ITIL 4 5.1.3: 5.1.3 Information security management

Guards the information the organization relies on to do business by understanding and managing risks to its confidentiality, integrity and availability, and to other security aspects such as authentication and non-repudiation. It uses policies, processes, behaviour, risk management and controls, balancing prevention with detection and correction, and balancing protection against room to innovate. It needs processes for handling security incidents, managing risk, reviewing and auditing controls, managing identity and access, managing events, penetration testing and vulnerability scanning, and handling changes that affect security (firewall configuration, for example). Security is weighed in all planning and improvement, recorded as a requirement in engage, built into every service and component during design and transition and obtain/build, and detected and put right in deliver and support.