ISO/IEC 20000-1

What is ISO/IEC 20000-1?

ISO/IEC 20000-1 sets the requirements for a service management system (SMS): the way an organisation plans, designs, delivers and improves the services it provides to customers. It grew out of IT service management and is mostly used by IT departments, managed service providers, data centres and software-as-a-service companies, though it can apply to any service.

The current version is the third edition, ISO/IEC 20000-1:2018. ISO and IEC reviewed it in 2023 and confirmed it without changes, and a 2024 amendment adds the climate-change consideration now found in all ISO management system standards.

What does it require?

The standard follows the harmonised structure of ISO management system standards, so its management clauses match ISO/IEC 27001 and ISO 9001. Its operations clause covers the service lifecycle. In outline, an organisation must manage:

• service portfolio: planning services, controlling the parties involved in delivering them, the service catalogue, assets and configuration;
• relationships and agreements: business relationships, service level management and supplier management;
• supply and demand: budgeting and accounting for services, and demand and capacity management;
• service design, build and transition: change management, service design and transition, and release and deployment;
• resolution and fulfilment: incident management, service requests and problem management;
• service assurance: service availability, service continuity and information security management.

How does it relate to ITIL?

ITIL is a widely used body of IT service management guidance describing good practice. ISO/IEC 20000-1 is a set of auditable requirements. The two fit together: many organisations use ITIL practices to meet the standard’s requirements, and certification to ISO/IEC 20000-1 shows those practices are run as a managed system. ITIL itself certifies individuals, not organisations.

What are the other parts?

The 20000 series has several parts. The most used are ISO/IEC 20000-2, guidance on applying the requirements, and ISO/IEC 20000-3, guidance on defining the scope and applicability of an SMS, which is useful when services depend on several suppliers.

How is it certified?

Organisations can be certified by an accredited certification body on the usual three-year cycle with surveillance audits. Customers of managed services, particularly in the public sector and financial services, sometimes ask for it in tenders as evidence that services are run in a controlled way.

How does it relate to ISO/IEC 27001?

The two are often combined. ISO/IEC 20000-1 includes information security management as one of its service assurance processes, and ISO/IEC 27001 provides the full information security management system and Annex A controls. Because both share the same structure, one integrated management system can cover both, with common processes for change, incidents, suppliers and continuity. For governance across the whole of IT, COBIT points to ISO/IEC 20000-1 and ITIL for service management.