What is ITIL?
ITIL (Information Technology Infrastructure Library) is a globally used framework of best practices for IT service management (ITSM) that describes how an organisation designs, delivers, manages and continually improves IT services so that they create value for the business. ITIL is neither a law nor a standard an organisation can be certified against; it is a body of practical guidance that you adapt to your own organisation. The framework originated in the late 1980s within the UK government and is now owned by PeopleCert. A growing number of industrial companies also apply ITIL practices such as incident, change and configuration management to OT systems like SCADA, PLCs and HMIs.
ITIL describes best practices to align IT services with the needs of the business in a structured, scalable and customer-focused way.
🕰️ How did ITIL originate and which versions exist?
ITIL started as a series of books from the UK government agency CCTA, which captured good practice in government IT in the late 1980s. Several major revisions followed:
| Version | Year | Characteristics |
|---|---|---|
| ITIL v1 | late 1980s | Dozens of separate books per topic, strongly focused on government IT |
| ITIL v2 | 2000–2001 | Consolidated around Service Support and Service Delivery; incident, problem and change management as processes |
| ITIL v3 / ITIL 2011 | 2007 and 2011 | Five lifecycle stages (Service Strategy, Design, Transition, Operation, Continual Service Improvement); the 2011 edition has 26 processes |
| ITIL 4 | February 2019 | Value-driven Service Value System, four dimensions and 34 practices; aligned with Agile, DevOps and LEAN |
| ITIL (Version 5) | February 2026 | Keeps the 34 practices, with more emphasis on digital products, value streams and responsible use of AI |
Ownership changed along the way. From 2013, AXELOS, a joint venture of the UK Cabinet Office and Capita, managed the framework. In July 2021 PeopleCert completed its acquisition of AXELOS, including ITIL and PRINCE2. ITIL 4 and ITIL (Version 5) run in parallel for at least twelve months, and an existing ITIL 4 Foundation certificate remains valid.
🧱 What are the building blocks of ITIL 4?
ITIL 4 replaces the rigid lifecycle of v3 with the Service Value System (SVS): a model showing how all parts of an organisation work together to create value. The SVS has five components:
- Seven guiding principles: focus on value; start where you are; progress iteratively with feedback; collaborate and promote visibility; think and work holistically; keep it simple and practical; optimise and automate
- Governance: how the organisation is directed and controlled
- Service value chain: six activities, namely plan, improve, engage, design and transition, obtain/build, and deliver and support
- Practices: 34 sets of organisational resources for a particular area of work
- Continual improvement: a recurring improvement model, related to the PDCA cycle
In addition, you should consider every service from four dimensions: organisations and people, information and technology, partners and suppliers, and value streams and processes. A new SCADA service that works technically but lacks trained operators or a sound supplier contract is therefore not finished in ITIL terms.
| Concept | Explanation |
|---|---|
| Service | A means of enabling value co-creation by facilitating outcomes that customers want to achieve, without the customer having to manage specific costs and risks |
| Value | The benefit and usefulness a service delivers to the user or organisation |
| Process | A set of interrelated activities that transforms inputs into outputs to achieve an objective |
| Practice | A combination of people, processes, information and tools for an area of work |
| Configuration item (CI) | Any component that needs to be managed in order to deliver a service |
| Continual improvement | Cyclical improvement based on measurement and feedback |
🔄 Which ITIL practices matter most?
The 34 practices of ITIL 4 fall into three groups: 14 general management practices (such as strategy, architecture, risk and information security management), 17 service management practices and 3 technical management practices (deployment management, infrastructure and platform management, and software development and management). For day-to-day operations these are the most widely used:
| Practice | Purpose | Application in OT |
|---|---|---|
| Incident Management | Restore normal service as quickly as possible | A failed HMI, lost communication with a PLC |
| Problem Management | Find and remove underlying causes | Root Cause Analysis after repeated downtime |
| Change Enablement | Assess, authorise and schedule changes | Firmware update, modified PLC logic; see Change Management |
| Service Request Management | Handle standard requests | New engineering account, extra SCADA client |
| IT Asset Management | Manage the lifecycle and cost of assets | Overview of all OT Assets and their support status |
| Service Configuration Management | Record configuration items and their relationships in a CMDB | Which PLC belongs to which production line and network segment |
| Monitoring and Event Management | Detect and assess events | Integration with an OT SOC or network monitoring |
| Information Security Management | Protect confidentiality, integrity and availability | Alignment with ISO 27001 and IEC 62443 |
ITIL 4 distinguishes three types of change: standard (pre-authorised, low risk), normal (assessed by a change authority) and emergency (implemented as soon as possible, with expedited authorisation). A Change Advisory Board is no longer mandatory for every change.
🏭 How do you apply ITIL in OT environments?
ITIL was written for IT, but its core questions apply in a plant too: who resolves a fault, who may change something and which systems do we have? In OT, however, the priorities shift. Availability and safety come before confidentiality, systems sometimes run for twenty years and changes are often only possible during a planned shutdown.
A practical approach in five steps:
- Start with the asset inventory: record OT assets in a CMDB or Asset Management system, including firmware version, owner and criticality. Without this overview, incident and change management are working in the dark.
- Create one incident process for IT and OT: with clear escalation to process engineers and suppliers, and priority based on impact and urgency. For a production line, high impact often means downtime or a safety risk.
- Link change enablement to MOC: let the change form ask whether the change affects process safety, so that the Management of Change procedure is triggered as well.
- Schedule patches and maintenance by agreement: patch management in OT follows the maintenance window and the supplier’s approval, not the monthly IT cycle.
- Involve suppliers: set out remote maintenance and service hours in contracts and assess suppliers against IEC 62443-2-4.
You can often see where it goes wrong in OT convergence: an IT service desk that treats a PLC fault as an ordinary ticket, or a monthly patch round that restarts an engineering workstation without consultation. A shared process with OT-specific categories, priorities and change authorities prevents this.
🔐 How does ITIL relate to standards and legislation?
ITIL itself is not a certifiable standard for organisations. If you want to demonstrate that you work according to ITIL principles, you get certified against ISO/IEC 20000-1 (current edition 2018), the international ISO standard for service management systems. Individuals can, however, obtain ITIL certificates, from Foundation up to ITIL Master.
| Framework | Relationship with ITIL |
|---|---|
| ISO/IEC 20000-1 | Certifiable service management standard; ITIL provides the practical implementation |
| ISO 27001 | Annex A contains controls for incident, change and asset management, among others, within an ISMS; ITIL processes provide the implementation and the evidence |
| IEC 62443 | OT security; requires a security programme with patch, change and incident management for the plant |
| NIS2 / Dutch Cybersecurity Act | Duty of care covering incident handling, business continuity and supply chain security, plus incident reporting within 24 hours |
| COBIT | Governance framework; defines what must be governed, while ITIL describes how |
Note that ITIL processes do not make you compliant automatically. An ITIL-based incident process does help you meet the deadlines of the Dutch Cybersecurity Act (early warning within 24 hours, notification within 72 hours, final report within one month), provided the reporting criteria are built into it. The act has applied since 15 August 2026. A well-run ITIL process also supplies the evidence needed for business continuity and compliance audits.
✅ What are the pros and cons of ITIL?
Benefits:
- A common language: IT, OT and suppliers mean the same thing by incident, problem and change
- Faster incident handling and fewer recurring faults thanks to problem management
- Clear roles and responsibilities, which simplifies audits and certifications
- Flexibly applicable, including in hybrid or industrial environments
Pitfalls:
- Bureaucracy: introducing all 34 practices at once buries you in forms; start small
- An IT view of OT: standard priorities and patch cycles do not fit production without adaptation
- Tool-driven adoption: an ITSM tool without process agreements only gives you a more expensive ticket list
❓ Frequently asked questions
Is ITIL mandatory?
ITIL is not legally mandatory: it is a framework of best practices that you apply voluntarily. Laws such as the Dutch Cybersecurity Act and standards such as ISO 27001 do require you to control incidents, changes and assets. ITIL is a widely used way to meet those requirements in practice.
Can an organisation be ITIL certified?
An organisation cannot be certified against ITIL itself; only individuals can obtain ITIL certificates. Organisations that want their service management certified use ISO/IEC 20000-1. ITIL and ISO/IEC 20000-1 fit together well.
What is the difference between ITIL 4 and ITIL (Version 5)?
ITIL (Version 5) was released in February 2026 and keeps the 34 practices of ITIL 4. The new version puts more emphasis on digital products, organisation-wide value streams and responsible use of AI. ITIL 4 remains valid for now, and you do not need to retake an ITIL 4 Foundation certificate.
What is the difference between ITIL and COBIT?
ITIL describes how you deliver and manage IT services day to day, such as incident and change management. COBIT is a governance framework that sets out which objectives and controls the board of an organisation should use to steer IT. Many organisations use COBIT for governance and ITIL for execution.
Is ITIL suitable for OT environments?
ITIL is suitable for OT, provided you adapt its priorities to production and safety. Changes in OT often fall within planned maintenance windows, patches require supplier approval and an incident can immediately pose a safety risk. You should therefore link ITIL change enablement to the plant’s Management of Change procedure.
What is the difference between an incident and a problem in ITIL?
An incident in ITIL is an unplanned interruption or reduction in the quality of a service, which you restore as quickly as possible. A problem is the underlying cause of one or more incidents, which problem management investigates and removes. This stops the same fault from coming back time after time.
📌 In summary
ITIL is the best-known framework for IT service management, with a Service Value System, four dimensions and 34 practices in ITIL 4. Since February 2026 there has also been ITIL (Version 5). In OT environments ITIL works well for asset, incident and change management, provided you take maintenance windows, process safety and suppliers into account. Certification goes through ISO/IEC 20000-1, and ITIL helps you put the requirements of ISO 27001, IEC 62443 and the Dutch Cybersecurity Act into practice.
ITIL is a globally recognised framework for making IT and OT service delivery structured, predictable and customer-focused, built on continual improvement.