Which practice has the purpose of protecting the information the organization needs in order to conduct its business?
ITIL 4 Foundation, objective 6. Purpose and key terms of 15 ITIL practices medium
Draft — not checked yet. This question was written from the published exam objectives and cites the clause it comes from, but nobody has yet read it against that clause and signed for it.
It is kept out of search results and out of mock exams until they have. Read the source below before you take the answer as settled.
The options
Not correct Service configuration management
Service configuration management ensures accurate and reliable information about services and their configuration items is available when needed. Its concern is accuracy and availability of configuration data, not protection of business information generally.
Correct Information security management
Correct. Its purpose is to protect the information the organization needs to conduct its business, which includes protecting confidentiality, integrity and availability as well as authentication and non-repudiation.
Not correct Continual improvement
Continual improvement aligns the organization's practices and services with changing business needs through ongoing improvement. Security controls may be improved through it, but protection is not its purpose.
Not correct IT asset management
IT asset management plans and manages the full lifecycle of IT assets to maximize value and control cost and risk. It protects the financial and contractual position, not the information itself.
Why
Information security management is stated in terms of the information, not the technology: the objective is protection of what the business needs to operate. Availability appears here as a security property, which is why it must not be read as duplicating the availability targets that service level management agrees with the customer.
Where this comes from
- Cited
- ITIL 4 syllabus clause 6
- What it says
- Information security management protects the information needed by the organization to conduct its business.
Practise this
Reading one question is not practice. The trainer will draw a set from objective 6 and space the ones you get wrong.