We help IT Professionals succeed at work.

Is ITIL an audit benchmark for vulnerability management

Medium Priority
Last Modified: 2012-03-15
Is ITIL more geared towards audit as opposed to vulnerability assessment?
Say for example if you looked at a set of web servers and found they were insecure due to multiple vulnerabilities, it is really an "as is" type review, as opposed to an "how things came to be this way", which I guess ITIL procedures could provide?

So could ITIL be used to identify "How things came to be that way" for security issues? If so are there any specific ITIL modules that focus specifically on security and security management?
Watch Question

ITIL is not security or security management course! it is a library of best practices and guidelines on how to develop and maintain you IT systems and make it align with business.

It contains modules about managing your services you offer to your clients or customers, how to develop them, provide them, maintain SLA and enhance your services continually.

if your looking for security audit and vulnerability, check CompTIA Sercurity+, CISM, or CISSP. these will help you alot.


What I was getting at however was, a pen test or vuln assessment just shows "as is - i.e. here are your security weaknesses", not "how this came to be - through poor patch mgmt/hardening/account mgmt these problems arose".

My question is what do you check to identify "how this came to be", what benchmarks or platofrms can be used in this area? ITIL seems to have access mgmt, account mgmt, patch mgmt etc.

I dont think waiting for a vuln assessment to flag up problems then apply quick fixes is a very good practice at all. They should serve as assurance or identify anything overlooked, but not be the justifacation to start doing things properly.


And im not after a course of qualifacation either.

No ITIL don't have Access management, account managemnt, patch management, .... it might talk about for better system development. if you are looking for such tools or references you should check ISO standards, or refer to the mentioned above courses they have what you need.


Any specific ISO standard?

I am after the management processes and a benchmark that can be used that will identify "How things came to be so insecure".

Surely there must exist such in the year 2012.

I am thinking NIST may be more what we are after.


Yup NIST is one of the standards organizations and you can follow their standards and procedures.

For ISO refer to ISO 27000 standards, below is the link:

Explore More ContentExplore courses, solutions, and other research materials related to this topic.