, so security must also protect the value co-created with customers.

The ITIL 4 service value chain has six activities (plan, improve, engage, design and transition, obtain and build, deliver and support); security activities are embedded in each rather than confined to one.

Security management is a supporting practice that interacts with other practices such as service desk, incident management, problem management, change enablement, supplier management, and relationship management.

The ITIL 4 guiding principles (focus on value, start where you are, progress iteratively with feedback, collaborate and promote visibility, think and work holistically, keep it simple and practical, optimize and automate) apply directly to security design and operations.

Security controls should be proportionate to the value of the information asset and the likelihood and impact of its compromise; over-control adds cost and friction without reducing risk.

ITIL 4 emphasizes value streams: security requirements should be traced from demand through design, build, transition, and operation to ensure controls are not lost at handover points.

Information security management is a practice, not a process owner; accountability for outcomes remains with the organization's leadership, while the practice provides the means to achieve them.

Governance is the means by which an organization is directed and controlled; information security governance sets direction, ensures objectives are met, verifies risk is managed, and confirms resources are used responsibly.

The governing body (board) retains ultimate accountability for information security; it delegates execution to management but cannot delegate accountability.

An information security strategy states the organization's security objectives, risk appetite, and the high-level approach to achieving them, and must align with business strategy and legal/regulatory obligations.

The three governance activities are: evaluate (set direction and objectives), direct (assign responsibility and allocate resources), and monitor (measure performance and compliance).

A security policy is the top-level statement of management intent; standards, procedures, and guidelines sit beneath it in a hierarchy from mandatory to advisory.

Risk appetite and risk tolerance are governance decisions: appetite is the amount of risk the organization is willing to accept in pursuit of objectives; tolerance is the acceptable variation around that appetite.

Governance requires defined roles and responsibilities: the board sets appetite, executive management owns the security program, and asset/service owners accept residual risk.

Compliance obligations (laws, regulations, contracts, standards) are inputs to the security strategy; non-compliance is itself a risk that must be assessed and managed.

Governance monitoring uses metrics and reporting to confirm that security objectives are being achieved; reporting should be timely, relevant, and decision-useful for the governing body.

Risk is the possible occurrence of an event that could cause harm or loss, or make it harder to achieve objectives; information security risk concerns the confidentiality, integrity, and availability of information and services.

Risk is assessed as a combination of likelihood and impact; the product or matrix position gives a risk level that drives treatment priority.

Risk treatment options are: avoid (eliminate the activity), mitigate/reduce (apply controls), transfer (share via insurance or contract), and accept (retain with informed decision).

Residual risk is the risk remaining after controls are applied; it must be formally accepted by the accountable owner and recorded.

Risk register records each risk with an identifier, description, owner, likelihood, impact, current controls, treatment plan, residual rating, and review date.

Risk assessment steps: identify assets and threats, identify vulnerabilities, estimate likelihood and impact, evaluate against risk criteria, then treat and monitor.

Risk criteria (appetite, thresholds, and scoring scales) must be defined before assessment so that ratings are consistent and comparable across the organization.

Risk management is continual: risks are reviewed at defined intervals and whenever significant change occurs (new service, major change, new threat, incident).

Controls reduce likelihood (preventive), reduce impact (corrective or mitigating), or provide evidence (detective); selecting a mix is more effective than relying on one type.

Controls are classified as preventive (stop an event), detective (identify an event), or corrective (limit damage and restore); most security architectures combine all three.

Administrative, technical, and physical control categories address people/process, technology, and environment respectively; a complete control set spans all three.

Access control follows least privilege and need-to-know: identities receive the minimum access required for their role, and access is reviewed periodically.

Identity and access management practices include authentication (verifying identity), authorization (granting rights), and accounting (logging and reviewing activity).

Change enablement must include security impact assessment so that changes do not introduce new vulnerabilities or bypass existing controls.

Supplier and third-party management requires security requirements in contracts, due diligence before onboarding, and ongoing monitoring of supplier security posture.

Asset management underpins security: you cannot protect what you have not identified; configuration management baselines provide the reference for detecting drift.

Segregation of duties and defense in depth reduce single points of failure: no single person or control should be able to compromise a critical asset alone.

Security awareness and training is a preventive administrative control that reduces human-factor risk such as phishing susceptibility and poor handling of information.

A security incident is a breach or suspected breach of information security; it is distinct from a service incident, though the two can co-occur and must be coordinated.

Incident management follows detect, respond, contain, eradicate, recover, and learn; containment should precede eradication to limit spread.

Incident classification uses severity criteria (impact, scope, data sensitivity) to determine escalation, notification, and resourcing.

Notification obligations (regulators, customers, law enforcement) may be time-bound by law or contract; the decision to notify is made early and documented.

Evidence handling must preserve integrity and chain of custody for potential legal or disciplinary action; forensic copies and documented handling are required.

Post-incident review identifies root causes and improvement actions; findings feed problem management and the continual improvement practice.

Continual improvement uses a structured method (such as the ITIL 4 continual improvement model: what is the vision, where are we now, where do we want to be, how do we get there, take action, did we get there, keep momentum).

Security metrics should measure outcomes (reduction in incidents, time to detect and contain, control effectiveness) rather than activity volume alone.

Lessons learned from incidents should update risk assessments, controls, and awareness training, closing the loop between operations and governance.