What is ISO 20000?

Why IT services need a management system

Payroll, e-commerce, hospital records, online banking and customer support all depend on IT services that must be available, secure and changed without breaking something else. When an unplanned change takes a service down, or the same incident returns every week because nobody investigated the cause, the customer does not blame a server; the customer blames the provider and may take the contract elsewhere.

ISO/IEC 20000-1, published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), addresses this by treating service delivery as a managed system. Who owns the service? What was agreed with the customer? How are changes approved and incidents resolved? The standard turns these questions into auditable requirements.

What is ISO 20000?

ISO 20000, usually meaning ISO/IEC 20000-1, is the international standard for IT service management (ITSM). The full title of the current edition is ISO/IEC 20000-1:2018 Information technology – Service management – Part 1: Service management system requirements. It was first published in 2005 on the basis of earlier work, revised in 2011 and again in 2018.

According to ISO's page, the 2018 edition (third edition) was last reviewed and confirmed in 2023 and remains current, and ISO/IEC 20000-1:2011 is withdrawn. Amendment 1:2024 adds climate action changes. Confirm the current edition and amendments with ISO or your certification body.

The standard applies to any organization that provides services, whether it is an IT company, an in-house IT department or a managed service provider, regardless of size or sector. It is relevant to service providers, customers who want assurance from their suppliers, auditors and advisers.

ISO 20000 vs. ITIL

ISO 20000 and ITIL are often mentioned together and sometimes confused. They are related but they are not the same thing.

• Nature: ISO 20000-1 is a standard with requirements against which an organization can be audited and certified; ITIL is a framework of good practice and guidance and it is not certifiable at the organization level
• Question answered: ISO 20000 states what the service management system must achieve and evidence; ITIL describes ways of working to achieve it
• Use together: ISO 20000 was developed with ITIL in mind, so an organization that uses ITIL practices can use them to meet many ISO 20000 requirements
• Other frameworks: ISO 20000 can also be used with other frameworks such as COBIT
• Certification: individuals can obtain ITIL qualifications, while organizations are certified against ISO 20000-1 by an accredited certification body

The structure: clauses 4 to 10

ISO/IEC 20000-1:2018 follows the High Level Structure shared by ISO 9001, ISO 14001 and ISO 27001. Clauses 1 to 3 cover scope, normative references and terms, and clauses 4 to 10 contain the requirements that are audited.

• Context of the organization (clause 4): understand the organization, its interested parties and their requirements, and define the scope of the SMS. For example, a managed service provider decides which services and customers are inside the scope
• Leadership (clause 5): top management demonstrates commitment, sets the service management policy and assigns roles and responsibilities. Is there a named service owner for each service?
• Planning (clause 6): address risks and opportunities, set service management objectives and plan the SMS and the services
• Support of the SMS (clause 7): resources, competence, awareness, communication, documented information and knowledge
• Operation of the SMS (clause 8): the service management processes described below
• Performance evaluation (clause 9): monitoring, measurement, analysis, internal audit, management review and service reporting
• Improvement (clause 10): nonconformities, corrective action and continual improvement

The service management processes in clause 8

Clause 8 is where service management is performed in daily work. The standard groups the processes by purpose, and an auditor will sample records from each to check that they work in practice.

• Service portfolio and catalogue: define the services, their scope and who they are provided to
• Relationship and agreement: business relationship management, service level management (clause 8.3.3) and supplier management, including internal groups and external suppliers
• Supply and demand: budgeting and accounting, demand management and capacity management (clauses 8.4.2 and 8.4.3)
• Design, build and transition: change management (clause 8.5.1), service design and development, release and deployment, so that new or changed services do not disrupt live services
• Resolution and fulfilment: incident management (clause 8.6.1), service request management and problem management (clause 8.6.3). For example, ten repeat incidents with the same root cause should trigger a problem record
• Service assurance: availability management, service continuity management and information security management (clauses 8.7.1 to 8.7.3), which link ISO 20000 to ISO 22301 and ISO 27001

The 2024 climate action amendment

ISO/IEC 20000-1:2018/Amd 1:2024 does not rewrite the standard. It adds climate change considerations to the way the organization understands its context. In practice the organization determines whether climate change is a relevant issue for its SMS, for example for the energy use of data centres or the exposure of facilities to extreme weather, and whether interested parties have climate-related requirements.

Always confirm the exact amended wording against the published amendment.

Why organizations adopt ISO 20000

Organizations choose ISO 20000 for practical reasons. These benefits depend on a system that is actually used; a certificate alone does not improve a service.

• Customer assurance: evidence that services are managed consistently, which is often requested in tenders and by enterprise customers
• Fewer repeat incidents: structured incident and problem management reduces firefighting
• Safer change: controlled change and release processes reduce outages caused by the provider
• Clear accountability: services, owners, agreements and suppliers are defined
• Integrated management: shared structure with ISO 27001, ISO 22301 and ISO 9001 allows audits and reviews to be combined
• Continual improvement: reporting and review create a cycle in which services get better over time

How to implement ISO 20000

A practical sequence helps to avoid building processes that nobody uses.

• Management commitment and scope: define the services and customers covered and secure resources
• Requirements and context: identify customer, legal and contractual requirements and the needs of interested parties
• Policy, objectives and plan: issue the service management policy, set objectives and write the service management plan
• Service catalogue and agreements: define each service, its owner and the service levels agreed with customers
• Processes: establish change, incident, problem, request, capacity, availability, continuity and supplier management
• Support: assign roles, train staff and control documented information
• Operate and record: run the processes and keep records of tickets, changes, reviews and reports
• Monitor, audit and review: report on services, run an internal audit, hold a management review and correct the findings
• Certification audit: arrange a Stage 1 and Stage 2 audit with an accredited certification body

Certification, related parts and how ComplyEncrypt helps

An accredited certification body audits the SMS within a defined scope. The audit normally has two stages: a review of documentation and readiness, then a main audit of how the system works in practice. A certificate is followed by surveillance audits and recertification. ISO itself does not issue certificates, and ISO has also noted that organizations can benefit from the standard with or without certification.

Required documented information includes the scope of the SMS, the policy and objectives, the service management plan, the service catalogue, service level agreements, processes and procedures, evidence of competence, records of monitoring, audit and review, and corrective actions. Confirm the exact list against the published standard. ISO/IEC 20000 also has further parts that give guidance, such as guidance on scope, concepts and an implementation plan.

ISO 20000 is on the ComplyEncrypt roadmap. ComplyEncrypt is built to bring service catalogue and policy drafts, process and procedure documentation, internal-audit preparation and corrective-action tracking into an AI-assisted workflow, and to connect them with ISO 27001 and ISO 22301 work. AI assistance applies to documentation work; people still run the services and handle incidents and changes, and certification remains the decision of an accredited body. A vigorous service management system is measured in the tickets that do not come back. See the ISO 20000 framework page for current availability.