ISO/IEC 20000-1 · IT service management systems
ISO/IEC 20000-1 certification consulting for IT services that meet the levels you agreed.
Achieve ISO/IEC 20000-1 certification through an independent, accredited body, with a service management system that runs your service desk, your changes and your suppliers rather than describing them for an auditor. Sterling's expert and experienced consultants build the SMS with your service teams, prepare the evidence and stay with you through Stage 1, Stage 2 and the surveillance audits that follow, in 60+ countries. We ensure successful certification for our clients.
- One all-inclusive proposal for a defined scope: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced IT service management consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
8,100+ client engagements in 60+ countries.
ISO/IEC 20000-1 client experience
What it is
What is ISO/IEC 20000-1 and what is it used for?
ISO/IEC 20000-1 is the international standard for service management systems, written for IT service management. It sets out what an organisation must have in place to plan, design, transition, deliver and improve the services it has agreed with its customers: a service catalogue, service level agreements, incident, request and problem handling, change and release control, capacity, availability and continuity management, control of suppliers and the reporting that shows whether the promises were kept. Internal IT departments, managed service providers, outsourcers, software and cloud businesses and data-centre operators use it, whether their customers sit down the corridor or across a contract.
The practical question it answers is one every IT customer asks: when something breaks, changes or grows, does the provider know, act to an agreed standard and learn from it? ITIL and similar frameworks describe good practice. ISO/IEC 20000-1 is the set of requirements an independent body can audit an organisation against, which is why it appears in outsourcing contracts and government IT tenders.
Current edition. ISO/IEC 20000-1:2018, the third edition, published in September 2018, replaces ISO/IEC 20000-1:2011; the three-year transition ended in September 2021 and certificates to the 2011 edition lapsed then. Amendment 1:2024, published in February 2024, adds to clause 4.1 the requirement to determine whether climate change is a relevant issue and notes in clause 4.2 that interested parties can have climate-related requirements; it adds no new processes or controls. The standard was confirmed at its 2023 systematic review and no revision is listed on ISO's work programme; first-time implementers build to the 2018 edition with the amendment. How ISO/IEC 20000-1 relates to ITIL 4 and ISO/IEC 27001
Who it is for
Who needs ISO/IEC 20000-1 certification?
ISO/IEC 20000-1 applies to any organisation that delivers IT services to customers, internal or external, and wants those services managed to a standard someone else can verify. The certificate covers services, not the whole company: ISO/IEC 20000-3 shows how to define a scope from a single service desk to a multi-supplier delivery chain. Organisations come to Sterling for ISO/IEC 20000-1 from four starting points:
- Nobody has asked, and the service desk is carrying the business on goodwill. Outages repeat, tickets bounce between teams, one change causes the next incident and the same customers escalate every month. An SMS turns experienced people and a ticketing tool into a system that holds when they are on leave.
- A client, tender or regulator requires the certificate. Outsourcing contracts, enterprise master service agreements and public-sector IT tenders name ISO/IEC 20000-1 as a supplier condition. Confirm which services, sites and accreditation are required before you scope the work, so the certificate answers the clause in the tender.
- You are building or scaling a managed service. A new network operations centre, a 24×7 service desk, a hosting or cloud offer or a second delivery centre. Designing the SMS while the service is being built costs a fraction of retrofitting it after the first client audit.
- You hold ISO/IEC 27001, or a certificate that no longer reflects the service. The security system runs and the service side does not, or an existing ISO/IEC 20000-1 certificate has become a set of documents nobody opens. The SMS needs rebuilding around the tool, the teams and the service levels that actually operate.
The intended benefit is predictable service and the evidence to prove it to customers. What you get depends on how it is implemented and who owns it after the consultant leaves, not on the certificate alone.
Business benefits
How ISO/IEC 20000-1 supports reliable services and confident customers
A service management system should make the service cheaper to run and easier to sell. We start with the points where an undefined service, an unowned incident or an untested change costs the business hours and credibility, and build the system around them.
- Services that are defined and agreedA catalogue your customers can read, service levels you can measure and requirements captured before a service is built, so expectations are set on paper rather than in escalation calls.
- Fewer outages, and shorter onesIncidents classified and resolved to targets, major incidents run to a procedure, and problems investigated so the same failure stops coming back.
- Changes without surprisesA change policy that says what is controlled, requests assessed for risk and impact, releases tested against acceptance criteria and deployments with a way back.
- Suppliers who are accountableContracts carrying the service levels your own SLAs depend on, performance reviewed and disputes recorded, whether the supplier is a cloud provider or a group company.
- Capacity and cost you can seeDemand forecast, capacity planned and services budgeted and accounted for, so growth is a plan rather than an emergency purchase.
- Evidence for clients, tenders and auditorsService reports, availability results and continuity tests that answer a client audit or a tender questionnaire from the system, not from a weekend of assembly.
Choose a handful of measures that reflect these priorities: service level attainment, repeat incidents, failed changes and time to resolve. Review whether the system moves them. A bigger process library is not a business result.
Requirements
What are the main ISO/IEC 20000-1 requirements?
The 2018 edition follows the harmonised structure shared by the ISO management system standards, clauses 4 to 10, with clause 8 carrying the service management processes that make it specific to IT services. The table is a plain-language map; your implementation is checked against the standard, clause by clause, during the programme.
| Clause | What it requires of you | What it looks like in practice |
|---|---|---|
| 4 Context of the organisation | Understand the organisation, the interested parties and the services the system will cover | A scope statement naming the services, customers and locations; the issues that affect delivery, including whether climate change is relevant; the SMS and its processes defined |
| 5 Leadership | Commit to service management, set the policy and assign the roles | A service management policy top management uses, defined authorities for service owners and process owners, and accountability for the services other parties help deliver |
| 6 Planning | Address risks and opportunities, set objectives and plan the SMS | A risk register for the services and the system, measurable service management objectives, and the service management plan clause 6.3 requires |
| 7 Support of the SMS | Provide resources, competence, awareness, communication, documented information and knowledge | Skills records for service staff, controlled documents, and the knowledge the teams need to deliver and support the services kept current, clause 7.6 |
| 8.1–8.2 Operation: service portfolio | Plan and control operations, deliver and plan services, control other parties in the service lifecycle, and manage the catalogue, assets and configuration | A catalogue customers can see, a documented list of the services, components and processes operated by suppliers or group companies, asset records and configuration information kept accurate |
| 8.3 Relationship and agreement | Manage the relationship with customers, agree and review service levels, and manage external and internal suppliers | Named customer contacts, complaints handled, SLAs with measured targets reviewed with customers, and supplier contracts and internal agreements aligned to those SLAs |
| 8.4 Supply and demand | Budget and account for services, manage demand and manage capacity | Service costs budgeted and tracked, demand forecast, and capacity for people, technology, information and finance planned and monitored |
| 8.5 Service design, build and transition | Control changes, design and transition new or changed services, and manage release and deployment | A change management policy, requests for change assessed and approved, designs covering the resources and impact of new services, release acceptance criteria and tested deployments |
| 8.6 Resolution and fulfilment | Manage incidents, service requests and problems | Incidents and requests recorded, prioritised and resolved to targets, a major-incident procedure, and problems analysed with known errors recorded |
| 8.7 Service assurance | Manage service availability, service continuity and information security | Availability targets and monitoring results, continuity plans tested, an information security policy, controls for assessed risks and security incidents managed |
| 9 Performance evaluation | Monitor and measure, audit internally, review the system and report on the services | Service reports customers and management act on, an internal audit programme, and a management review that decides things |
| 10 Improvement | Correct nonconformities and improve continually | Corrective actions closed with evidence, and improvements to services and to the SMS evaluated for effect |
What does useful ISO/IEC 20000-1 evidence look like?
A service catalogue, current SLAs, the service management plan, incident and problem records with their targets, requests for change with their assessments, release test results, availability reports, a tested continuity plan, supplier performance reviews and the monthly service report a customer would recognise. Most of it already exists in your ITSM tool; the work is to make it complete, consistent and connected to decisions. The management-system layer lives in Effivity from the first workshop, so the auditor meets a system in operation.
ISO/IEC 20000-1 requirements explained, clause by clauseCertification process
How do you get ISO/IEC 20000-1 certified?
First operate a working SMS. Then an independent certification body assesses it. Sterling supports you through consulting and preparation; the decision to certify rests with the certification body alone, and that separation is what gives the certificate its value in a tender.
- 01Define the services the certificate needs to cover.Confirm the services, customers, locations, delivery teams, suppliers and the intended scope statement, with ISO/IEC 20000-3 as the guide.
- 02Gap analysis: review the current service management against the requirements.The gap analysis shows what is missing in the processes, the tool and the records, keeps what works, and sets actions, owners, dates and resources.
- 03Implement and collect meaningful evidence.Put the catalogue, SLAs, change policy and plans into use, train service owners and process owners, and let the records accumulate in daily operation.
- 04Audit, review and address the findings.Internal audit and management review test whether the SMS operates as written; we raise the findings before the certification body does, and close them with evidence.
- 05Complete the independent assessment.The certification body's Stage 1 readiness review, then its Stage 2 audit of implementation and effectiveness; findings answered, then its decision.
- 06Maintain the system after certification.Service reporting, reviews, internal audits and improvement continue, while the certification body's annual surveillance and three-yearly recertification run alongside.
Judge the route by its credibility, not only by the quoted price. Ask for the certification body's identity, its accreditation to ISO/IEC 17021-1 and ISO/IEC 20000-6, the proposed scope statement and the audit arrangements, and verify them directly with the bodies concerned. Be cautious of offers that skip implementation: a certificate a client's audit team rejects leaves the outages unresolved and the money spent. How to choose a credible ISO/IEC 20000-1 provider · The certification buyer's checklist
Cost
How much does ISO/IEC 20000-1 certification cost?
No universal price for ISO/IEC 20000-1 implementation would be worth quoting. A single service desk with a mature ITSM tool needs a different scope from a managed service provider with three delivery centres, forty clients and a chain of cloud suppliers. What we can promise is a proposal that shows every component and states everything that is included.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Number of services and customers in scope, maturity of the existing processes and tool, number of delivery sites, deliverables and how much of the work your team takes on (Design™ or Drive™) |
| Independent certification | The certification body's audit days, which follow the scope, sites, headcount and complexity of the services, plus travel and the annual surveillance arrangements |
| Internal resources | Service-owner and process-owner time, tool configuration, management involvement, training, and operational changes such as a change advisory routine or a continuity test |
| Software and learning | Part of a Sterling engagement: Effivity for the management-system layer and Sterling Academy access for your people; users, courses and access period are stated in the proposal |
| Continued support | Internal audits, service reviews, refresher learning and future scope extensions under Sustain™ |
What moves the price
- Number of services, customers and SLAs in scope, and whether a catalogue exists
- Delivery sites, shifts and countries, and whether one certificate or several
- Whether an ITSM tool is in use and how much of the process already runs in it
- How many suppliers and group companies deliver parts of the services
- The deadline, and how much of the work your team can carry
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions written down
- The certification body's fees listed separately, so the whole programme cost can be compared
- Effivity, training and Academy access itemised, at no additional cost
- Payment milestones linked to deliverables rather than dates
- One all-inclusive proposal. No surprises, ever
Timeline
How long does ISO/IEC 20000-1 certification take?
The realistic timeline depends on the starting point, the availability of your service teams, the process and tool changes needed and the certification body's schedule. It is measured in months, typically six to twelve: an SMS has to run long enough to produce service reports, SLA reviews, closed problems, tested continuity plans and a change history an auditor can sample. Organisations already running ITIL-based processes in an ITSM tool sit at the shorter end; those defining their catalogue and service levels for the first time need the longer. We plan around that evidence, with milestones your team can track.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to service owners, the tool, existing SLAs, supplier contracts and records |
| Build and implementation | The extent of process change, tool configuration, agreement of the catalogue and service levels with customers, and internal capacity |
| Evidence and review | Services operating long enough to demonstrate performance against targets, followed by internal audit and management review |
| Certification assessment | The certification body's availability, Stage 1 and Stage 2 scheduling, and the time needed to close any findings |
If a client or tender deadline exists, share it at the start. We will tell you what is achievable and where early decisions are needed, such as which services to certify first. A certificate date promised before anyone has read your SLAs is a sales tactic, not a plan.
Challenges
Common ISO/IEC 20000-1 implementation challenges
Five problems account for most stalled ISO/IEC 20000-1 programmes. Each has a practical answer.
The processes live in the ticketing tool, but there is no management system around them.
Incident, request and change workflows exist, and nobody can show the policy, the objectives, the plan or the review that governs them. We build the SMS layer around the tool you already run, so the auditor sees governance and evidence rather than a second system.
The service catalogue and the SLAs do not describe what is actually delivered.
We work with service owners and customers to define the services as they operate today, agree targets that can be measured from the tool and align supplier contracts to them, so reporting stops being a monthly argument.
Suppliers and group companies deliver parts of the service with no defined control.
Clause 8.2.3 expects you to demonstrate control of the services, components and processes other parties provide. We map the delivery chain, document the agreements and set the performance reviews, whether the party is a cloud provider or a group shared services centre.
Incidents are closed and nothing is learned.
Problem management and continual improvement run on goodwill. We set the trigger for opening a problem, the known-error record and the review that turns incident trends into fixes, and make the improvements visible to management.
Continuity and security are managed by other teams, outside the SMS.
Clause 8.7 places availability, continuity and information security inside the system. We connect the existing continuity plan and its tests, the security policy and the security incident process to the SMS, which is also the natural start of an integrated ISO/IEC 27001 and ISO 22301 programme.
Your engagement
What your ISO/IEC 20000-1 engagement includes
The agreed scope covers everything a working SMS and a prepared team need. Most firms sell the documents and leave you to make them operate; a Sterling engagement is the whole journey, from one team, under one all-inclusive proposal.
Scope, gap analysis and implementation plan
Services, customers, sites and suppliers defined, with responsibilities, dates and decision owners agreed before work starts.
Process development and documentation
The service management plan, catalogue, SLAs, policies and processes built with your service owners on Sterling's own template sets, around the tool you run.
Effivity ISO & GRC software
The management-system layer of your SMS runs in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for the people who will audit the SMS, as applicable to your standard, plus preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit and management review
Run or facilitated as agreed, with every finding closed on evidence before the certification body's auditor arrives.
Certification readiness and support
Your team and evidence prepared for Stage 1 and Stage 2, and support until the certificate is in your hands.
Certification decisions remain with the independent certification body.
How we deliver
How Sterling supports your ISO/IEC 20000-1 implementation
Every ISO/IEC 20000-1 engagement runs on Sterling OS™, our delivery operating system: five phases with named deliverables, decision owners and evidence at each stage. Pick the level of support your internal capacity allows; the method, the software and the accountability do not change.
- 01Design™Guided implementation: your service owners and process owners implement with Sterling's structure, templates, workshops and coaching.
- 02Drive™Fully managed consulting: Sterling consultants take on the agreed consulting and documentation work with your process owners and tool administrators.
- 03Sustain™Post-certification operation: surveillance readiness, internal audits, service reviews, refreshers and new-hire training, year after year.
- 04Automate™The management layer of the SMS running in Effivity: documents, risks, objectives, audits, actions, supplier reviews and management review in one workspace, cross-referenced to your ITSM tool.
- 05Revise™Changes in scope, services, sites, suppliers or regulation, and any future revision of the standard.
Before work starts we agree the engagement team, the weekly working session, the deliverables and who decides what. Progress is then reviewed against those commitments every week, so a slipping deliverable is visible in month two rather than at Stage 1.
How Sterling OS™ worksOften combined with
Standards organisations pair with ISO/IEC 20000-1
- ISO/IEC 27001ISO/IEC 27001 certification consulting: an ISMS built with your people, evidence prepared, and support through Stage 1, Stage 2 and surveillance audits.
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- API Spec Q1API Spec Q1 certification consulting for oil and gas suppliers: contract review, design, purchasing and release controlled, prepared for the APIQR audit.
- AS9100AS9100 certification consulting for aerospace and defence suppliers: ISO 9001 plus product safety, configuration and FAI, ready for an IAQG scheme audit.
- CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.
- CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
Effivity · ISO/IEC 20000-1 SMS software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of ISO/IEC 20000-1:2018.
Every Sterling ISO/IEC 20000-1 engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the SMS workspace within the agreed scope: context, policy, objectives, risks, documented information, competence records, supplier evaluations, internal audits, nonconformities, corrective actions, KPIs and management review, the layer that turns service processes into a management system. Incidents, requests, problems, changes and configuration items stay in the ITSM tool your teams already use; Effivity holds the governance and evidence around them, so the certification auditor reviews a working system, not a binder. Sterling consulting clients receive Effivity included with the engagement, at no additional cost.
Context, scope and interested parties
The scope statement listing services and customers, the internal and external issues, including the climate-change determination the 2024 amendment asks for, and the interested parties, in one register reviewed on a schedule.
Service management policy, roles and objectives
The policy, the service-owner and process-owner responsibilities and the service management objectives with their measures, owners and dates, reported from the system, not from a slide.
Risks, opportunities and the service management plan
A risk register for the services and the SMS with owners, treatments and review dates, and the service management plan maintained as a controlled document with its actions tracked to closure.
Competence, awareness, documented information and knowledge
Skills and training records for service staff linked to Sterling Academy; policies, processes, SLAs and plans with versions, approvals and distribution, so only the current version is in circulation.
Suppliers, other parties and change governance
External and internal supplier agreements, performance reviews and disputes on record; the change management policy and the governance evidence for the services and processes other parties operate, cross-referenced to your ITSM tool.
Service assurance and business relationships
Availability and continuity risks, continuity test records, the information security policy and security incidents, customer complaints and service review minutes, each with its evidence attached.
KPIs, service reports, internal audit and management review
Service level attainment and other KPIs on live dashboards, the service reports customers receive, audit programmes with findings and follow-up, and a management review that records its inputs, decisions and actions.
Nonconformity, corrective action and improvement
Raised, investigated and closed with root cause and the evidence that the action worked; improvement opportunities from service reviews and problem trends prioritised and visible to management.
What this means at the audit
The certification auditor asks for the service management plan, the last management review, the SLA reviews, the supplier evaluations, the continuity test, the open nonconformities and the training records, and then samples incidents, changes and problems in your ITSM tool. In Effivity each management-system item is a screen with dates, owners and evidence attached, cross-referenced to the tickets, not a folder assembled the week before Stage 1. Once certified, Sustain™ continues in the same workspace, and each surveillance audit meets a system that has been running all year.
In your engagement
- Subscription included with the engagement, at no additional cost
- Set up by your Sterling consultant within the agreed scope
- Your policies, plans, SLAs and registers migrated, not retyped
- Admin and user training for your team
- Modules for ISMS, QMS, EMS, OHSMS and more when you integrate other standards
ISO/IEC 20000-1 client experience
Client letters on file, available on request.
Signed client letters for ISO/IEC 20000-1 are available on request. The client feedback wall lists every letter by standard.
An integrated programme with ISO/IEC 20000-1 in scope
How service management, security and continuity run as one system.
- 01Read the case study
ITES: better service delivery, protected data and more contract renewals
An IT-enabled services provider needed better service delivery and stronger protection of client data. It implemented ISO 9001, ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 20000-1 and completed a SOC 2 audit. Standard processes, SLA monitoring and early resolution of issues improved the customer experience and brought more contract renewals, while the security and privacy controls protected client data and kept it compliant with international privacy rules; its VP of operations said the work changed how the company operates.
Sterling Academy · ISO/IEC 20000-1 e-learning
Train the whole service team on ISO/IEC 20000-1, not just the process owners.
Sterling Academy trains the whole workforce and the people who run the SMS through e-learning: short video lessons, practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients get preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- ISO/IEC 20000-1 awareness for every service desk agent, engineer and manager, with the evidence of competence clause 7.2 asks for
- Practitioner courses for service owners, process owners and the person accountable for the SMS
- Internal auditor training for the people who will audit the system, as applicable to your standard, as part of the engagement
- Learner progress by team and shift, and a training status report for the certification auditor
- New starters trained as they join, so competence evidence is current at every surveillance audit
- A Sterling consultant on call when a learner gets stuck
Sterling Academy courses for an ISO/IEC 20000-1 programme
The courses your people take, and who takes them.
ISO/IEC 20000-1 Awareness
What the standard requires of the organisation and of each person who logs, resolves, changes or reports on a service, why agreed service levels matter to customers and to the business, and how the SMS shows up in a shift. The competence evidence for the whole service workforce.
View the courseDocumented Information Management
Creating, controlling and using the SMS documents the 2018 edition requires, from the service management plan and catalogue to SLAs, policies and records, so they stay current, usable and audit-ready.
View the courseNonconformity Management
Raising, investigating and closing nonconformities found in audits, service reviews and customer complaints, root cause and corrective action, and the evidence that a fix actually worked.
View the courseRisk Management
Identifying, evaluating and treating risks and opportunities to the services and the SMS, including availability, continuity and security risks, with the register, ownership and review clauses 6.1 and 8.7 expect.
View the courseInternal auditor training
Delivered by your Sterling consultant for the people who will audit the service management system, with practical exercises on your own incidents, changes and SLAs and a Certificate of Competence.
Integrating other standards?
Awareness courses for ISO/IEC 27001, ISO 9001, ISO 14001, ISO 45001 and more, so one workforce learns an integrated system on one platform.
See all coursesAccess for Sterling consulting clients is arranged by their consultant. Sterling Academy certificates evidence training; certifying your service management system remains the independent certification body's decision.
Where we work
Where Sterling delivers ISO/IEC 20000-1
- ISO/IEC 20000-1 in Australia
- ISO/IEC 20000-1 in Austria
- ISO/IEC 20000-1 in Bahrain
- ISO/IEC 20000-1 in Bangladesh
- ISO/IEC 20000-1 in Belgium
- ISO/IEC 20000-1 in Brazil
- ISO/IEC 20000-1 in Canada
- ISO/IEC 20000-1 in China
- ISO/IEC 20000-1 in Czechia
- ISO/IEC 20000-1 in Denmark
- ISO/IEC 20000-1 in Egypt
- ISO/IEC 20000-1 in France
- ISO/IEC 20000-1 in Germany
- ISO/IEC 20000-1 in Ghana
- ISO/IEC 20000-1 in Hong Kong
- ISO/IEC 20000-1 in India
- ISO/IEC 20000-1 in Indonesia
- ISO/IEC 20000-1 in Ireland
- ISO/IEC 20000-1 in Italy
- ISO/IEC 20000-1 in Japan
- ISO/IEC 20000-1 in Jordan
- ISO/IEC 20000-1 in Kenya
- ISO/IEC 20000-1 in Kuwait
- ISO/IEC 20000-1 in Malaysia
- ISO/IEC 20000-1 in Maldives
- ISO/IEC 20000-1 in Mauritius
- ISO/IEC 20000-1 in Mexico
- ISO/IEC 20000-1 in Nepal
- ISO/IEC 20000-1 in the Netherlands
- ISO/IEC 20000-1 in New Zealand
- ISO/IEC 20000-1 in Nigeria
- ISO/IEC 20000-1 in Norway
- ISO/IEC 20000-1 in Oman
- ISO/IEC 20000-1 in Pakistan
- ISO/IEC 20000-1 in the Philippines
- ISO/IEC 20000-1 in Poland
- ISO/IEC 20000-1 in Portugal
- ISO/IEC 20000-1 in Qatar
- ISO/IEC 20000-1 in Saudi Arabia
- ISO/IEC 20000-1 in Singapore
- ISO/IEC 20000-1 in South Africa
- ISO/IEC 20000-1 in South Korea
- ISO/IEC 20000-1 in Spain
- ISO/IEC 20000-1 in Sri Lanka
- ISO/IEC 20000-1 in Sweden
- ISO/IEC 20000-1 in Switzerland
- ISO/IEC 20000-1 in Taiwan
- ISO/IEC 20000-1 in Tanzania
- ISO/IEC 20000-1 in Thailand
- ISO/IEC 20000-1 in Türkiye
- ISO/IEC 20000-1 in Uganda
- ISO/IEC 20000-1 in the United Arab Emirates
- ISO/IEC 20000-1 in the United Kingdom
- ISO/IEC 20000-1 in the United States
- ISO/IEC 20000-1 in Vietnam
Keep exploring
Explore more about ISO/IEC 20000-1
Watch a video on how to implement ISO 20000-1 here.
Watch a video on ISO 20000-1 requirements here.
ISO/IEC 20000-1 resources
Services for ISO/IEC 20000-1
Industries
Why Sterling
Want successful ISO/IEC 20000-1 certification? Come to Sterling.
Whether you run one service desk or deliver managed services from several countries, Sterling helps you build common service management processes that each delivery centre owns locally. We work through differences in customer contracts, tooling, supplier arrangements and applicable requirements, so the SMS supports growth without losing sight of how each delivery centre operates.
Management systems in 60+ countries since 2003
Systems implemented for managed service providers, BPOs, software and cloud businesses, telecoms and internal IT functions across every region we serve, with a single engagement team accountable in every country you deliver from.
All-inclusive proposal
One proposal covering consulting, Effivity, training and Academy access, with the certification body's fees shown separately so the full cost is comparable. No surprises, ever.
A system your service teams can use
Minimum documentation, maximum effect: the SMS built around your ITSM tool and your shifts, so engineers and agents adopt it rather than tolerate it.
Expert and experienced consultants
Consultants who have advised on management systems across sectors and countries since 2003, and who build the SMS right the first time, so the certification audit confirms what is already working.
The Sterling Promise
What our ISO/IEC 20000-1 certification success guarantee means
We remain engaged until the ISO/IEC 20000-1 certification outcome agreed in your engagement is reached, through consulting, audit preparation and the closure of assessment findings. Clear explanations, practical delivery, included software and employee learning turn the investment into a service operation that keeps improving rather than a certificate on a wall.
The engagement letter names the standard, the scope, the outcome and each party's responsibilities. Your organisation provides accurate information and operates the agreed processes. The independent certification body assesses conformity, and its decision is its own. Our commitment covers the agreed certification support, not every future contract award or an outage-free service.
After certification
What happens after ISO/IEC 20000-1 certification?
An SMS has to keep working while services, customers, suppliers and technology change around it. Service reports go out, service levels are reviewed, problems are worked, changes are assessed and continuity plans are tested again. The certification body comes back for a surveillance audit, normally every year, and for recertification in year three.
As the service portfolio grows, the system should grow with it. Under Sterling OS™ Sustain™ we review service performance, repeat incidents, failed changes and supplier results with you alongside the planned internal audits, management reviews and surveillance preparation, so the SMS keeps running between audits instead of being revived for them.
FAQs
Frequently asked questions about ISO/IEC 20000-1
Is ISO/IEC 20000-1 the same as ITIL? Do we need ITIL first?
No, and no. ITIL 4 is a framework of good practice owned by PeopleCert; it qualifies individuals and cannot certify an organisation. ISO/IEC 20000-1 is the international standard an organisation can be certified against by an accredited body. ITIL-based processes are a good starting point, and ISO/IEC TS 20000-11 maps ITIL 4 to the requirements, but the standard does not require ITIL and using ITIL does not by itself demonstrate conformity.
Which services should the certificate cover?
The services you want customers to rely on, in a scope statement naming the services, the customers, the locations and the parties that deliver parts of them. ISO/IEC 20000-3 gives worked examples from a single service desk to a multi-supplier chain. A narrow, accurate scope that grows at surveillance audits is worth more than a broad one that fails at Stage 2.
Can an internal IT department be certified, or only service providers?
Both. The standard applies to any organisation delivering IT services, including a corporate IT function whose customers are the business units it serves. Internal customers still need a catalogue, agreed service levels and service reports; only the agreements are internal rather than contractual.
Do we need an ITSM tool?
The standard does not name one, but it requires records of incidents, requests, problems, changes, configuration information and availability that are hard to keep credibly on spreadsheets beyond a small operation. We build the SMS around the tool you already run; if you have none, we help you choose a proportionate one before process design starts, so processes and tool are designed together.
Does Sterling issue the ISO/IEC 20000-1 certificate?
No. Sterling's role is consulting and hands-on support. An independent certification body, accredited to ISO/IEC 17021-1 and ISO/IEC 20000-6, conducts the audit and makes the certification decision. Anyone offering to do both is selling paper.
Can we combine ISO/IEC 20000-1 with ISO/IEC 27001 or ISO 9001?
Yes, and for IT service providers it is usually the right design. Clause 8.7.3 already requires an information security policy, controls and incident handling; ISO/IEC 27013 describes how to implement or integrate an SMS and an ISMS together, and the harmonised structure shared with ISO 9001 and ISO 22301 lets document control, risk, internal audit and management review run once. Each standard's specific requirements still have to be met.
Parts of our service are delivered by suppliers or a group company. Is that a problem?
No, provided you control it. Clause 8.2.3 expects you to identify the services, service components and processes other parties provide and to demonstrate control over them through agreements, performance reviews and defined authority. Accountability for the service you certify cannot be outsourced with the work.
What does the 2024 amendment change?
Very little in practice. Amendment 1:2024 adds one requirement to clause 4.1, to determine whether climate change is a relevant issue for the organisation, and a note to clause 4.2 that interested parties can have climate-related requirements. Record the determination and the reasoning behind it; if climate change is relevant to your services, for example through data-centre energy or cooling, address it through the existing risk process.
Is a new edition of ISO/IEC 20000-1 coming?
Not at present. The 2018 edition was confirmed at its 2023 systematic review and no revision appears on ISO's work programme as of September 2026. The 2011 edition is withdrawn and its certificates lapsed in September 2021; one presented today is not valid.
What do you need to prepare an ISO/IEC 20000-1 proposal?
The services and customers to be covered, the delivery locations and approximate headcount, the ITSM tool in use, the main suppliers, whether a system or certificate exists today, any client or tender requirement, and your deadline. That is enough for a scoped, all-inclusive proposal; the service catalogue can come later.
Before the first call
Prepare a useful ISO/IEC 20000-1 readiness brief
No service catalogue or process manual is needed before the first discussion. A short account of the services you deliver, and of where the certificate should help, is enough; seven questions cover it:
- What does your client, tender or contract require, including the services and locations to be covered? Or, if nobody has asked, which service problems do you want to stop?
- Which IT services do you deliver, to whom, and which parts of them are provided by suppliers or group companies?
- What tool records your incidents, requests, problems and changes today, and which service levels, if any, are agreed in writing?
- What do outages, repeat incidents, failed changes or customer escalations tell you about the starting point?
- Which existing processes, reports and plans, such as a continuity plan or a change board, already work well?
- Who will make the decisions, and who can give time to implementation, internal audit and learning?
- Is there an existing certificate, a client audit date or a contract deadline to plan around?
These answers let us scope the work and write a realistic proposal. They prepare a conversation; they are not a scored assessment and not a certification decision.
Don’t be fooled by certification scams
If it takes ten days, it is not ISO/IEC 20000-1 certification.
A certificate is useful when its scope statement names the services a client is paying for and the SMS behind it can stand up to that client's audit team. The market is awash with paper: certificates from bodies no one accredits, consultants who promise to write everything while your service desk changes nothing, and audits that never open a ticket. They cost less, until a procurement team, a tender evaluator or a client's auditor checks.
How to choose a credible ISO/IEC 20000-1 provider
- Ask which body will issue the certificate and where its public register shows the certificate's status and scope statement, then look it up yourself.
- Confirm the accreditation your client requires. For ISO/IEC 20000-1 the body should be accredited to ISO/IEC 17021-1 and ISO/IEC 20000-6 by an accreditation body recognised under the Global ACI arrangement, which replaced the IAF MLA and ILAC MRA; check with the accreditation body itself, not a logo in a quotation.
- Ask how the programme will review actual incidents, changes, SLAs and supplier performance. Documents should reflect your services, not a template with another provider's catalogue still in it.
- Establish who does each task, which certification-body costs sit outside the fee, and who supports you when Stage 2 findings need corrective action.
- Ask what your service teams will be trained on and which software the SMS will run in. Without training and a system, nothing survives the consultant's last invoice.
- Walk away from "certified in ten days", "we handle everything" and a single invoice covering consulting and the certificate. A service management system has to operate and produce records before anyone can audit it.
Keep exploring
More on ISO/IEC 20000-1 and related standards
Every ISO/IEC 20000-1 guide
More in Information security, cyber & cloud
Talk to a consultant
Plan your ISO/IEC 20000-1 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice