IT service management and cloud computing: a practical modernisation guide
IT service management (ITSM) in cloud computing means running cloud-based IT as a set of managed services, with clear owners, service levels and processes for incidents, changes, requests and problems. Frameworks such as ITIL 4 describe the practices. The cloud changes how fast resources appear and disappear, so the processes must be automated to keep up.
Key takeaways
- ITSM is how IT is designed, delivered, supported and improved as services that users can rely on. Cloud computing is how many of those services are now hosted.
- ITIL 4 replaced the older five-stage lifecycle with a service value system and 34 management practices. PeopleCert now also offers ITIL (Version 5).
- NIST SP 800-145 defines cloud computing by five essential characteristics, three service models and four deployment models.
- In the cloud, responsibility is shared with the provider. Your ITSM processes must cover the part you own.
- The practices that change most are change enablement, configuration management, monitoring and cost control. All of them need automation.
What is IT service management?
IT service management is the discipline of running IT as services with agreed outcomes, rather than as a collection of servers and tickets. A service has an owner, users, a service level and a defined way to request help or changes.
The most widely used framework is ITIL. When ITIL 4 launched in 2019, PeopleCert notes, it came with guidance for 34 management practices, among them incident management, organisational change management and deployment management. ITIL 4 moved away from the ITIL v3 lifecycle of service strategy, design, transition, operation and continual improvement, and organises the work around a service value system and value streams instead.
ITIL is now owned by PeopleCert, which acquired AXELOS. PeopleCert's ITIL certification page lists both ITIL 4 and the newer ITIL (Version 5), with a bridge course for ITIL 4 holders. If your team is ITIL 4 trained, the practices below still apply. The standard for certifying a service management system is ISO/IEC 20000-1:2018.
The core ITSM practices most teams start with are:
- Service desk. One point of contact for users.
- Incident management. Restore normal service as quickly as possible.
- Problem management. Find and remove the root causes of incidents.
- Change enablement. Make changes quickly while controlling risk.
- Service request management. Handle standard requests such as access or new environments.
- Service level management. Agree targets with the business and report against them.
- Service configuration management. Know which components make up each service and how they connect.
The basics of cloud computing for service managers
The reference definition comes from NIST SP 800-145: cloud computing is a model for on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort or provider interaction. NIST describes it through five essential characteristics, three service models and four deployment models.
| NIST element | Items | What it means for ITSM |
|---|---|---|
| Essential characteristics | On-demand self-service, broad network access, resource pooling, rapid elasticity, measured service | Resources change by the minute, so manual records and approvals fall behind quickly |
| Service models | IaaS, PaaS, SaaS | The higher the model, the more the provider runs and the more your work shifts to vendor and contract management |
| Deployment models | Private, community, public, hybrid | Hybrid estates need one service view across on-premises and cloud |
Shared responsibility
Cloud providers run part of the stack for you. The AWS shared responsibility model separates security "of" the cloud, which AWS covers (hardware, software, networking and facilities), from security "in" the cloud, which the customer covers. Azure and Google Cloud use the same idea. Your ITSM processes must clearly cover your side: identities, configuration, data, patching of what you run, and the response to incidents in your accounts.
Why combine ITSM and cloud computing?
Because cloud without service management becomes hard to control, and service management without cloud automation becomes a bottleneck. Combining them gives you speed with accountability.
- Faster delivery. Standard requests such as a new environment can be fulfilled automatically from the service catalogue.
- Fewer surprises. Monitoring linked to incident management opens tickets before users notice a problem.
- Better audits. Changes made through pipelines leave a record of who approved what and when, which supports GDPR, NIS2 and ISO 27001 evidence.
- Cost visibility. Tagging and ownership data in the CMDB let you assign cloud spend to services and teams.
How ITSM practices change in the cloud
| Practice | Traditional data centre | Cloud |
|---|---|---|
| Change enablement | Change advisory board reviews most changes | Pre-approved standard changes run through CI/CD with automated tests; only high-risk changes go to review |
| Configuration management | CMDB updated by hand after changes | CMDB fed by cloud APIs, tags and infrastructure as code |
| Incident management | Users report most incidents | Monitoring and alarms create incidents automatically, often with runbooks attached |
| Capacity management | Hardware bought years ahead | Autoscaling and regular rightsizing reviews |
| Supplier management | Hardware and support contracts | Cloud provider SLAs, marketplace software and managed service partners |
| Financial management | Annual capital budget | Monthly variable spend that needs FinOps practices |
How to implement ITSM for cloud services
- Define your services. List the business services that run in the cloud, with owners, users and dependencies. Start with the ones that would hurt most if they failed.
- Agree service levels. Set targets for availability, response and resolution that match each service's importance. Check them against the cloud provider's own SLAs, which cover only the provider's part.
- Connect monitoring to incidents. Route alerts from CloudWatch, Azure Monitor or your observability tool into the ITSM platform, with severity rules and on-call rotas.
- Automate change. Define standard changes that are deployed by pipeline, with tests as the control. Keep manual review for changes that are new or high risk.
- Keep configuration data accurate. Populate the CMDB from infrastructure as code, tags and cloud APIs, not from spreadsheets.
- Build the service catalogue. Offer common requests, such as access, environments or backups, as self-service items with automated fulfilment.
- Review and improve. Run problem reviews after major incidents and report service levels monthly. Feed findings into the backlog.
Choosing a cloud provider with ITSM in mind
When you compare AWS, Azure and Google Cloud, look beyond compute and storage. Check how each provider's SLAs are defined and credited, which support plan you need for your response times, how well its monitoring and event services integrate with your ITSM tool, and which regions meet your data residency requirements.
What Are the Best Practices for IT service management in the cloud?
- Tag everything. Owner, service, environment and cost centre tags make incident routing and cost reporting possible.
- Treat infrastructure as code as your change record. A merged pull request with passing tests is better evidence than a ticket filled in after the fact.
- Use the provider's guidance. The AWS Well-Architected operational excellence pillar covers runbooks, observability and learning from failure in a way that maps well to ITSM practices.
- Measure what users feel. Track availability, time to restore service and request fulfilment time, not only ticket counts.
- Train both sides. Service managers need to understand cloud services, and cloud engineers need to understand why change and incident records matter.
- Decide what to outsource. Many organisations keep service ownership in-house and buy 24/7 monitoring and operations from a managed cloud services partner.
How Opsio helps
Opsio runs cloud estates on AWS and Azure as managed services, with 24/7 cloud monitoring and support, change management and security operations. We also help with cloud migration when services still sit in your own data centre.
Opus Bilprovning, one of Sweden's largest vehicle inspection companies with about 100 stations and roughly two million inspections a year, uses Opsio for 24/7 managed operations on AWS. Day to day that means proactive monitoring, change management and continuous security hardening, with one defined point of accountability across the AWS estate.
Frequently asked questions
What are the basics of service management in cloud computing?
Define each cloud service with an owner and service level, connect monitoring to incident management, automate standard changes through pipelines, keep configuration data accurate from cloud APIs and infrastructure as code, and review performance and problems regularly.
Is ITIL still relevant for cloud environments?
Yes. ITIL 4 practices such as incident, change and service level management apply to cloud services. The main difference is that cloud teams automate many controls inside pipelines instead of handling them through manual approvals. PeopleCert also now offers ITIL (Version 5).
What is the difference between ITSM and cloud management?
Cloud management covers provisioning, configuring, securing and optimising cloud resources. ITSM covers how those resources are delivered and supported as services, including service levels, incidents, changes and requests. Most organisations need both, linked by shared data.
What are the best practices for IT service management?
Know your services and owners, agree measurable service levels, automate routine requests and changes, keep configuration data current, learn from every major incident and report results the business understands.
Who is responsible for security in the cloud?
Responsibility is shared. The provider secures the underlying infrastructure. You secure what you deploy on it, including identities, configuration, data and applications. Your ITSM processes should cover incidents and changes on your side of that line.
Related reading
Related Articles
About the Author
Editorial standards: This article was written by a certified practitioner, named in the byline above. We revise it when the technology or regulation it covers changes; the dates above show the latest update. Opsio maintains editorial independence — we recommend solutions on technical merit, not commercial relationships.
