ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS).

An ISMS organises how an organisation manages information security risks. It connects responsibilities, risk assessment, selected controls, monitoring and improvement, with the aim of protecting information confidentiality, integrity and availability.

The standard can be applied by organisations of different sizes and sectors. Implementing an ISMS and obtaining independent certification are distinct steps; a reference to the standard alone does not demonstrate certification.

Variant: ISO27001. Family: Standards and frameworks.

Read the risk assessment guide · Discuss your ISMS needs

Reference: ISO — ISO/IEC 27001.

ITIL is a widely used framework for managing IT and digital services. Its practices help organisations organise service delivery, clarify responsibilities and improve outcomes for users and the business.

In daily operations, it can inform how a team handles incidents and requests, investigates recurring problems and prepares changes. The practices should be adapted to the organisation’s needs and risks rather than treated as a requirement to introduce a large administrative system.

ITIL is a management framework, not a ticketing product. A tool can support the practices, but responsibilities, decisions and review routines still need to be defined.

Historical expansion: Information Technology Infrastructure Library. Family: Service management frameworks.

Discuss your service management needs

Reference: PeopleCert — ITIL.