IT services are one of the main pathways for information to flow through organizations, their clients and partners, and as legal and contractual requirements are increasingly including information protection demands (the healthcare industry is an example), these services and their management practices must evolve to adapt to this new scenario. But, how can we do that properly and in a cost-effective way?<\/p>\n
This article will present an overview of how ISO 27001<\/a>, an ISO standard focused on information security management, and ITIL<\/a>, a public-private framework that focuses on IT services management, are related considering information protection, and how they can be used together to increase their benefits to an organization\u2019s business.<\/p>\n Here is some information you may find useful for an initial understanding of ISO 27001 and ITIL:<\/p>\nGeneral facts<\/h3>\n
| ISO 27001<\/td>\n | ITIL<\/td>\n<\/tr>\n<\/thead>\n |
| International standard<\/td>\n | Best practice framework<\/td>\n<\/tr>\n |
| Defines requirements for the establishment, implementation, maintenance, and continual improvement of an Information Security Management System (ISMS)<\/a>.<\/td>\n | Presents a set of best practices for IT service management, giving guidance on the provision of quality IT services and the processes, functions, and other capabilities needed to support them.<\/td>\n<\/tr>\n |
| Applicable to any type and size of organization.<\/td>\n | Applicable to almost every type of IT environment.<\/td>\n<\/tr>\n |
| Implementation and certification are optional.<\/td>\n | Implementation is not subject to certification.<\/td>\n<\/tr>\n |
| Current version: ISO 27001:2013<\/td>\n | Current version: ITIL 2011 edition<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n As you can see, ISO 27001 has a direct definition concerning information protection, while ITIL\u2019s is more indirect. This is so because the term \u201cITIL\u201d refers to a multitude of practices to manage and provide quality of IT services, like financial management and request fulfillment. However, since information security is also a critical aspect in IT service management and quality in IT services, ITIL does cover information security as one of its support processes (security management), and integrates information security into most of the processes in the framework.<\/p>\n |