What Is IT Service Management? — IT Service Management

TL;DR

ITSM is about managing IT as services that help people get their work done, not only about keeping technology running.
ITIL (Version 5), published in early 2026, widens the scope from service management to digital product and service management (DPSM): building and running digital products and services as one whole.
ITIL is a body of guidance that organizations adopt and adapt. People can be certified in ITIL; organizations cannot. The certifiable standard for organizations is ISO/IEC 20000-1.
The ITIL Foundation (Version 5) exam has 40 multiple-choice questions in 60 minutes, closed book, and you need 26 correct (65%) to pass.
COBIT covers the governance of enterprise IT, and FitSM is a free, lightweight service management standard; they complement ITIL rather than compete with it.

What IT service management is

You use services every day without thinking about how they are run. A train company does not sell you a locomotive; it gets you from one city to another, on a timetable, with a ticket you can buy on your phone and someone to ask when the train is late. You care about the result — arriving on time — not about the rolling stock, the signaling system or the staff rosters behind it. The company, on the other hand, has to manage all of those things so that the result keeps happening.

IT works the same way. The people in a finance department do not want "a server with the billing application on it"; they want to send correct invoices to customers before the end of the month. IT service management (ITSM) is the discipline of planning, delivering, supporting and improving IT as services that help people reach results like that. It covers the technology, but also the agreements, the support, the way changes are made and the way problems are learned from.

Service management versus running technology

An IT team that "just runs technology" measures itself by the state of its components: servers are up, disks have free space, the network is green. A team that practices service management asks a different question: can the people who depend on us do what they need to do? The two answers are not always the same. All monitoring dashboards can be green while customers cannot pay their bills, because a certificate at an external payment provider expired and nobody was watching the whole chain.

Technology-focused IT	Service-focused IT
"The database server was up 99.9% of the time."	"Customers could log in and see their invoices 99.9% of the time."
Work arrives by email, phone and hallway conversations.	Work arrives through known channels and is recorded, prioritized and tracked.
Changes are made when an engineer has time.	Changes are assessed for risk and scheduled so that users are not surprised.
The same failure is fixed again every month.	Recurring failures are investigated and their cause removed.

What goes wrong without it

Throughout this topic we follow Kestrel Energy, a fictional energy supplier with about 2,000 employees. Kestrel has a customer web portal and mobile app, a billing system, an internal IT department with a service desk, an operations team that runs a network operations center (NOC), and suppliers: a cloud provider, a data center where it rents rack space (colocation) and a telecom carrier.

A few years ago Kestrel's IT department was full of capable people, yet everyone was unhappy. Here is what that looked like, and what changed once the department started to manage its work as services.

Situation	Before	After
Getting help	Employees called whichever engineer they knew. Tomasz from the network team spent half his day on laptop questions.	One service desk with a phone number, a chat channel and a portal. Every request becomes a ticket with an owner.
Outages	IT learned that the customer portal was down from complaints on social media.	Monitoring raises an alert in the NOC, an incident is logged and customers see a status message within minutes.
Changes	A firewall change on a Friday evening broke the nightly payment file to the bank. Nobody knew who had made it.	Changes are recorded, their risk is assessed and they are scheduled away from the billing run.
Expectations	The billing team expected fixes "immediately"; IT thought "this week" was fine.	A service level agreement says what both sides can expect, and both review it every quarter.
Suppliers	When the telecom line failed, nobody could find the contract or the support number.	Supplier contracts, contacts and agreed response times are recorded and reviewed.

Nothing in the "after" column needs exotic technology. It needs agreements, a few well-run routines and the habit of looking at the whole service instead of one component. That is what service management provides, and the rest of this topic explains each part.

From service management to DPSM

For a long time, IT service management mostly described an internal IT department that ran services for the rest of the company: email, laptops, the network, business applications. Today many organizations also build digital products and offer them directly to customers. Kestrel's mobile app is designed, coded, released, run and supported by its own teams; customers never meet the IT department, but they meet the app every month.

ITIL (Version 5) responds to this by widening its scope. It speaks of digital product and service management (DPSM): the set of organizational capabilities needed to create value for customers through digital products and the services built on them. Products and services are managed together, across one shared lifecycle: study material for the new version describes the focus shifting between product management and service management as work moves from discovering an idea to supporting it in daily use. The ideas are explained on Value, Products and Services and The Product and Service Lifecycle.

In everyday conversation, "ITSM" remains the common name for the field, for the job titles and for the tools. DPSM is best understood as ITSM grown up: the same discipline, applied to everything an organization delivers digitally.

What ITIL is

ITIL is the most widely used body of guidance for IT service management, and now for digital product and service management. It started as the "IT Infrastructure Library"; today the name is mostly used on its own. ITIL is owned by PeopleCert, which also runs its exams. In training and certification it is styled ITIL (Version 5); colleagues will simply say "ITIL 5" or "the new ITIL".

Three things about ITIL are easy to misunderstand:

It is guidance, not a standard. ITIL describes good practice and explains why it works. It contains no list of requirements that an auditor can check, so an organization cannot be "ITIL certified". Individual people take ITIL exams; an organization that wants a certificate uses ISO/IEC 20000-1 (see below).
You adopt and adapt it. Nobody implements all of ITIL. A 20-person software company and a national energy supplier need very different amounts of process. ITIL expects you to take what helps and fit it to your situation.
It is not a tool. Products such as ServiceNow, Jira Service Management, TOPdesk or Freshservice support ITIL-style work, but buying one does not make an organization good at service management.

A short history

ITIL has been rewritten several times, each time reflecting how IT was organized in that period. You will meet terms from older versions at work, so it helps to know where they come from.

Version	Period	What characterized it
Original ITIL	Late 1980s	A large library of books from a UK government agency, written to make government IT more efficient.
ITIL v2	Around 2000	Consolidated into a few books; "Service Support" and "Service Delivery" introduced processes such as incident, problem and change management to a whole generation.
ITIL v3 and ITIL 2011	2007, revised 2011	The service lifecycle in five books: strategy, design, transition, operation and continual service improvement.
ITIL 4	2019	The service value system, value co-creation and 34 practices; more room for Agile and DevOps ways of working.
ITIL (Version 5)	Early 2026	Digital product and service management, one lifecycle for products and services, experience and sustainability as value factors, and AI built in from the start.

Version 5 was published in early 2026: the framework in January and the Foundation exam in February. It is being released in phases, module by module, and ITIL 4 remains available during the transition.

The certification path at a glance

Everything starts with ITIL Foundation (Version 5). It checks that you know and understand the vocabulary and the main models; it does not test whether you can run a practice. Foundation is the prerequisite for the higher qualifications, which combine into designations:

Designation	What you take after Foundation
ITIL Practice Manager	One Practice Manager module plus Transformation
ITIL Managing Professional	Product, Service, Experience and Transformation
ITIL Strategic Leader	Strategy and Transformation
ITIL Master (Version 5)	All three designations above

ITIL AI Governance (Version 5) is a separate extension without a prerequisite. A certificate has a renewal date three years after you earn it; you renew by collecting continuing professional development (CPD) points, by passing another ITIL exam or by retaking the exam.

The Foundation exam is built from seven categories:

Category	Weight
Key ITIL terms and definitions	30%
The ITIL Four Dimensions of Product and Service Management	10%
The ITIL Product and Service Lifecycle	10%
The ITIL Value System	40%
Value stream identification, mapping and management	5%
ITIL and AI	2.5%
ITIL and other frameworks	2.5%

ITIL is not alone. Several other frameworks deal with how IT is run, and organizations often combine them. They answer different questions.

ISO/IEC 20000

ISO/IEC 20000 is the international standard for service management. Its first part, ISO/IEC 20000-1, lists the requirements for a service management system: the policies, plans, processes and records an organization needs to plan, deliver and improve its services. Because the requirements are auditable, an organization can be certified against it by an accredited body — something ITIL cannot offer. The current edition is from 2018, with an amendment from 2024 that adds climate-related considerations. Organizations often use ITIL as the "how" and ISO/IEC 20000-1 as the proof that they do it.

COBIT

COBIT is a framework from ISACA, the professional association for IT audit and governance, for the governance and management of enterprise IT. Where ITIL explains how to run products and services, COBIT asks whether IT as a whole serves the goals of the enterprise and whether risks are under control. It is popular with auditors and risk managers. COBIT 2019 is the current published version; ISACA is introducing COBIT 7 and has announced that its COBIT Foundations certificate moves to COBIT 7 from late October 2026.

FitSM

FitSM is a free, lightweight family of service management standards, published under a Creative Commons license and first developed in the EU-funded FedSM research project for federated IT infrastructure. It offers a short set of requirements, a common vocabulary, a simple role model and templates. Small organizations, universities and research infrastructures use it when ITIL or ISO/IEC 20000 would be too heavy. The current core documents are version 3.0. People can be certified, and organizations can be certified against FitSM-1 through an audit-based scheme.

Name	Type	Main question	Can an organization be certified?
ITIL (Version 5)	Body of guidance	How do we create value with digital products and services?	No (people can)
ISO/IEC 20000-1	International standard	Does our service management system meet the requirements?	Yes
COBIT	Governance framework	Is enterprise IT governed and managed in line with business goals and risk?	No (people can; assessments are possible)
FitSM	Free lightweight standard	What is the minimum we need to manage services properly?	Yes, through an audit-based scheme against FitSM-1 run with APMG International; this is separate from ISO/IEC 20000-1 certification (people can also be certified)

DevOps, Agile and PRINCE2

Ways of working such as DevOps, Agile and site reliability engineering, and project management methods such as PRINCE2, are not alternatives to ITIL either. They describe how teams build and change things quickly and safely, or how projects are run; ITIL describes how the whole organization turns that work into value. How they fit together on the job is described on ITSM in Practice, and the delivery side on DevOps and CI/CD.