ITIL 4 InfoSec key terms

The coordinated set of activities an organization uses to protect information and keep it confidential, intact, and available, aligned with business objectives and legal obligations.

The three core properties of information that security activities protect: access limited to authorized parties, accuracy and completeness preserved, and access ensured for those who need it when needed.

The ITIL practice that protects the information used by the organization, covering how information is stored, transmitted, and processed, including policy, controls, and risk treatment.

Any data, system, or record that has value to the organization and therefore requires protection, including customer records, code, credentials, and configuration data.

Assigning information to defined categories such as public, internal, confidential, or restricted, so that handling and protection requirements are clear and consistently applied.

The ITIL 4 operating model of six activities-plan, improve, engage, design and transition, obtain and build, deliver and support-through which security activities are woven rather than run as a separate silo.

The direction and oversight set by leadership to ensure security is aligned with business strategy, accountabilities are assigned, and performance and risk are monitored and reported.

A documented statement of management intent that sets security objectives, principles, and mandatory requirements, and authorizes more detailed standards, procedures, and guidelines beneath it.

A long-term plan describing how security capabilities will evolve to support organizational goals, including target maturity, investment priorities, and major initiatives over a defined horizon.

The defined allocation of security duties across leadership, managers, practitioners, and all users, ensuring accountability for decisions, controls, and reporting is explicit and understood.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in statements or thresholds that guide treatment decisions and escalation.

The acceptable variation in risk exposure around the agreed appetite, used as a practical threshold that triggers action when a measure moves outside its permitted range.

The process of identifying threats and vulnerabilities affecting information assets, estimating likelihood and impact, and determining the resulting level of risk.

Any potential cause of an unwanted incident that could harm information or systems, such as malicious actors, human error, technical failure, or environmental events.

A weakness in a system, process, control, or human behavior that a threat could exploit to cause harm, including unpatched software, misconfiguration, or weak access habits.

Selecting and applying options to address assessed risk-mitigate, transfer, avoid, or accept-and recording the decision, owner, and residual risk that remains afterwards.

The risk that remains after controls or other treatment have been applied, which must be compared with appetite and formally accepted by an accountable owner.

A maintained record of identified risks, each with its owner, assessment, treatment plan, status, and review date, used to track and report exposure over time.

A forward-looking measure that signals increasing risk exposure, such as rising failed login attempts or overdue patching, so action can be taken before incidents occur.

Safeguards of a technical, administrative, or physical nature that reduce the likelihood or impact of security events, selected through risk treatment and monitored for effectiveness.

Layering multiple independent controls so that failure of one does not expose the asset, for example combining access control, segmentation, monitoring, and encryption.

Granting each user, service, or process only the access rights needed to perform its function, and no more, to limit the damage possible from misuse or compromise.

The policies and mechanisms that decide who or what may reach a resource and what they may do there, including authentication, authorization, and periodic review of entitlements.

The practice of administering identities and their entitlements across their lifecycle-joining, moving, leaving-so that access stays accurate and can be audited.

Transforming data with cryptographic algorithms so that it is unreadable without the correct key, protecting confidentiality at rest and in transit.

The disciplined process of identifying, testing, deploying, and verifying software updates that close known vulnerabilities, prioritized by risk and asset criticality.

Rules defining how users may use organizational information, devices, and networks, including prohibited activities and expected behavior, often acknowledged at onboarding.

Recurring education that builds user knowledge of threats and correct behavior, such as phishing recognition and safe data handling, reducing human-error related risk.

A single or series of unwanted information security events that harm or threaten to harm information assets, services, or business operations and require a coordinated response.

The ITIL practice for handling security incidents through detection, logging, categorization, escalation, resolution, and communication, restoring normal service operation as quickly as possible.

A documented set of roles, phases, and procedures-prepare, detect, contain, eradicate, recover, learn-that guides the organization's reaction to a security incident.

An incident with significant business impact or urgency that demands priority handling, senior coordination, and dedicated communication separate from routine incident flow.

A structured, blame-free examination after an incident closes that establishes causes, evaluates the response, and produces improvement actions with owners and dates.

The recurring ITIL practice of identifying and acting on opportunities to improve products, services, and practices, using models and measurements to move from current to target state.

Quantified measures used to judge whether controls and processes work as intended, such as mean time to detect, patch coverage, and repeat incident rates.

The shared assumptions, norms, and behaviors that determine how seriously people treat security in daily work, shaped by leadership example, training, and how incidents are handled.

The accountable role for a specific information asset, responsible for its classification, correct handling, and approval of access or risk decisions concerning it.