ITSM tool selection comes down to the order of work, which is also the short answer to how to choose an ITSM tool. Agree your processes first, rank your requirements in tiers, then score every shortlisted tool on the same scenarios built from your own tickets. Check Arabic and right-to-left behaviour, data hosting, full cost and exit terms before you sign. An ITIL accreditation helps you shortlist, but it does not replace testing.
ITSM tool selection starts with scope and process
Write down what the tool must run before you look at a product. For ITSM tool selection that means who raises tickets, which practices you need now and later, which languages people work in, how many agents will use it, and whether HR or facilities will run their own queues. Each answer changes the requirements.
Then check that the processes exist. If you cannot yet say how tickets are prioritised, who approves a change to production or when a repeat fault becomes a problem, the tool will supply its own defaults, and ITSM tool selection turns into choosing someone else’s process. The guide to incident, problem and change management covers the practices most tools are built around.
Organisations that want help with ITSM tool selection at this stage can use WASNA Digital Solutions’ ITSM implementation and tooling selection, which defines requirements first, then compares tools against them.
ITSM tool requirements in three tiers
PeopleCert, which acquired ITIL’s publisher AXELOS in 2021, groups ITSM tool capabilities into three clusters: monitor, support and fulfil; plan, implement and control; and collaborate, assure and improve. It also assesses platform areas such as workflow management, reporting, integration, security and customisation, as its ITSM tool capabilities page explains. That grouping makes a practical skeleton for your own ITSM tool selection list.
| Area | What the requirement should say | How to test it |
|---|---|---|
| Monitor, support and fulfil (incidents, requests, problems) | Ticket channels; separate forms and approvals for requests; links from incidents to problems and known errors | Log an incident, link a repeat, open a problem and show the known error to an agent |
| Plan, implement and control (change, release, assets) | Standard, normal and emergency change routes with different approvals; a change calendar; links to the services and assets affected | Raise one normal and one emergency change and show who approves each |
| Collaborate, assure and improve (service levels, improvement) | Service level clocks that use your working calendars and can pause; reports managers can read without an export | Breach a target on purpose and produce the monthly report |
| Platform (workflow, reporting, integration, security, customisation) | Single sign-on; role-based access; an audit trail; links to monitoring, HR and asset sources; form and workflow edits by your own administrator | Have your administrator edit a form and a workflow without vendor help |
Mark every requirement as must, should or later. In ITSM tool selection, a must is something without which you cannot run a chosen process, meet a contractual service level or meet a rule you are subject to. Keep the musts short. If most requirements are musts, the scores will not separate the tools.
If asset records will live in the tool, decide the minimum record for each asset first. The IT asset management checklist lists what to capture.
What accreditation tells you in ITSM tool selection
PeopleCert runs a Tool Vendor Accreditation programme that assesses ITSM software for alignment with ITIL and publishes a list of accredited vendors. Its accreditation FAQ suggests buyers consult that list.
The same FAQ states the limit: accreditation does not give a single indicator of how far a vendor or its tool supports ITIL practices, and PeopleCert’s capabilities page advises adding criteria of your own. When you work out how to choose an ITSM tool, use accreditation to shorten the longlist, not to pick the winner. Ask which practices were assessed, at what level, when, and against which ITIL version. PeopleCert’s programme announcement refers to ITIL 4, and PeopleCert has since released ITIL (Version 5), so the version matters.
ITSM tool evaluation criteria that test rather than tick
How to choose an ITSM tool by scoring scenarios, not features
A feature checklist records what a product claims. For ITSM tool selection, scenarios built from your own ticket history show what it does. Pick six to eight from the last quarter and send the same list to every vendor before the demo. Candidates:
- a high-priority outage, from first report to closure, with escalation
- a repeat incident that should lead to a problem record
- a normal change and an emergency change, each with its approval route
- a new starter request with approvals and tasks for several teams
- a service level breach and the report that shows it
- a ticket raised in Arabic that contains English product names and numbers
Ask the vendor to run each scenario live. Then trial the best two or three with your own agents and administrator doing the work. Demos hide the effort of configuration, and a trial shows it.
Score each scenario from 0 to 3 against what you wrote, weight the scores by tier and have each panel member score separately before comparing. Service desk software selection goes wrong when one person’s impression outweighs the written criteria, which is why ITSM tool selection should end with scores on paper.
Arabic, right-to-left and calendar questions
“Supports Arabic” is not an answer in ITSM tool selection. Ask the vendor to show each of these in the trial:
- The portal, emails and notifications in Arabic with right-to-left layout, while an agent works in English on the same ticket.
- Mixed text, such as an Arabic subject line containing an English product name, a ticket number and a file path. The W3C explains that text of opposite direction can display in the wrong order unless each phrase is isolated with markup that sets its direction, especially next to punctuation or numbers.
- Search, reports and exports that keep Arabic text intact, including when a report is opened in a spreadsheet.
- Knowledge articles and the service catalogue in both languages, and who maintains the translations.
- Service level calendars that follow your working week, shifts, public holidays and any change in hours during Ramadan, with Hijri dates if you need them.
Hosting, data and security questions
Hosting and data location belong in ITSM tool selection because ticket records identify people. SDAIA’s guide to the Personal Data Protection Law (PDPL) quotes Article 1(4), which defines personal data as any data that may lead to identifying an individual, and says a controller must ensure that any processor it engages fully complies with the PDPL. Names, phone numbers, device details and attachments in tickets may all fall within that definition. Put these questions to each vendor and take the answers to your data protection and legal advisers:
- Where are production data, backups and support copies held, and from where can vendor staff see ticket content?
- Is the service dedicated to you or shared, and how is your data kept separate from other customers’?
- Does any personal data leave the Kingdom, and on what basis? SDAIA’s guide lists a Regulation on Personal Data Transfer outside the Kingdom as part of the PDPL framework.
- Can all tickets, attachments and audit history be exported in a usable format when the contract ends, and when is your data deleted afterwards?
- Which independent assurance applies, such as certification to ISO/IEC 27001 (requirements for an information security management system), and does its scope cover the service you are buying?
The National Cybersecurity Authority’s Essential Cybersecurity Controls (ECC-2:2024) state that they apply to government agencies and their affiliated companies and entities, and to private sector entities that own, operate or host critical national infrastructure. For cloud computing and hosting services, control 4-2-3 lists, as a minimum, protection of the entity’s data according to its classification level and the return of data in a usable format when the service is completed. The document’s change log adds that data localisation controls moved to the National Data Management Office, and that entities must refer to that office before acting on data localisation.
This is general information, not legal advice. Whether these rules bind you depends on your scope, sector and contracts, so confirm with a qualified adviser or the relevant authority.
Cost beyond the licence
Ask each vendor to price the same scenario over the period you expect to keep the tool. These questions make the quotes comparable:
- What is the licence metric: named agents, concurrent agents, users or assets? Does someone who only approves requests count as an agent?
- What is priced separately: a test instance, automation, AI features, extra languages, integrations, storage or higher support tiers?
- Who does implementation and configuration, for how long and at what cost, and what must your team provide?
- How can the price change at renewal, and what are the notice and exit terms?
Add the internal time the project will take. A low licence price can hide an expensive project, and good ITSM tool selection includes knowing what you will spend after signing.
Who should be on the ITSM tool selection panel?
Use a service desk agent, the IT operations manager, someone from the business who raises tickets, a security representative and a procurement contact. ITSM tool selection is a team decision, so name the panel before the first demo. Add one person from HR or facilities if they will use the tool, and bring in legal and data protection for the contract stage. Keep the trial to two or three tools, because each one costs your agents real hours.
Turn your requirements into a scoring sheet
Share your ticket volumes, languages, hosting constraints and the processes you already run. We can help you turn them into ranked requirements before you speak to a vendor.
Sources
- ITSM Tool Capabilities and ITIL Service Delivery, PeopleCert Accredited Tool Vendor programme (page updated 19 January 2026). Accessed 2 October 2026.
- FAQ, PeopleCert Accredited Tool Vendor programme (undated page). Accessed 2 October 2026.
- ITIL-Accredited Tool Vendors programme, PeopleCert (undated page). Accessed 2 October 2026.
- PeopleCert completes Axelos acquisition, PeopleCert, 2021. Accessed 2 October 2026.
- ITIL FAQ, PeopleCert. Accessed 2 October 2026.
- Essential Cybersecurity Controls (ECC 2-2024), National Cybersecurity Authority, Saudi Arabia (page last updated 19 July 2026). Accessed 2 October 2026.
- Essential Cybersecurity Controls (ECC-2:2024), full text, National Cybersecurity Authority, Saudi Arabia. Accessed 2 October 2026.
- Guide to the Saudi Personal Data Protection Law (for controllers and processors), SDAIA (undated PDF). Accessed 2 October 2026.
- ISO/IEC 27001:2022, Information security management systems, Requirements, ISO. Accessed 2 October 2026.
- Inline markup and bidirectional text in HTML, W3C Internationalization. Accessed 2 October 2026.
