ISO/IEC 20000-1

Introduction to ISO/IEC 20000-1

ISO/IEC 20000-1 is the international standard for a Service Management System (SMS). It specifies the requirements an organisation must satisfy to plan, establish, implement, operate, monitor, review, maintain and continually improve the management and delivery of services. Where ISO 9001 governs quality management generically, ISO/IEC 20000-1 focuses specifically on the disciplined management of services - most commonly IT services, but the standard is deliberately technology-neutral and applies equally to managed security services, cloud services, business-process outsourcing and any other service that is planned, delivered and improved. It is the only auditable, certifiable international standard dedicated to service management and is the formal specification against which an organisation's SMS is assessed by an accredited certification body.

The standard is closely aligned with the ITIL body of practice, but the two are distinct. ITIL is a non-certifiable framework of good practice and guidance; ISO/IEC 20000-1 is a certifiable, shall-based specification of requirements. An organisation may adopt ITIL practices, COBIT, VeriSM, DevOps or any other approach as the means of meeting the requirements, but certification is granted only against ISO/IEC 20000-1. The current edition, ISO/IEC 20000-1:2018, was restructured onto Annex SL - the common High-Level Structure shared with ISO 9001, ISO/IEC 27001, ISO 22301 and ISO 14001 - which makes integrated management systems substantially easier to build and audit.

This guide is written for service-management leaders, process owners, internal auditors and certification project managers who need an auditor-grade understanding of every clause and requirement. It walks through the full structure of the standard, provides a master assessment checklist covering every clause and service-management process, and sets out a phased implementation approach, a capability model, an audit methodology, an evidence request list, roles, KPIs and framework mappings. British and Indian English spelling is used throughout.

What is ISO/IEC 20000-1

ISO/IEC 20000-1:2018 specifies requirements for an organisation to establish, implement, maintain and continually improve a Service Management System. The SMS is the coordinated set of policies, objectives, plans, processes, documented information and resources that an organisation uses to direct and control its service-management activities and to deliver value to customers and users. The standard adopts the Plan-Do-Check-Act (PDCA) cycle and a process-based, risk-driven approach in which the organisation defines the services in scope, agrees service requirements with customers, delivers against those requirements, measures performance, and continually improves.

The 2018 edition is organised under the Annex SL High-Level Structure, giving it clauses 1 to 10. Clauses 1 to 3 are scope, normative references and terms. Clauses 4 to 10 contain the auditable requirements: Context of the organisation (4), Leadership (5), Planning (6), Support of the service management system (7), Operation of the service management system (8), Performance evaluation (9) and Improvement (10). Clause 8 is by far the largest and contains the service-management processes historically associated with the standard - service level management, service continuity and availability management, capacity management, information security management, incident and request management, problem management, change management, release and deployment management, configuration management, service reporting, budgeting and accounting, demand management, service catalogue management, the design and transition of new or changed services, and the management of suppliers and other parties involved in the service lifecycle.

Key facts about the standard are summarised below.

Who must comply with ISO/IEC 20000-1

ISO/IEC 20000-1 is voluntary in the sense that no law mandates it universally, but certification is frequently required contractually - in public-sector tenders, managed-services agreements and outsourcing contracts it is often a mandatory qualification. Any organisation that plans, delivers and improves services can implement the standard, whether the services are delivered internally, to external customers, or sourced from third parties. The requirement to be met by the organisation is that it demonstrates control over its own SMS, even where parts of the service are provided by other parties.

• There is no minimum organisation size - small and large providers alike can certify, provided the SMS scope is meaningful and the organisation retains management control of the services.
• Certification is granted at the level of a defined scope (specific services, sites and delivery teams), not necessarily the whole organisation.
• Where services rely on suppliers or internal groups, the organisation seeking certification must demonstrate governance of those parties (Clause 8.2.3) rather than certify the third party itself.
• The standard is often adopted alongside ISO/IEC 27001 for security and ISO 22301 for continuity to present a single integrated management system.

Structure of ISO/IEC 20000-1

The 2018 edition follows the Annex SL structure. Clauses 4 to 10 carry the auditable requirements. Clause 8 (Operation of the service management system) is the largest and is subdivided into service-portfolio, relationship, supply, design/build/transition, resolution, and service-assurance groupings which contain the recognisable service-management processes. The table below sets out every clause and sub-clause group that an auditor will examine.

Master assessment checklist

This is the core of the guide. It enumerates every clause of ISO/IEC 20000-1:2018 and every service-management process within Clause 8. Each group is presented with a table of what an auditor verifies and the typical evidence expected. Use it as a gap-assessment worksheet: mark each row as conformant, partial or nonconformant and attach the evidence reference.

Clause 4 - Context of the organisation

Clause 5 - Leadership

Clause 6 - Planning

Clause 7 - Support (resources, competence, awareness, communication, documented information, knowledge)

Clause 8.1 - Operational planning and control

Clause 8.2 - Service portfolio: service delivery, planning services, control of parties, service catalogue, asset and configuration management

Clause 8.3.1 - Business relationship management

Clause 8.3.2 - Service level management (SLM)

Clause 8.3.3 - Supplier management

Clause 8.4.1 - Budgeting and accounting for services

Clause 8.4.2 - Demand management

Clause 8.4.3 - Capacity management

Clause 8.5.1 - Change management

Clause 8.5.2 - Service design and transition of new or changed services

Clause 8.5.3 - Release and deployment management

Clause 8.6.1 - Incident management

Clause 8.6.1 - Major incident management

Clause 8.6.2 - Service request management

Clause 8.6.3 - Problem management

Clause 8.7.1 - Service availability management

Clause 8.7.2 - Service continuity management

Clause 8.7.3 - Information security management

Clause 9 - Performance evaluation (monitoring, internal audit, management review, service reporting)

Clause 10 - Improvement (nonconformity, corrective action, continual improvement)

Scoping the Service Management System

Defining the SMS scope correctly is one of the most consequential decisions in an ISO/IEC 20000-1 programme, and ISO/IEC 20000-3 provides dedicated guidance on scope definition and applicability. The scope must be meaningful: it should describe the services covered, the parties delivering them, the technologies and locations involved, and any exclusions. A scope that is too narrow can render certification commercially worthless; a scope that is too broad can make the programme unmanageable.

A critical constraint in the 2018 edition is the concept of governance of processes operated by other parties. The organisation seeking certification must retain accountability for the SMS. It cannot exclude a service-management process simply because a supplier or another internal group performs it; instead it must demonstrate that it governs that party, sets requirements, and monitors performance. If the organisation cannot demonstrate this control, the service cannot legitimately be included in scope.

• Define scope by service, not merely by technology - list the services from the service catalogue that are covered.
• State the organisational units, delivery teams and physical/cloud locations included.
• Identify all parties (external suppliers, internal groups, customers acting as suppliers) and confirm the organisation governs them.
• Document justified exclusions and confirm no Clause 4-10 requirement is excluded (all requirements are mandatory; only the range of services is scoped).
• Reference ISO/IEC 20000-3 when assessing whether a proposed scope is demonstrable and defensible.
• Ensure the scope statement is a controlled document, approved by top management and made available to interested parties.

Implementation approach

A pragmatic ISO/IEC 20000-1 implementation follows a phased path aligned to the PDCA cycle. The following five phases take an organisation from initiation to certification and beyond. Each phase lists key activities and the deliverables an auditor will later expect to see.

Phase 1 - Initiation and gap assessment

Establish the mandate, secure top-management sponsorship, and understand the current state against the standard.

• Activities: appoint a project sponsor and SMS manager; define provisional scope; conduct a clause-by-clause and process-by-process gap assessment against ISO/IEC 20000-1:2018; identify interested parties and their requirements; produce a business case.
• Deliverables: gap assessment report, provisional scope statement, stakeholder register, project charter and high-level plan, business case.

Phase 2 - Design and documentation

Design the SMS, its policy, objectives, process architecture and documented information.

• Activities: draft the service management policy and objectives; design the process architecture covering all Clause 8 processes; define the service catalogue; write procedures, RACIs and templates; establish the risk and improvement registers; select or configure ITSM tooling; define measurement and reporting.
• Deliverables: service management policy, service management plan, process procedures, service catalogue, RACI matrices, risk register, improvement (CSI) log, KPI/measurement plan, tool configuration.

Phase 3 - Implementation and operation

Deploy the SMS into live operation and begin generating records.

• Activities: roll out processes and tooling; train staff and build awareness; agree SLAs, OLAs and supplier contracts; commence incident, request, problem, change, release and configuration management in earnest; begin service reporting; operate the SMS long enough to generate an audit trail (typically three to six months of records).
• Deliverables: signed SLAs/OLAs, training records, live process records (tickets, changes, releases), populated CMDB, service reports, competence matrix.

Phase 4 - Evaluation and internal audit

Check that the SMS is working and correct weaknesses before external assessment.

• Activities: measure and analyse KPIs; conduct a full internal audit covering all clauses and processes; hold a management review with all required inputs and outputs; raise and close nonconformities and improvements.
• Deliverables: internal audit programme and reports, management review minutes, nonconformity and corrective-action records, updated improvement log, KPI performance packs.

Phase 5 - Certification and continual improvement

Engage an accredited certification body and sustain the SMS.

• Activities: select an accredited certification body; undergo Stage 1 (documentation and readiness review) and Stage 2 (implementation) audits; address any findings; achieve certification; operate surveillance audits and recertification; drive continual improvement.
• Deliverables: Stage 1 and Stage 2 audit responses, corrective-action plans, certificate of registration, surveillance-audit records, ongoing CSI evidence.

Capability and maturity model

ISO/IEC 20000-1 certification is binary - an SMS either conforms or it does not - but organisations benefit from a maturity view to plan improvement and to communicate progress. The model below combines a five-level process-capability scale (aligned with the spirit of ISO/IEC 33000 and CMMI) with the PDCA emphasis of the standard. Use it to score each process and target a consistent minimum before seeking certification.

For certification, an organisation should generally target at least Level 3 (Established) across all in-scope processes, with Clause 9 evaluation and Clause 10 improvement demonstrably operating to move toward Levels 4 and 5 over time.

Assessment and audit approach

Certification audits by an accredited body follow a defined two-stage model, followed by a three-year cycle of surveillance and recertification. Internal audits and pre-assessments follow a similar methodology. The following steps describe an auditor-grade approach.

1. Define audit scope and criteria: confirm the SMS scope, services, sites and the applicable edition (ISO/IEC 20000-1:2018) as the audit criteria.
2. Conduct a Stage 1 (readiness / documentation) review: examine the SMS documentation, scope, policy, objectives, risk approach and internal-audit and management-review evidence to confirm the SMS is designed and ready for the implementation audit.
3. Plan the Stage 2 audit: prepare an audit plan and schedule sampling each clause (4-10) and every in-scope Clause 8 process, allocating time and interviewees.
4. Gather objective evidence: interview process owners and staff, inspect records (tickets, changes, releases, CMDB, reports), observe operations and trace transactions end to end.
5. Test the PDCA loop: verify that monitoring, internal audit, management review and improvement actually drive corrective action and continual improvement, not just documentation.
6. Assess governance of other parties: confirm suppliers and internal groups delivering in-scope processes are governed and monitored.
7. Classify findings: record conformities, opportunities for improvement, minor nonconformities and major nonconformities against specific clauses.
8. Report and require corrective action: issue an audit report; the organisation submits root-cause analysis and corrective-action plans for nonconformities.
9. Make the certification decision: an independent reviewer confirms closure of major nonconformities before the certificate is granted.
10. Operate the surveillance cycle: conduct annual (or semi-annual) surveillance audits covering a rolling subset of the SMS, and a full recertification audit before the three-year certificate expires.

Evidence request list

Auditors and internal assessors typically request the following categorised evidence. Prepare an evidence index that maps each item to its clause.

Governance and leadership

• Service management policy and objectives
• SMS scope statement and applicability record
• Management review minutes and action logs
• Organisational roles, RACI and appointment records
• Risk register and treatment plans

Service portfolio and configuration

• Service catalogue
• CMDB/CMS extract and configuration baselines
• Configuration audit and reconciliation reports
• Asset register and lifecycle records
• Party/supplier register and governance model

Agreements and relationships

• Signed SLAs, OLAs and underpinning contracts
• Supplier scorecards and performance reviews
• Customer satisfaction survey results
• Complaints log and resolution records
• Service review meeting minutes

Operational process records

• Incident and major-incident records
• Service request records and request catalogue
• Problem records, RCA and known-error database
• Change records (RFCs), CAB minutes, change schedule
• Release and deployment records with test/verification results

Service assurance

• Availability reports and downtime analyses
• Service continuity plans and test reports (with RTO/RPO)
• Information security policy, risk assessment and incident records
• Capacity plans and utilisation reports
• Demand forecasts and consumption metrics

Financials, evaluation and improvement

• Service budgets, cost models and financial reports
• KPI dashboards and service reports
• Internal audit programme and reports
• Nonconformity and corrective-action records
• Continual improvement (CSI) log and closed-improvement evidence

Roles and responsibilities

Clear ownership is essential. The table below sets out typical roles in an ISO/IEC 20000-1 SMS and their core responsibilities. Titles vary by organisation; the accountabilities do not.

KPIs to track

A balanced set of KPIs demonstrates both service performance and SMS health. Track at least the following, defining targets, owners and reporting frequency for each.

• SLA attainment rate (percentage of service level targets met)
• Incident resolution within target and mean time to resolve (MTTR)
• Major incident count, duration and repeat rate
• Service request fulfilment within target time
• First-contact / first-line resolution rate
• Change success rate and percentage of emergency changes
• Failed change and change-related incident rate
• Release success rate and rollback frequency
• Problem closure rate and reduction in recurring incidents
• CMDB accuracy (percentage of CIs verified in audits)
• Service availability against agreed targets (uptime percentage)
• Continuity plan test coverage and RTO/RPO achievement
• Information security incident count and mean time to contain
• Capacity threshold breaches and forecast accuracy
• Customer satisfaction (CSAT/NPS) and complaint resolution time
• Internal audit findings closed within target
• Nonconformity closure rate and corrective-action effectiveness
• Number and value of continual improvements delivered

Readiness checklist

Work through this checklist before engaging a certification body. Every item should be evidenced.

• Top management has approved the service management policy and provided resources
• SMS scope is defined, documented and demonstrably governs all parties in scope
• Service management objectives are measurable and linked to the policy
• Risks and opportunities to the SMS are identified, assessed and treated
• All Clause 8 processes are documented, operating and generating records
• A current, accessible service catalogue exists
• SLAs, OLAs and supplier contracts are signed and aligned
• CMDB/CMS is populated, controlled and audited for accuracy
• Incident, request, problem, change, release and configuration processes are live
• Availability, capacity, continuity and information security processes are operating with reports
• Service continuity plans have been tested and RTO/RPO validated
• Competence matrix and training records are complete
• Service reporting is delivering agreed reports to defined audiences
• At least one full internal audit covering all clauses has been completed
• A management review with all required inputs and outputs has been held
• Nonconformities and improvements are logged and being actioned
• Three to six months of operational records are available as evidence
• An accredited certification body has been selected and Stage 1 scheduled

Common gaps and pitfalls

The following weaknesses recur in ISO/IEC 20000-1 audits. Address them proactively.

• Treating outsourced processes as out of scope instead of demonstrating governance of the supplier (Clause 8.2.3) - a frequent scope failure.
• Documentation that describes an idealised process which staff do not actually follow in practice.
• Weak or absent evidence that the PDCA loop closes - metrics collected but no resulting improvement actions.
• Management reviews that omit required inputs or produce no actionable outputs.
• Inaccurate or stale CMDB with no configuration audits, undermining change and incident management.
• SLAs not underpinned by OLAs and supplier contracts, leaving targets unachievable.
• Service continuity plans that exist on paper but have never been tested, or untested RTO/RPO assumptions.
• Information security treated as a bolt-on rather than integrated with the SMS (often resolved by aligning with ISO/IEC 27001).
• Problem management not distinguished from incident management, so recurring incidents are never eliminated.
• Insufficient operational history - too few records to evidence that processes work over time.
• Objectives that are vague or not measurable, preventing meaningful performance evaluation.
• Internal audits that are superficial or do not cover every clause and process before Stage 2.

ISO/IEC 20000-1 mapped to other frameworks

Because ISO/IEC 20000-1 uses the Annex SL structure, it integrates cleanly with other management-system standards, and its Clause 8 processes correspond closely to ITIL practices. The table below maps key ISO/IEC 20000-1 areas to related frameworks to aid integrated implementation.

Frequently asked questions

Need help with ISO 20000-1?

CERT-In empanelled, PCI QSA senior auditors can take you from reading about it to compliant — with a scoped, guided programme.