ISO 20000-1 requirements explained: what clauses 4 to 10 ask of your service management system

How are the ISO/IEC 20000-1 requirements organised?

ISO/IEC 20000-1:2018 is the third edition of the service management system standard, with ten numbered clauses. The first three set the frame: clause 1 states that the document specifies requirements for establishing, implementing, maintaining and continually improving a service management system (SMS), clause 2 names the normative reference and clause 3 defines the terms. Auditable requirements start at clause 4.

Six of those seven clauses mirror the other ISO management system standards, so an SMS can share its risk method, audits and reviews with ISO 9001 or ISO/IEC 27001. Clause 8 is the part unique to service management. It is grouped into six service areas, covered below.

The requirements state outcomes, not methods: you choose the tool and the format, and the auditor tests them against how services are really delivered.

Clauses 4 to 7: context, leadership, planning and support

Clause 4: context of the organisation

You determine the internal and external issues that affect the SMS (4.1), the interested parties and their requirements (4.2), and the scope (4.3), then establish the system and its processes (4.4). Since Amendment 1:2024, clause 4.1 also requires you to determine whether climate change is a relevant issue, and a note to 4.2 recognises that interested parties may hold climate-related requirements. Action follows only if you judge it relevant, but the judgement needs evidence. ISO/IEC 20000-3 is the guidance part on writing the scope.

Clause 5: leadership

Top management demonstrates leadership and commitment (5.1), establishes and communicates the service management policy (5.2) and assigns roles, responsibilities and authorities (5.3). In practice: named service and process owners with authority to act.

Clause 6: planning

Clause 6.1 covers actions to address risks and opportunities; 6.2 sets service management objectives and the plans to achieve them. Clause 6.3 is specific to this standard: you must plan the SMS itself, and that plan is the service management plan, one of the documents the 2018 edition still names.

Clause 7: support

Resources, competence, awareness and communication (7.1 to 7.4) come first, followed by documented information (7.5), which includes a sub-clause on the documented information the SMS itself must hold. Clause 7.6, knowledge, asks you to determine and maintain the knowledge needed to run the SMS and the services.

Clause 8.1 to 8.3: planning, service portfolio and agreements

Clause 8.1 requires operational planning and control. Clause 8.2, the service portfolio, then covers service delivery (8.2.1), planning the services (8.2.2), control of the parties involved in the service lifecycle (8.2.3), the service catalogue (8.2.4), asset management (8.2.5) and configuration management (8.2.6). Clause 8.2.3 is where many scopes are tested: the SMS must identify the services, service components and processes that suppliers, internal groups or customers operate, and keep that list as documented information.

Clause 8.3, relationship and agreement, covers business relationship management (8.3.2), service level management (8.3.3) and supplier management (8.3.4). The 2018 edition distinguishes external suppliers, managed through contracts, from internal suppliers and customers acting as suppliers, managed through documented agreements. Auditors check that supplier commitments support the service levels promised to customers.

Clause 8.4 to 8.7: supply, change, resolution and assurance

Clause 8.4, supply and demand, asks for budgeting and accounting for services (8.4.1), demand management (8.4.2) and capacity management (8.4.3). Clause 8.5, service design, build and transition, begins with change management (8.5.1), which requires a change management policy, then service design and transition (8.5.2) and release and deployment management (8.5.3), where release acceptance criteria must be defined.

Clause 8.6, resolution and fulfilment, covers incident management (8.6.1), service request management (8.6.2) and problem management (8.6.3). A documented procedure for classifying and managing a major incident is required, and problems must be analysed with known errors recorded. Clause 8.7, service assurance, covers availability (8.7.1), continuity (8.7.2) and information security (8.7.3), which calls for an information security policy, controls for the assessed risks and the management of security incidents.

ITIL-based teams usually find much of this already in place; the ITIL 4 comparison guide covers the mapping.

ISO/IEC 20000-1 vs ITIL 4: framework, standard and how they fit

Clauses 9 and 10: performance evaluation and improvement

Clause 9 has four parts, one more than the other management system standards. Monitoring, measurement, analysis and evaluation (9.1), internal audit (9.2) and management review (9.3) are familiar; service reporting (9.4) is added, so reports on service performance and trends become a requirement, not a courtesy. Auditors compare them with SLA targets and ask what happened when one was missed.

Clause 10 covers nonconformity and corrective action (10.1) and continual improvement (10.2). Corrective action means finding the cause and checking that the action worked; improvement opportunities are recorded and evaluated.

ISO/IEC 20000-1 internal audit: planning, conduct and reporting

Which documents and records does the standard name?

The 2018 edition cut the number of prescribed documents, but a core set remains. The table groups what the clauses name; the documentation guide covers how to write and keep each one.

ISO/IEC 20000-1 documentation: the service management plan, catalogue and SLAs

What the 2018 edition and the 2024 amendment changed

The 2018 edition moved the standard onto the harmonised structure and changed its vocabulary: "service provider" became "organisation", "internal group" became "internal supplier" and "supplier" became "external supplier". Incident, service request, availability, continuity, service level, catalogue, capacity and demand management each gained a clause of their own. Certificates to the 2011 edition lapsed in September 2021.

Amendment 1:2024 is limited to the climate change additions in clauses 4.1 and 4.2. ISO confirmed the standard at its 2023 systematic review, and no revision appears in the committee's current work programme, so a system built now is built to the 2018 edition with the amendment.

ISO/IEC 20000-1 requirements: questions buyers ask