Practicing the practices II: delivery, relationships and improvement

This lesson covers the second group of practices most often tested at Foundation: service level management, continual improvement, relationship management, supplier management, information security management, IT asset management, service configuration management, release management and deployment management. ITIL-141 taught most of them in depth. As in lesson 8, the focus here is on purpose statements, key terms and the distinctions that examiners test.

In ITIL 4 these practices sat in three groups: general management practices (continual improvement, information security, relationship and supplier management), service management practices (service level, IT asset, service configuration and release management) and technical management practices (deployment management). Version 5 regroups the 34 practices into general management practices and product and service management practices, and published summaries say deployment management and information security management move into the product and service group. The practice names and purposes stay largely the same, so the questions below work for either exam.

Service level management

Purpose: to set clear business-based targets for service levels, and to ensure that delivery of services is properly assessed, monitored and managed against these targets. The signature words are 'clear business-based targets'. Key ideas include service level agreements (SLAs), documented agreements between a service provider and a customer that identify both the services required and the expected level of service, and the importance of engaging with customers to understand what really matters to them.

ITIL warns about the watermelon effect: green on the outside, red on the inside. Service level reports can show every target met while customers are unhappy, because the targets measure the wrong things, such as system uptime instead of the outcomes users care about. Questions often test that SLAs should relate to defined outcomes, not just operational metrics, and that service level management gathers information from customer engagement, feedback surveys, operational metrics and business metrics.

Continual improvement practice

Purpose: to align the organization's practices and services with changing business needs through the ongoing improvement of products, services, practices, or any element involved in their management. Lesson 6 covered the continual improvement model and register. For the practice, remember that continual improvement is everyone's responsibility, that the register tracks ideas, and that the practice uses many methods, such as Lean, Agile and DevOps techniques, but warns against using too many at once.

Relationship management

Purpose: to establish and nurture the links between the organization and its stakeholders at strategic and tactical levels. It includes identifying, analyzing, monitoring and continually improving relationships with and between stakeholders. The signature words are 'establish and nurture links' and 'stakeholders at strategic and tactical levels'. A distractor might offer supplier management's purpose instead; relationship management covers all stakeholders, while supplier management is specifically about suppliers.

Supplier management

Purpose: to ensure that the organization's suppliers and their performance are managed appropriately to support the seamless provision of quality products and services. Key activities include creating a single point of visibility and control, maintaining a supplier strategy and policy, negotiating and agreeing contracts, managing relationships and performance, and identifying and managing supplier risks. Questions often describe a decision about outsourcing, contract terms or supplier performance and ask which practice it belongs to.

Information security management

Purpose: to protect the information needed by the organization to conduct its business. This includes understanding and managing risks to the confidentiality, integrity and availability of information, as well as other aspects of information security such as authentication (ensuring someone is who they claim to be) and non-repudiation (ensuring someone cannot deny that they took an action). The signature words are 'protect the information'. Questions often list confidentiality, integrity and availability and ask which practice is concerned with them.

The practice balances prevention, detection and correction. It must also balance protection with the need for innovation: excessive controls can slow the organization without making it much safer. Exam options using absolute words, such as 'information security must prevent all incidents', are distractors.

IT asset management

Purpose: to plan and manage the full lifecycle of all IT assets, to help the organization maximize value, control costs, manage risks, support decision-making about purchase, reuse, retirement and disposal of assets, and meet regulatory and contractual requirements. An IT asset is any financially valuable component that can contribute to the delivery of an IT product or service. Questions test the full lifecycle (from planning and purchase to disposal) and the link to cost and compliance, for example software license compliance.

Service configuration management

Purpose: to ensure that accurate and reliable information about the configuration of services, and the configuration items that support them, is available when and where it is needed. This includes information on how configuration items are configured and the relationships between them. A configuration item (CI) is any component that needs to be managed in order to deliver an IT service. The information may be held in a configuration management system or database.

The classic confusion is between IT assets and configuration items. Many items are both, but the definitions differ. An IT asset is defined by financial value; a configuration item is defined by the need to manage it to deliver a service. A laptop is an asset; whether it is also a CI depends on whether it must be managed to deliver a service. A service, a document or a contract can be a CI without being an asset in the usual sense.

Release management

Purpose: to make new and changed services and features available for use. A release is a version of a service or other configuration item, or a collection of configuration items, that is made available for use. ITIL notes that releases can be separated from deployments: components can be deployed to production but hidden behind feature flags until they are released to users. In agile and DevOps environments, releases tend to be small and frequent.

Deployment management

Purpose: to move new or changed hardware, software, documentation, processes or any other component to live environments. It may also be involved in deploying components to other environments for testing or staging. ITIL describes several approaches, including phased deployment (to parts of the production environment at a time), continuous delivery (components integrated, tested and deployed when needed), big bang deployment (to all targets at the same time) and pull deployment (users download software when they choose).

Release and deployment are a favorite pair for distractors. Deployment moves components to environments; release makes services and features available to users. The same software can be deployed weeks before it is released, if a feature flag hides it. If a question describes moving components into a live environment, choose deployment management; if it describes making a feature available to users, choose release management.

Practices in Version 5 summaries

Published summaries of Version 5 say the practice guides remain largely unchanged at first and will be updated during 2026, and that the Foundation exam uses selected practice terminology rather than requiring detailed knowledge of every practice. For candidates, this means the purposes and key terms in lessons 8 and 9 remain the core of practice preparation for either edition. If your syllabus lists a practice not covered here, read its purpose and key terms in your exam materials and add it to your flashcards.

# Purpose-statement matcher: signature phrases for nine practices
purposes = {
    "service level management": ["business-based targets"],
    "continual improvement": ["align", "changing business needs"],
    "relationship management": ["nurture the links", "stakeholders"],
    "supplier management": ["suppliers and their performance"],
    "information security management": ["protect the information"],
    "IT asset management": ["full lifecycle of all IT assets"],
    "service configuration management": ["accurate and reliable information about the configuration"],
    "release management": ["make new and changed services and features available"],
    "deployment management": ["move new or changed", "live environments"],
}
statements = [
    "To protect the information needed by the organization to conduct its business",
    "To make new and changed services and features available for use",
    "To move new or changed hardware and software to live environments",
    "To set clear business-based targets for service levels",
    "To establish and nurture the links between the organization and its stakeholders",
]
for st in statements:
    low = st.lower()
    match = max(purposes, key=lambda p: sum(k.lower() in low for k in purposes[p]))
    print(f"{match:<32} <- {st[:58]}")

information security management  <- To protect the information needed by the organization to c
release management               <- To make new and changed services and features available fo
deployment management            <- To move new or changed hardware and software to live envir
service level management         <- To set clear business-based targets for service levels
relationship management          <- To establish and nurture the links between the organizatio

Practice set

Remembering nine purposes

Nine purpose statements are a lot to hold in memory, so group them. Service level management, relationship management and supplier management are all about relationships and agreements: with customers, with stakeholders and with suppliers. Information security, IT asset and service configuration management are all about protecting and knowing what the organization has: its information, its financially valuable assets and the components that deliver services. Release and deployment management are about getting change into use. Continual improvement stands alone and links to everything.

Lena used these three groups as a memory frame. When she met a purpose statement, she first decided which group it belonged to, then which practice within the group. Narrowing the choice to two or three practices in this way made the signature words easier to spot, and her accuracy on practice purpose questions rose noticeably within a week.