ITIL 4 InfoSec common mistakes
ITIL 4 InfoSec · Understand the traps and how to avoid them.
Treating information security as a separate technical discipline owned only by a security team, rather than as a perspective woven through the ITIL 4 service value chain and all four dimensions.
Candidates carry over the mental model from traditional security certifications where security is a siloed function, and they overlook that ITIL 4 positions information security as an integral part of service management across organizations, people, partners, value streams, and information/technology.
What to do instead
For every scenario question, ask which of the four dimensions and which value chain activity the security concern touches. Practise mapping a single control (for example access management) across all four dimensions and multiple value chain activities to internalize the integrated view.
Confusing governance with management: describing the governing body as approving individual changes, running incidents, or making operational security decisions.
The words sound interchangeable in everyday speech, and candidates default to 'the board decides everything' rather than distinguishing direction, evaluation, and monitoring from planning, execution, and control.
What to do instead
Memorize the split: governance evaluates, directs, and monitors; management plans, builds, runs, and improves. When a question mentions the governing body, the correct answer almost always involves setting direction, policy, risk appetite, and assurance, not operational action.
Selecting the most technically sophisticated or restrictive control as the answer, instead of the control that is proportionate to the identified risk and the organization's risk appetite.
Candidates equate 'more security' with 'correct security' and are drawn to answers that sound strongest, ignoring cost, usability, and proportionality.
What to do instead
Before evaluating options, identify the risk level and the stated risk appetite in the scenario. Eliminate options that are disproportionate in either direction, then choose the option that brings residual risk within appetite at reasonable cost and effort.
Conflating risk treatment options, especially treating 'risk avoidance' as always correct and 'risk acceptance' as always wrong.
Candidates moralize risk: acceptance feels like negligence, so they reject it even when the scenario states the risk is within appetite or the cost of treatment exceeds the impact.
What to do instead
Learn the treatment set (avoid, mitigate/reduce, transfer, accept, and where relevant share) and judge each against the stated appetite and cost-benefit. Acceptance is legitimate and often correct when residual risk is within appetite and formally owned.
Answering incident-management questions with a pure technical containment or eradication step and skipping the service-management flow of detect, log, classify, escalate, communicate, and restore service.
Security training emphasizes forensic containment, while ITIL 4 emphasizes restoring normal service operation as fast as possible and managing the incident through the value chain, including stakeholder communication.
What to do instead
For each incident scenario, trace the full lifecycle and pick the step that is actually being asked about. Remember that restoring service takes priority over root-cause analysis, and that major security incidents require coordinated communication and escalation.
Treating a security incident and a problem as the same thing, or skipping problem management once an incident is resolved.
The immediate relief of closing an incident feels like completion, and candidates underestimate the role of problem management in removing recurring causes of security incidents.
What to do instead
Distinguish clearly: incidents restore service, problems investigate and eliminate causes. When a scenario shows recurring incidents or an unresolved underlying weakness, the correct practice is problem management, with known errors and workarounds recorded.
Ignoring the human and cultural dimension, answering purely with technical controls when the scenario describes phishing, shadow IT, or policy non-compliance.
Candidates gravitate to tools they can name, and underweight awareness, training, competence, and culture, which are explicit parts of the organizations and people dimension.
What to do instead
When the scenario involves behaviour, choose answers that combine awareness and training, clear policy, and management commitment, with technical controls as reinforcement. Recognize that security culture is a management responsibility, not a tooling problem.
Misapplying continual improvement: proposing a one-off remediation project instead of the ongoing identify, define, measure, analyse, improve, and control cycle with defined metrics.
Candidates treat improvement as a project with an end date, missing that ITIL 4 continual improvement is iterative and measurement-driven, and that security metrics must be defined and tracked.
What to do instead
Look for the answer that establishes baselines, defines measurable objectives, and feeds results back into the improvement cycle. Reject answers that stop at 'fix it once' without measurement, ownership, or review.
Confusing the purpose of policies, controls, and procedures, and picking a policy statement where a control or procedure is required, or vice versa.
All three appear in governance and control questions, and candidates do not separate intent (policy), mechanism (control), and step-by-step execution (procedure).
What to do instead
Classify each option by its nature before choosing: policy expresses direction and expectation, controls are the mechanisms that enforce or verify it, procedures describe how work is performed. Match the nature of the option to what the question actually asks for.
Forgetting that third parties and suppliers are inside the security boundary, and answering as if controls stop at the organizational perimeter.
Candidates picture security as protecting internal assets and overlook supply chain risk, contractual security requirements, and shared responsibility with partners.
What to do instead
When a scenario involves outsourcing, cloud, or partners, include supplier management and contractual controls in the answer. Remember that the value chain's 'obtain/build' and 'engage' activities and the partners and suppliers dimension extend security obligations outward.