Frameworks and standards
IT frameworks and standards, explained simply
ITIL, COBIT, ISO/IEC 20000, ISO/IEC 27001, DevOps: if these names are new to you, or you hear them often but are not quite sure how they fit together, this guide is for you.
Start here
Frameworks, standards and methods: what is the difference?
They all capture good practice, but they work in different ways, and that affects how you use them.
A framework is a body of guidance you adopt and adapt. There is no pass or fail for an organisation; you take what helps. ITIL, COBIT and VeriSM are frameworks.
A standard sets out requirements that an organisation can be formally audited and certified against by an accredited certification body. ISO/IEC 20000 and ISO/IEC 27001 are international standards.
A method or approach describes a way of working. PRINCE2 is a project management method; DevOps and Agile are approaches to delivering work.
Most organisations end up using a combination. A common pattern is ITIL to shape day-to-day service management, ISO/IEC 20000 or ISO/IEC 27001 where formal certification is needed, COBIT to govern the whole picture, and DevOps or Agile for how change is delivered.
Certification: two different things
People can take exams to show they understand a framework, for example ITIL Foundation or COBIT Foundation. These are awarded through the framework owner or its examination partners.
Organisations can only be certified against standards, such as ISO/IEC 20000-1 or ISO/IEC 27001. This is done by independent certification bodies, which in the UK are accredited by UKAS.
There is no such thing as an “ITIL certified organisation”. An organisation can align with ITIL, and its people can hold ITIL certifications.
The guides
Choose a framework or standard
Service managementITILThe world’s most widely used guidance for managing IT and digital products and services.Read moreGovernanceCOBITISACA’s framework for governing and managing enterprise information and technology.Read moreStandardISO/IEC 20000The international standard for service management, which organisations can be certified against.Read moreSecurity standardISO/IEC 27001The international standard for information security management systems.Read moreWays of workingDevOpsA culture and set of practices that bring development and operations together to deliver change quickly and safely.Read moreService managementVeriSMA flexible approach to service management for the digital age, built around the whole organisation.Read moreProject managementPRINCE2A structured, widely used method for managing projects of any size, popular across the UK.Read more
How they fit together
A simple map
COBITDirection and controlSets how IT is governed: who decides, how risk is managed, and how performance is measured against business goals.
ITIL, VeriSM, ISO/IEC 20000Running servicesShape how services are designed, delivered, supported and improved every day, with ISO/IEC 20000 adding formal certification.
ISO/IEC 27001Protecting informationManages information security risk in a structured way, and works best when it shares processes with service management.
DevOps, Agile, PRINCE2Delivering changeCover how new and changed services are built and delivered, whether continuously or as structured projects.
Common questions
Which one do we need?
We are new to all this. Where should we start?
For most IT teams, ITIL is the natural starting point because it covers the everyday work of supporting users and running services. A short maturity assessment will show which practices to focus on first.
Do we have to choose just one?
No. They are designed to complement each other, and most mature organisations use several. The skill is in combining them without duplicating effort, for example running one set of processes that satisfies both ISO/IEC 20000 and ISO/IEC 27001.
Our customers are asking for ISO certification. What does that involve?
You build a management system that meets the requirements of the standard, run it for a period to produce evidence, and are then audited by an accredited certification body. We help organisations prepare; the certification body performs the audit.
Are these frameworks only for IT?
They started in IT, but many of the ideas apply to any service: HR, facilities, finance and customer service teams increasingly use them. VeriSM in particular takes an organisation-wide view.
Information on these pages was last reviewed in November 2026. Frameworks and certification schemes change over time, so always check the owner’s website before booking an exam.
Want help choosing the right mix?
Book a free scoping call and we will help you work out which frameworks and standards fit your goals, and where to begin.