Information security controls and practices
What the domain tests
This domain tests how controls are chosen, implemented, operated and measured within ITIL 4. It is not a control-catalogue memorization test. Expect questions on control types, embedding controls in practices, control ownership, measurement and the balance between assurance and value.
Core rules
- A control is a measure that modifies risk. Classify controls as preventive, detective or corrective, and as management, technical or physical where useful.
- Select controls from risk assessment and cost-benefit, not by copying a framework wholesale. Layer them for defence in depth.
- Common examples: least privilege and role-based access, logging and monitoring, patching, backup and restore testing, segregation of duties, security awareness, supplier due diligence and physical access.
- Policies, standards, procedures, training and culture form the control environment. People are part of the organizations and people dimension, so awareness is a control enabler.
- Embed controls in value streams: change enablement carries security review, incident management carries detection and response, problem management addresses control failure.
- Measure control effectiveness with KRIs and audit evidence. Use optimize and automate for guardrails and repeatable checks.
Worked example
A shared service desk resets passwords. The preventive control is an identity verification script plus an MFA reset workflow. The detective control is monthly sample audit and logging. The corrective control is account lock and session revocation. Reasoning: each control maps to the account-takeover risk, is measurable, and fits the service desk practice rather than sitting outside it.
Traps that cost marks
- Treating controls as technical only.
- Assuming more controls always means better security.
- Leaving controls without an owner or effectiveness metric.
- Ignoring culture and awareness.
- Copying controls from a framework without a risk rationale.
- Treating audit as the only form of assurance.