Most organizations without a formal ITSM practice describe their IT function the same way: "IT handles it." Someone submits a request, someone in IT deals with it, and there's no real distinction between a five-minute password reset and a two-week system migration — both are just "IT doing IT things." ITSM is what replaces that undifferentiated model with something an organization can actually measure and manage. This article covers what ITSM is, how ITIL relates to it, and why treating IT as a set of defined services rather than an undifferentiated function changes what an organization can do with it.
What ITSM actually is
IT service management is the practice of treating IT as a set of defined, deliverable services rather than an undifferentiated function that "handles things." Under an ITSM model, IT publishes a service catalog — a defined list of what IT actually offers, from "provision a new laptop" to "restore a file from backup" to "onboard a new employee's accounts" — with defined processes for how each service is requested, fulfilled, and supported, and metrics for how well each one is actually being delivered.
The shift is from "IT does whatever comes in" to "IT delivers a specific, named set of services, each with an expected process and an expected level of performance." A request for a new laptop and a request to investigate a network outage aren't the same kind of work, and ITSM formalizes that distinction instead of routing both through the same undifferentiated queue.
How ITIL relates to ITSM
ITIL (the IT Infrastructure Library) is the most widely adopted framework and body of best-practice guidance for implementing ITSM. It provides structure for core practices — incident management, change management, problem management, service request fulfillment — and a shared vocabulary for describing them.
It's important to be precise about what ITIL is not. ITIL is not a certification requirement for most organizations, and adopting ITSM does not mean an organization needs staff with formal ITIL certifications or needs to implement every practice ITIL describes. ITIL functions the way NIST CSF functions in cybersecurity — a widely recognized structure that organizes practice and gives teams a common vocabulary, without being a mandate that has to be adopted wholesale or certified against. An organization can run a genuinely mature ITSM practice by adopting the ITIL concepts that fit its size and needs, without ever pursuing formal certification.
Why formalizing IT as services changes how it's managed
The practical value of a service-oriented view is measurement. When IT is an undifferentiated function, there's no way to answer questions like "which of the things IT does are we actually doing well, and which are we struggling with?" — because there's no defined boundary around any individual "thing." Everything blurs into a single, undifferentiated stream of tickets, and everything feels equally urgent because nothing is prioritized against a defined standard.
Once IT is organized as a catalog of discrete services, each with its own defined process and expected performance, an organization can actually measure delivery — how long password resets take against a target, how often change-related incidents occur, which services are chronically underperforming their targets. That measurement is what makes continuous improvement possible: an organization can only decide where to invest in fixing a broken process if it can first identify which process is actually broken, rather than guessing based on which complaints were loudest recently.
Formalizing isn't about paperwork
The goal of a service catalog and defined processes isn't documentation for its own sake. It's the mechanism that turns "IT feels slow" into "the hardware provisioning service is missing its target 40% of the time, and here's why" — a specific, actionable finding instead of a vague impression.
Common mistakes
- "ITIL theater" — adopting ITIL terminology without any real process change behind it. Renaming a ticket queue's status fields to match ITIL vocabulary, without a real incident management process, change advisory function, or service catalog behind it, produces the appearance of ITSM maturity without the substance.
- Treating ITSM adoption as an all-or-nothing initiative. An organization doesn't need to implement every ITIL practice simultaneously — adopting incident management and a basic service catalog first, then expanding into change and problem management, is a more sustainable path than attempting a full framework rollout at once.
- Building a service catalog nobody uses to actually request services. A catalog that exists as a document but isn't the actual channel employees use to request IT services doesn't change behavior — it just adds a document that quickly goes stale.
- Measuring activity instead of service delivery. Counting tickets closed is not the same as measuring whether services are being delivered against a defined standard — volume metrics without a quality or timeliness standard behind them can look good while service quality is actually declining.
FAQ
Do we need to be ITIL certified to practice ITSM? No. ITIL certification is relevant for individuals pursuing that specific credential, but an organization does not need any staff to be ITIL-certified in order to run a mature ITSM practice. ITIL is best-practice guidance and shared vocabulary, not a compliance requirement.
Is ITSM only relevant for large enterprises with dedicated IT departments? No — the core idea, treating IT as a defined set of services rather than an undifferentiated function, scales down. A smaller organization's service catalog will be shorter and its processes lighter-weight, but the same structure still produces the same benefit: the ability to measure and improve what IT actually delivers.
What's the difference between ITSM and ITIL? ITSM is the practice — the discipline of managing IT as services. ITIL is one specific, widely-adopted framework for how to implement that practice. An organization can practice ITSM using ITIL concepts, a different framework, or a custom approach built from first principles.