ITIL 4 InfoSec study plan

Define the ITIL 4 service value chain, the four dimensions, and the guiding principles in your own words, then map where information security responsibilities sit in each

Distinguish the seven ITIL 4 management practices most relevant to security (information security management, risk management, incident management, problem management, change enablement, service continuity, supplier management) by writing a one-sentence purpose for each

Build a personal glossary of 20 core terms covering confidentiality, integrity, availability, asset, threat, vulnerability, likelihood, impact, and control

Draw a simple diagram linking a service value stream to the security activities that protect it, and annotate three handoff points where risk decisions are made

Explain how the ITIL 4 information security management practice interacts with the other six practices from week 1, giving one realistic scenario per interaction

Classify ten sample organizational assets by criticality and owner, and justify each classification against business impact rather than technical convenience

Apply the risk management practice's core steps (identify, assess, treat, monitor) to a fictional cloud migration scenario and record the outputs of each step

Compare a qualitative risk matrix with a quantitative approach for the same scenario and state when each is more defensible

Identify threats and vulnerabilities for three distinct asset types (data store, identity system, third-party service) using structured prompts rather than brainstorming alone

Select and justify treatment options (avoid, mitigate, transfer, accept) for six risks, stating the acceptance authority for each

Define risk appetite and risk tolerance statements for a fictional organization and test them against your week 2 register

Document how risk monitoring and review would work: review cadence, triggers for re-assessment, and escalation thresholds

Describe how governance bodies (board, steering committee, security function) divide accountability, responsibility, and decision rights for security risk

Draft a security policy hierarchy: policy, standards, procedures, and guidelines, with one realistic example at each level

Connect risk reporting to governance by designing a one-page risk dashboard with the metrics a steering committee would actually act on

Explain how internal audit, compliance obligations, and assurance activities feed back into the risk management practice

Derive five controls directly from the risks in your register and state which risk each control reduces and by what mechanism

Categorize controls as preventive, detective, or corrective, and identify one gap where a category is missing in your design

Explain how segregation of duties, least privilege, and defense in depth apply to a fictional identity and access management design

Describe how change enablement and supplier management act as security controls in their own right, with one failure example each

Design the monitoring and measurement approach for five controls, naming the metric, data source, threshold, and response when the threshold is breached

Evaluate the limits of technical controls by analyzing three realistic bypass or failure scenarios and the compensating controls for each

Explain how awareness, training, and competence requirements function as controls and how their effectiveness can be evidenced

Assess a fictional supplier against security requirements and record the assurance evidence you would demand before onboarding

Define security incident categories, severity levels, and escalation paths, and distinguish an incident from a problem and from a service request

Walk a fictional ransomware incident through detection, response, containment, eradication, recovery, and post-incident review, naming the role accountable at each stage

Draft the post-incident review agenda and the questions that turn an incident into improvement actions rather than blame

Identify the communication and evidence-handling obligations that apply during an incident, including who decides on disclosure

Convert lessons from your incident runbook into at least three improvement actions with owners, measures, and review dates

Explain how continual improvement, measurement and reporting, and the guiding principles apply to a security management system over time

Reconcile your full study artifacts into a single coherent narrative showing governance, risk, controls, and incident learning as one loop

Identify and close your three weakest knowledge areas using targeted self-testing rather than rereading notes