Two-minute brief
ISO/IEC 20000-1 requirements explained: video brief
A two-minute brief on ISO/IEC 20000-1:2018: the management system clauses and the service management processes in clause 8 that make it specific to IT services.
Key takeaways
- ISO/IEC 20000-1 follows clauses 4 to 10, with IT service processes in clause 8.
- A service management plan is a specific planning requirement.
- Service level agreements and supplier management sit under agreement management.
- Change and release control, incident, request and problem management all produce records.
- Availability, continuity, capacity and information security assure the services.
The service management system clauses
The 2018 edition of ISO/IEC 20000-1 follows the harmonised structure shared by the ISO management system standards, clauses 4 to 10, with clause 8 carrying the service management processes that make it specific to IT services. This short film walks through that structure.
Context asks you to understand the organisation, the interested parties and the services the system will cover; in practice a scope statement naming the services, customers and locations, and the issues that affect delivery, including whether climate change is relevant. Leadership means a service management policy top management uses, defined authorities for service owners and process owners, and accountability for the services other parties help deliver. Planning covers a risk register for the services and the system, measurable service management objectives and the service management plan. Support provides resources, competence, awareness, communication, documented information and knowledge.
In practice that means skills records for service staff and controlled knowledge the service desk can rely on.
Clause 8: the processes behind the services
Clause 8 holds the operational requirements: planning and control, the service portfolio and service catalogue, relationship and agreement management including service level agreements and supplier management, supply and demand, service design, build and transition with change and release control, resolution and fulfilment through incident, request and problem management, and service assurance through availability, continuity, capacity and information security management.
Performance evaluation asks for monitoring and reporting of services against what was agreed, internal audit and management review, and improvement closes the loop. The standard applies to managed service providers, IT outsourcers and BPOs, software and cloud businesses, data centres and internal IT functions. Certificates to the 2011 edition lapsed in September 2021; certification is decided by an independent, accredited certification body.
The certificate covers services rather than a whole company, and ISO/IEC 20000-3 shows how to define a scope, from a single service desk to a multi-supplier delivery chain.
ISO/IEC 20000-1 at a glance
- Purpose
- IT service management: planning, designing, transitioning, delivering and improving services to agreed requirements, with the incident, change, capacity, continuity and supplier disciplines behind them
- Relevant to
- Managed service providers, IT outsourcers and BPOs, software and cloud businesses, data centres and internal IT functions serving their own organisation
- Edition
- ISO/IEC 20000-1:2018 with Amendment 1:2024; no revision in progress; certificates to the 2011 edition lapsed in September 2021
- Certification
- Assessed and decided by an independent certification body accredited to ISO/IEC 17021-1 and ISO/IEC 20000-6
- Sterling's role
- Implementation with your service teams, Effivity, training, internal audit and certification readiness, then Sustain™
- Cost and timing
- Total investment for an ISO/IEC 20000-1 SMS depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 6 to 12 months
ISO/IEC 20000-1: questions people ask
Is ISO/IEC 20000-1 the same as ITIL? Do we need ITIL first?
No, and no. ITIL 4 is a framework of good practice owned by PeopleCert; it qualifies individuals and cannot certify an organisation. ISO/IEC 20000-1 is the international standard an organisation can be certified against by an accredited body. ITIL-based processes are a good starting point, and ISO/IEC TS 20000-11 maps ITIL 4 to the requirements, but the standard does not require ITIL and using ITIL does not by itself demonstrate conformity.
Which services should the certificate cover?
The services you want customers to rely on, in a scope statement naming the services, the customers, the locations and the parties that deliver parts of them. ISO/IEC 20000-3 gives worked examples from a single service desk to a multi-supplier chain. A narrow, accurate scope that grows at surveillance audits is worth more than a broad one that fails at Stage 2.
Can an internal IT department be certified, or only service providers?
Both. The standard applies to any organisation delivering IT services, including a corporate IT function whose customers are the business units it serves. Internal customers still need a catalogue, agreed service levels and service reports; only the agreements are internal rather than contractual.
Do we need an ITSM tool?
The standard does not name one, but it requires records of incidents, requests, problems, changes, configuration information and availability that are hard to keep credibly on spreadsheets beyond a small operation. We build the SMS around the tool you already run; if you have none, we help you choose a proportionate one before process design starts, so processes and tool are designed together.
Does Sterling issue the ISO/IEC 20000-1 certificate?
No. Sterling's role is consulting and hands-on support. An independent certification body, accredited to ISO/IEC 17021-1 and ISO/IEC 20000-6, conducts the audit and makes the certification decision. Anyone offering to do both is selling paper.
Keep exploring
Related to this video
Read next
The complete guide
Everything on ISO/IEC 20000-1
Start with the ISO/IEC 20000-1 page, or go straight to the guide you need.
On the ISO/IEC 20000-1 page
- What are the main ISO/IEC 20000-1 requirements?
- How do you get ISO/IEC 20000-1 certified?
- How much does ISO/IEC 20000-1 certification cost?
- How long does ISO/IEC 20000-1 certification take?
- Who needs ISO/IEC 20000-1 certification?
- How ISO/IEC 20000-1 supports reliable services and confident customers
- Frequently asked questions about ISO/IEC 20000-1
Guides
Often combined with ISO/IEC 20000-1
More videos: Quality and operational excellence
- How to implement ISO 10012Implementation walkthrough · 3 min 15 s
- ISO 10012 requirements explainedTwo-minute brief · 2 min
- How to implement ISO 44001Implementation walkthrough · 3 min 15 s
- ISO 44001 requirements explainedTwo-minute brief · 2 min
- How to implement ISO 56001Implementation walkthrough · 3 min 15 s
- ISO 56001 requirements explainedTwo-minute brief · 2 min
- How to implement ISO 41001Implementation walkthrough · 3 min 14 s
- ISO 41001 requirements explainedTwo-minute brief · 2 min
- How to implement ISO 9001Implementation walkthrough · 3 min 14 s
Talk to a consultant
Plan your ISO/IEC 20000-1 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice