ISO/IEC 20000-1: Service Management Certification for IT Providers

ISO/IEC 20000-1, often shortened to ISO 20000-1, is the international standard that specifies requirements for a service management system. It tells an organisation what it must have in place to plan, design, transition, deliver and improve services that meet agreed requirements, and it is certifiable by accredited certification bodies. For IT companies that sell managed services, support or hosting, it is the most widely recognised way to prove service management capability to buyers.

The current version is ISO/IEC 20000-1:2018, amended in 2024 to add climate change considerations. This guide explains what the standard requires, the processes in clause 8, how it differs from ITIL, how certification works, the evidence auditors expect and how software and support teams can meet it without heavy bureaucracy.

What is ISO/IEC 20000-1?

ISO/IEC 20000-1 is Part 1 of the ISO/IEC 20000 series, published jointly by ISO and IEC through joint technical committee JTC 1, subcommittee SC 40. It sets out the requirements for a service management system (SMS): the policies, objectives, plans, processes, controls, roles and documentation an organisation uses to manage services. "Service" is defined broadly, so the standard can apply to any service, but in practice it is used almost entirely for IT services.

It follows the harmonised structure shared by ISO management system standards such as ISO/IEC 27001 and ISO 9001: clauses 4 to 7 cover context, leadership, planning and support; clause 8 covers operation; clauses 9 and 10 cover performance evaluation and improvement. Clause 8 is where ISO/IEC 20000-1 is distinctive, because it defines the service management processes in detail.

History and current edition

The standard grew out of the British Standard BS 15000, which was based on early ITIL practice. ISO/IEC 20000-1 was first published in 2005, revised in 2011 and revised again in 2018. The 2018 edition, the third, aligned the standard with the harmonised management system structure, reduced prescriptive documentation, gave more attention to the organisation's control of other parties involved in services, and added explicit requirements on service portfolio, asset management, demand management and knowledge.

In February 2024, ISO published Amendment 1, "Climate action changes", which adds to clause 4 a requirement for the organisation to determine whether climate change is a relevant issue, and a note that interested parties can have climate-related requirements. The same amendment was applied to many ISO management system standards. Check the ISO page for the current status before planning a certification, as editions and amendments change.

Who should consider it?

• Managed service providers and IT outsourcers selling support, operations or managed infrastructure.
• Cloud, hosting and SaaS providers that want to show disciplined service delivery and change control.
• Internal IT departments and shared service centres serving large organisations or public bodies.
• Software companies offering maintenance and support contracts with service level commitments.
• Bidders for government and enterprise tenders where ISO/IEC 20000-1 certification is scored or required.

It is voluntary. No law requires it, but procurement rules in several countries, including some Indian and Middle Eastern public sector tenders, list it as a qualification or scoring criterion.

Is it mandatory or voluntary?

ISO/IEC 20000-1 is voluntary. It becomes effectively mandatory when a contract or tender requires certification. Certification is not required to use the standard; some organisations adopt it as an internal benchmark, but third-party certification is what buyers recognise.

Structure of the standard

Clause	Topic	What it requires
4	Context of the organisation	Internal and external issues, interested parties, scope of the SMS, establishing the SMS, and (since 2024) whether climate change is relevant.
5	Leadership	Top management commitment, service management policy, roles and responsibilities.
6	Planning	Risks and opportunities, service management objectives, planning the SMS.
7	Support of the SMS	Resources, competence, awareness, communication, documented information and knowledge.
8	Operation of the SMS	The service management processes, described below.
9	Performance evaluation	Monitoring and measurement, internal audit, management review and service reporting.
10	Improvement	Nonconformity, corrective action and continual improvement.

The clause 8 service management processes

Clause 8 groups the processes into seven areas:

• 8.1 Operational planning and control: plan, implement and control the processes needed to meet service requirements.
• 8.2 Service portfolio: service delivery, planning services, control of parties involved in the service lifecycle, service catalogue management, asset management and configuration management.
• 8.3 Relationship and agreement: business relationship management, service level management and supplier management, including internal suppliers and customers acting as suppliers.
• 8.4 Supply and demand: budgeting and accounting for services, demand management and capacity management.
• 8.5 Service design, build and transition: change management, service design and transition, and release and deployment management.
• 8.6 Resolution and fulfilment: incident management, service request management and problem management.
• 8.7 Service assurance: service availability management, service continuity management and information security management.

The standard says what each process must achieve, not how. For example, change management needs a change management policy defining which changes are controlled, a way to record and classify requests, assessment of risk and impact, approval, a schedule of changes, and review of whether changes met their objectives. It does not prescribe a change advisory board, a ticketing tool or a particular workflow.

Control of other parties

Most IT services depend on cloud platforms, software vendors and subcontractors. The 2018 edition requires the organisation to retain accountability for services even when other parties operate processes or components, to identify which processes other parties operate, and to define and apply controls over them. An organisation cannot exclude a process from scope simply because a supplier performs it. For a SaaS company running on a public cloud, this means documenting what the cloud provider does, how its performance is monitored and how its commitments support the organisation's own service levels.

ISO/IEC 20000-1 and ITIL

ITIL is a body of best practice guidance owned by PeopleCert. ISO/IEC 20000-1 is a requirements standard. The two are complementary: ITIL describes ways to perform practices such as incident or change management, and ISO/IEC 20000-1 states what an auditable management system must achieve. Many organisations use ITIL practices to meet the standard's requirements, but ITIL certifications apply to individuals while ISO/IEC 20000-1 certification applies to an organisation's service management system. Neither requires the other.

Aspect	ISO/IEC 20000-1	ITIL 4
Nature	Requirements standard	Practice guidance
Certifies	The organisation's SMS	Individuals
Owner	ISO and IEC	PeopleCert
Audit	Accredited certification body	Not applicable to organisations
Detail	What must be achieved	How practices can be performed

The rest of the ISO/IEC 20000 series

• ISO/IEC 20000-2: guidance on applying Part 1, with examples.
• ISO/IEC 20000-3: guidance on scope definition and applicability of Part 1.
• ISO/IEC 20000-6: requirements for bodies providing audit and certification of service management systems.
• ISO/IEC 20000-10: concepts and vocabulary.

Only Part 1 is certifiable. The others help with interpretation and audit.

Certification process step by step

1. Define the scope: which services, to which customers, from which locations. A narrow, well-defined scope is easier to certify first.
2. Gap analysis against clauses 4 to 10.
3. Design and document the SMS: policy, objectives, service catalogue, service level agreements, process procedures and records.
4. Operate the processes long enough to produce evidence, typically three months or more.
5. Internal audit and management review, covering the whole scope.
6. Stage 1 audit: the certification body reviews documentation and readiness.
7. Stage 2 audit: the certification body tests implementation and effectiveness through interviews, records and samples.
8. Certification for three years, with surveillance audits in years one and two and recertification in year three.

Choose a certification body accredited for ISO/IEC 20000-1 by a national accreditation body that is a signatory to the international mutual recognition arrangements, now run by the Global Accreditation Cooperation, formed on 1 January 2026 by the merger of IAF and ILAC. Accreditation is what makes a certificate meaningful to buyers.

Service reporting and service level management in practice

Service level management is the process buyers notice most. The standard requires the organisation to agree a catalogue of services with customers, document service level agreements with targets, monitor and report performance against those targets at planned intervals, and review the agreements periodically. Service reports must be produced from reliable data and used to make decisions, not just filed.

A practical approach is to keep a small number of meaningful targets per service, such as availability, first response time by priority and resolution time by priority, and to report them monthly with trends, breaches, their causes and improvement actions. Where the organisation depends on cloud providers or subcontractors, their own commitments should be reviewed so internal targets are achievable.

Evidence auditors expect

• Scope statement, service management policy and objectives with measures.
• Service catalogue and service level agreements, with service reports showing performance against targets.
• Records of incidents, service requests and problems, with categorisation, priority, resolution and root cause.
• Change records showing assessment, approval, implementation and review, and a schedule of changes.
• Release records and deployment verification.
• Configuration and asset records for components in scope.
• Capacity and availability plans and monitoring data.
• Service continuity plans and test results.
• Information security policy and risk assessment for services.
• Supplier agreements and performance reviews.
• Internal audit reports, management review minutes and corrective actions.

Timeline and cost considerations

A focused IT services provider with existing ticketing and change practices can often reach certification in six to twelve months. The main costs are internal effort to document and operate processes, tooling, possible consultancy and certification body fees, which depend on headcount, sites and scope. Organisations already certified to ISO/IEC 27001 or ISO 9001 can reuse the management system elements in clauses 4 to 7, 9 and 10 and run integrated audits.

Benefits and limitations

• Benefits: recognised certification for tenders and enterprise sales; clearer service levels; fewer failed changes; faster incident resolution through problem management; better supplier control; a framework for continual improvement.
• Limitations: certification shows a working management system, not that every service is excellent; poorly scoped programmes produce paperwork with little value; and buyers in some markets value SOC 2 or ISO/IEC 27001 more for security assurance.

How it fits with software development and DevOps

Agile and DevOps teams sometimes fear that ISO/IEC 20000-1 means slow change boards. It does not. The standard lets the organisation define its change policy, including standard pre-approved changes and automated approval for low-risk changes. A deployment pipeline that records who approved a merge, runs automated tests, deploys through a controlled release and logs the result can be the change and release evidence. Incident and problem records can live in the same tools developers already use, as long as they meet the requirements for recording, prioritising, resolving and reviewing.

For example, an Indian company providing 24x7 support for a European client's e-commerce platform defines three services in its catalogue, agrees response and resolution targets in SLAs, treats routine dependency updates as standard changes, routes database schema changes through peer review and a rollback plan, and holds monthly service reviews with the client using data exported from its ticketing system. Those records form most of its audit evidence.

Common mistakes

• Scope too broad for a first certification.
• Documenting processes nobody follows.
• SLAs without measurement or service reports.
• Ignoring cloud and software suppliers in the control of other parties.
• Problem management that never finds root causes, leaving repeated incidents.
• Continuity plans never tested.
• Treating ITIL training as compliance; individual certificates do not demonstrate an SMS.

Best practices and tools

• Use one ITSM or ticketing platform for incidents, requests, problems and changes, with consistent categories and priorities.
• Automate service level reporting from tool data.
• Link changes to deployments and incidents so failed changes are visible.
• Keep configuration data accurate through discovery and infrastructure as code.
• Integrate with ISO/IEC 27001 and ISO 22301 where certified, sharing risk, audit and review processes.
• Run quarterly service reviews with customers.

Our maintenance and support and migration and modernisation services use ticketed change control and incident records that fit this kind of management system.

How ISO/IEC 20000-1 relates to other frameworks

Framework	Relationship
ITIL	Practice guidance often used to meet the requirements.
ISO/IEC 27001	Shares the management system structure; covers information security in depth.
ISO 9001	General quality management; ISO/IEC 20000-1 is the service management equivalent for IT.
ISO 22301	Business continuity in more depth than clause 8.7.2.
COBIT	Governance framework that can map to ISO/IEC 20000-1 processes.

Next steps

1. Decide whether buyers or tenders actually ask for ISO/IEC 20000-1.
2. Define a clear first scope.
3. Run a gap analysis and fix the biggest process gaps.
4. Operate the SMS and collect evidence for at least three months.
5. Complete internal audit and management review, then book stage 1 and 2 audits.

Frequently asked questions

What is ISO/IEC 20000-1?

The international standard specifying requirements for a service management system, used mainly for IT services and certifiable by accredited bodies.

Is ISO/IEC 20000-1 mandatory?

No. It is voluntary, but tenders and contracts may require certification.

What is the current version?

ISO/IEC 20000-1:2018, with Amendment 1:2024 adding climate action changes to clause 4.

What is the difference between ISO 20000 and ITIL?

ISO/IEC 20000-1 is a certifiable requirements standard for organisations; ITIL is practice guidance with certifications for individuals.

Do I need ITIL to get ISO/IEC 20000-1 certified?

No. Any approach that meets the requirements is acceptable, though many organisations use ITIL practices.

How long does certification take?

Often six to twelve months for a focused scope, depending on existing processes.

How long is a certificate valid?

Three years, with annual surveillance audits.

Can ISO/IEC 20000-1 be combined with ISO/IEC 27001?

Yes. They share the management system structure and are often audited together as an integrated system.

Does the standard require a change advisory board?

No. It requires a controlled change process; the organisation decides how approvals work, including automated approval for standard changes.

Can a SaaS company certify if it runs on a public cloud?

Yes. It must identify what the cloud provider does and apply controls over it, but it does not need to operate the infrastructure itself.

Which parts of the ISO/IEC 20000 series are certifiable?

Only Part 1. The other parts provide guidance, scope advice, vocabulary and certification body requirements.