Information security management in the ITIL 4 context
What the domain tests
This domain checks whether you can place information security management inside the ITIL 4 service value system rather than treat it as a separate technical function. Expect questions on the practice's purpose, its links to the four dimensions and service value chain activities, and how it enables value co-creation.
Core rules
- The information security management practice protects information used by the organization and maintains confidentiality, integrity and availability at a level justified by risk and business need.
- It is one of the 34 management practices, not a lifecycle stage. Security work appears in plan, improve, engage, design and transition, obtain/build, and deliver and support.
- Apply all four dimensions: organizations and people (roles, culture), information and technology (classification, tooling), partners and suppliers (third-party risk), value streams and processes (security embedded in workflows).
- Use the guiding principles, especially focus on value, collaborate and promote visibility, and keep it simple and practical, to avoid control sprawl.
- Coordinate with change enablement, incident management, problem management, risk management, supplier management and service continuity management.
Worked example
A SaaS provider adds a customer portal. Security is asked to approve it one week before launch. Under ITIL 4, security requirements should enter during plan and design and transition. The team identifies customer PII as the key asset, assesses exposure via the risk management practice, adds tenant isolation and audit logging controls, updates incident runbooks, and verifies supplier clauses for the cloud database. Reasoning: early engagement changes the design while change is cheap; late approval only creates rework and residual risk.
Traps that cost marks
- Describing information security as a gate at the end of a project.
- Confusing the practice with the governance component of the SVS.
- Assuming ITIL 4 prescribes a fixed control catalogue or mandates CIA to equal degree.
- Ignoring partner and supplier risk in the four dimensions.