Poland · Certification
ISO/IEC 20000-1 certification in Poland
Achieve ISO 20000-1 certification in Poland with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Accredited certification
- Frankfurt office team
- Effivity software included
- Academy training included
Who asks for ISO 20000-1 in Poland
Clients include
ISO 20000-1 certification in Poland at a glance
Rozporządzenie w sprawie Krajowych Ram Interoperacyjności (Dz. U. 2024 poz. 773), section 15 refers to ISO/IEC 20000-1, yet none of the Polish instruments checked makes it compulsory. Buyers in Poland ask for it anyway.
Public-sector IT service management has a direct regulatory hook in Poland. Section 15 of the Krajowe Ramy Interoperacyjności regulation deems its service-management requirements met where the design, operation, monitoring and improvement of the service take Polish Standards PN-ISO/IEC 20000-1 and PN-ISO/IEC 20000-2 into account, which is why managed-service and outsourcing providers selling to government expect the question. Providers of ICT service management also sit in the amended National Cybersecurity System Act, where Art. 41 names the minister responsible for digital affairs as their competent authority. Shared-service centres and BPO providers meet the standard through client contracts and audits. The certificate comes from a certification body accredited by the Polish Centre for Accreditation (PCA) or another body within the international recognition arrangements. Sterling's Frankfurt office documents incident, change, release and configuration processes with the delivery teams and aligns them with information security controls, with Effivity and Sterling Academy included in the engagement.
Who needs ISO 20000-1 in Poland, and what happens without it
In Poland the question rarely comes from a law. It comes from the buyer, the regulator or the partner that wants proof before it signs. These are the organisations that get asked.
- Public bodies and entities performing public tasksThe interoperability regulation deems IT service management requirements met where PN-ISO/IEC 20000-1 and 20000-2 are taken into account.
- Managed service and IT outsourcing providers serving public bodiesPublic customers expect service management that meets the regulation's requirements.
- ICT service management providers under the national cybersecurity systemThe amended Act names a competent authority for the ICT service management sector.
- Shared-service centres and BPO providers running IT services for clientsClient contracts and audits ask for documented service management.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the ISO/IEC 20000-1 readiness checkISO 20000-1 requirements in Poland
Strip away the vocabulary and ISO/IEC 20000-1 requires a company to prove six things about how it plans and delivers IT services.
In Poland these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: ISO/IEC 20000-1 explained →
How to get ISO 20000-1 certified in Poland
One team from the Frankfurt office carries the work from scoping to certificate. Clients in Poland are served from Sterling's Frankfurt office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against ISO/IEC 20000-1 and the Polish requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before the certification body arrives.
- Certification body stage 1 and stage 2, then surveillanceAn accredited body audits and decides. Sterling supports the audits and the three-year cycle.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does ISO 20000-1 certification take in Poland?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Poland these are the factors that set the timeline.
- Services, locations and customers in the scope
- Maturity of incident, change, release and configuration processes
- Evidence of service reporting and management review
- Certification body scheduling
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does ISO 20000-1 certification cost in Poland?
The cost has two parts: the consulting work to build and prove the system, and the certification body’s audit fees, which are quoted separately. In Poland these factors move both.
- Number of services, sites and teams in scope
- Service management tooling and process integration
- Certification body audit fees quoted separately from consulting
- Integration with ISO/IEC 27001
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
ISO 20000-1 consultants and certification bodies in Poland
Two different organisations are involved. A consultant helps you build the system and prove it works; an accredited certification body then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers ISO 20000-1 and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Poland are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive ISO 20000-1 in Poland (3)
| Instrument | How it treats the standard |
|---|---|
| Rozporządzenie w sprawie Krajowych Ram Interoperacyjności (Dz. U. 2024 poz. 773), section 15 | Refers to / expects IT service management requirements are deemed met where design, deployment, operation, monitoring, review, maintenance and improvement of service management take Polish Standards PN-ISO/IEC 20000-1 and PN-ISO/IEC 20000-2 into account; certification is not itself required. |
| National Cybersecurity System Act as amended (Dz. U. 2026 poz. 252), Art. 41 | Context Names the minister responsible for digital affairs as competent authority for the ICT service management sector; the Act does not name ISO/IEC 20000-1. |
| Polskie Centrum Akredytacji (PCA) — national accreditation body | Market driver Accredited ISO/IEC 20000-1 certification is available through the national accreditation body; no mandate. |
Accreditation, audit language and remote audits in Poland
Use a certification body accredited for ISO/IEC 20000-1 by the Polish Centre for Accreditation (PCA) or by another accreditation body within the international mutual recognition arrangements (Global ACI — Global Accreditation Cooperation Incorporated, formerly the IAF MLA); check that the accreditation scope covers the standard and your sector. No body is named here unless its accreditation scope has been verified. Edition and transition details: ISO/IEC 20000-1 hub →
Audit language
Audits are held in Polish or English; agree the audit language and the language of controlled documents with the certification body at application, and follow any language requirement in a tender or contract.
Remote and on-site
Remote audit elements are at the certification body's discretion under its accreditation rules; operational sites are normally visited on-site.
ISO 20000-1 in Poland: questions clients ask
Does Polish public-sector regulation mention ISO 20000-1?
Yes. Section 15 of the Krajowe Ramy Interoperacyjności regulation deems the requirements for IT service management met where the design, deployment, operation, monitoring, review, maintenance and improvement of the service take Polish Standards PN-ISO/IEC 20000-1 and PN-ISO/IEC 20000-2 into account. It speaks of taking the standards into account rather than holding a certificate; confirm expectations with your public customer.
Are managed IT service providers covered by the Polish NIS2 law?
The amended Act names a competent authority for them. Art. 41 gives the minister responsible for digital affairs the role for the ICT service management sector. Whether your company is a key or important entity depends on the Act's criteria and annexes, which you should check with counsel; the Act does not name ISO/IEC 20000-1 as the way to comply.
Who accredits ISO 20000-1 certification bodies in Poland?
The Polskie Centrum Akredytacji (PCA), the national accreditation body for Poland, which accredits organisations providing certification services and reports full signatory status in the EA and Global ACI arrangements. Because accreditation is scoped, ask any certification body for proof that ISO/IEC 20000-1 sits inside its PCA scope before you appoint it.
Can ISO 20000-1 and ISO 27001 share one management system?
Yes, and many service providers do. Both standards use a management-system structure, so document control, internal audit, management review and corrective action can be shared, with service-specific and security-specific processes added on top. Integration is listed among the cost drivers because it reduces duplicated effort. Agree combined audit arrangements with your certification body.
More on ISO 20000-1 for Polish organisations
Other standards Polish businesses ask Sterling for
Organisations in Poland often combine ISO/IEC 20000-1 with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Frankfurt office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Rozporządzenie w sprawie Krajowych Ram Interoperacyjności (Dz. U. 2024 poz. 773), section 15 — api.sejm.gov.pl (accessed 7 Oct 2026)
- National Cybersecurity System Act as amended (Dz. U. 2026 poz. 252), Art. 41 — api.sejm.gov.pl (accessed 7 Oct 2026)
- Polskie Centrum Akredytacji (PCA) — national accreditation body — pca.gov.pl (accessed 7 Oct 2026)
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice