CyphrQ
Menu

ISO/IEC 20000-1 Explained: IT Service Management, ITIL and Certification

ISO/IEC 20000-1 is the certifiable standard for IT service management. What it requires, how it differs from ITIL, and how certification works.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

10 min read

ISO/IEC 20000-1 is the international standard for running IT services as a managed, auditable system. It sets requirements for a service management system (SMS): how an organisation plans, designs, delivers and improves services for its customers. An accredited auditor can certify it. ITIL, by contrast, is a framework of guidance. You can follow ITIL without a certificate, and you cannot be "certified" to it as an organisation.

What is ISO/IEC 20000-1 and who publishes it?

ISO/IEC 20000-1:2018 is titled "Information technology - Service management - Part 1: Service management system requirements". It is published jointly by ISO and IEC and maintained by their joint technical committee ISO/IEC JTC 1/SC 40, which covers IT service management and IT governance. The IEC webstore listing shows edition 3.0, published 14 September 2018. The official ISO page is iso.org/standard/70636.html; check it for the current status and any amendment before you cite the edition in a contract or tender.

The standard is a "Part 1" because it has relatives. Part 1 holds the requirements you are audited against. Other parts of the series give guidance and vocabulary, and there is a separate part with requirements for the bodies that certify. I don't list their titles here; confirm the parts and editions on iso.org.

What does ISO/IEC 20000-1 cover?

The IEC listing describes the scope as requirements for an organisation to establish, implement, maintain and continually improve a service management system, including the planning, design, transition, delivery and improvement of services.

In plain terms, a service is something you provide to a customer so they get a result without owning the cost and risk of producing it: a managed email platform, a payroll system run for a client, an internal help desk for the rest of the company. A service management system is the set of policies, roles, processes and records that make that service predictable.

The requirements run through the usual management-system clauses. A training provider's course outline for the standard shows the structure: an introduction, then clauses 4 to 6 on the organisation, leadership and planning, then clauses 7 to 10 on support, operation, performance evaluation and improvement. The part most people care about is the operation clause. From my reading of its structure, it groups service management work into areas such as:

  • Service portfolio and catalogue: what you offer, to whom, and who is responsible.
  • Relationships and agreements: service level agreements, supplier management and the contracts behind them.
  • Supply and demand: budgeting, capacity and demand planning.
  • Design, build and transition: how a new or changed service goes live, including change and release control.
  • Resolution and fulfilment: incidents, service requests and problems.
  • Service assurance: availability, continuity and information security.

The standard text is paid and copyrighted, so I describe its shape and do not quote it. Your licensed copy is the authority on exact wording and clause numbers.

Who uses ISO/IEC 20000-1, and can you be certified?

Yes, you can be certified. The standard is written so that a third party can audit against it. The IEC listing names its intended audiences: customers who want assurance about service quality, service providers who want to show capability, conformity assessment bodies, and training or advisory providers.

In practice the people who ask for it are:

  • Managed service providers and outsourcers, because customers and tender documents ask for proof that the provider runs controlled processes.
  • Internal IT departments and shared-service centres in larger organisations that run IT like a service business.
  • Government and regulated bodies that want a recognised yardstick for their own IT service operation.

In practice: in an announcement on its own site, the US consultancy Excella says it achieved ISO/IEC 20000-1:2018 certification after an independent audit by National Quality Assurance (NQA), which Excella describes as an ANAB-accredited management systems certification body. The page lists the areas the audit looked at: IT service management processes, management review, documentation management, resource management and continual service improvement. It does not give a formal scope statement. That is a useful reminder: the scope on the certificate is the real claim.

Another example is the Qatari satellite operator Es'hailSat, whose press release page reports ISO/IEC 20000-1:2018 certification in 2021. I have only seen the headline and a summary of that announcement, so read the page itself for the certifying body and scope.

How does ISO/IEC 20000-1 relate to ITIL?

ITIL is a framework published for IT service management. The PeopleCert ITIL page presents it as a framework and sells exam-based qualifications for individuals. It lists both ITIL 4 and a newer ITIL Version 5 pathway, with a bridge course for ITIL 4 holders. That page is about people qualifications; it does not describe an organisational certificate against ITIL.

The difference, in two lines:

ISO/IEC 20000-1 ITIL
What it is A standard with requirements ("shall" statements) A framework of guidance and practices
Who gets certified An organisation's service management system Individuals, through exams
How you prove it A third-party audit and certificate with a defined scope An exam pass for a person

They work together because they overlap in subject. ITIL describes good ways to do incident, change or service level management. ISO/IEC 20000-1 says what your system must achieve and evidence. Many organisations use ITIL language and practices to meet the standard, but the standard does not require you to adopt ITIL. A mapping between them is a design choice you make and document, not an automatic equivalence.

Where does ISO/IEC 20000-1 fit next to ISO 27001 and ITIL?

ISO/IEC 27001 manages information security risk. ISO/IEC 20000-1 manages the quality and reliability of the service itself, and touches information security as one of its service assurance areas. A provider often holds both: one proves the data is protected, the other proves the service is run in a controlled way. For comparison with a different kind of report, see SOC 2 vs ISO 27001. The AI-specific sibling in the same family is covered in ISO/IEC 42001 explained.

Change management is the clearest overlap with audit work outside this standard: the controls auditors test under IT general controls include change management too, and one well-run process can serve both audits.

For related standards, browse the ISO Standards subtopic page.

How does ISO/IEC 20000-1 certification work in practice?

The pattern follows other ISO management system certifications. Your chosen body will set its own stages and timings, so treat this as the general shape.

  1. Decide the scope. Which services, which customers, which locations and which teams. The certificate describes this scope, so be precise.
  2. Build the SMS. Policies, a service management plan, defined processes, roles, supplier agreements and the records they produce.
  3. Run it and collect evidence. Operate the processes for long enough to show repeatable records. Hold an internal audit and a management review.
  4. Choose an accredited certification body. Check that it is accredited for this standard by a national accreditation body that signs the relevant international recognition arrangements.
  5. Pass the audit stages. A documentation review and an on-site or remote assessment. Gaps are raised as nonconformities you must correct.
  6. Stay certified. Expect periodic surveillance audits and recertification. Confirm the cycle with the body.

Going deeper: for security and IT teams

Start with scope, not with processes. A common failure in a first attempt is a scope that is either too wide to evidence or so narrow that customers question its value. Write the scope as a list of services, the supporting teams, the locations and any parts of the service delivered by other parties. Then decide what is excluded and why. Auditors read the scope statement first and test everything else against it.

Map the processes to what you already run. Most IT teams already have an incident record, a change record and a service desk tool. The work is to show they connect and are controlled:

  • A service catalogue entry for each in-scope service with a named owner.
  • Service level targets agreed with the customer and reported on a schedule, with actions when a target is missed.
  • An incident process with priorities, escalation and closure criteria, linked to a problem process that records root causes and known errors.
  • A change process with risk assessment, approval, test evidence and a rollback plan, separated from the release and deployment process.
  • Configuration and asset records good enough to show what supports each service.
  • A capacity and availability plan, and a continuity plan that has been tested.
  • Supplier agreements for every third party in the delivery chain, with a named person who reviews performance.

Control of parties involved in the service lifecycle. If another organisation delivers part of your service, the standard expects you to retain accountability and show how you control them. Auditors ask for the contract, the service level reporting you receive, and what happens when they fail. This overlaps with vendor due diligence under ISO/IEC 27001, so collect the evidence once and reference it from both systems.

Evidence an auditor asks for. Expect to be asked for samples, not a policy folder:

  • Pick a recent major incident: show the record, communications, post-incident review and resulting corrective action.
  • Pick three changes of different risk levels: show the request, approval, test and outcome.
  • Show the last two service reviews with a customer and the actions that followed.
  • Have the internal audit findings, minutes from management review and the log of corrective actions ready to show.
  • Show competence and awareness records for the people operating the processes.

Common nonconformities, described generally. Documented processes that staff cannot describe when asked. Service level targets that are measured but never reviewed. Emergency changes that bypass approval with no retrospective review. A supplier with no recorded performance review. An internal audit that covered only some processes, or a management review with no decisions recorded. None of these needs a tool to fix; they need an owner and a routine.

Choosing the certification body. Verify on the accreditation body's own register that the body is accredited for ISO/IEC 20000-1, and ask how it handles combined audits if you also hold ISO/IEC 27001. Check that the auditors have operational IT service experience, not only management-system experience. A certificate from a body with no accreditation may look similar but carries less weight with customers and tender evaluators.

Verify a supplier's certificate. Ask for the certificate, the scope statement, the certification body and its accreditation, the issue and expiry dates, and which services and locations are covered. A certificate for one service line says nothing about another.

Ask your own team: Which services would we put in scope and which would we leave out? Who owns each process? If an auditor picked a random incident from last month, could we show the whole story?

What should an IT service team do next with ISO/IEC 20000-1?

  • List your services, their owners and the teams that support them.
  • Check what your customers or tender documents actually ask for: the certificate, or evidence of ITIL-style practice.
  • If you hold ISO/IEC 27001, ask your auditor how the two systems can share document control, internal audit and management review.
  • Run a mock audit by sampling one incident and one change from the last quarter.
  • If a supplier says it is certified, request the scope and the certification body.

Learn more

  • ISO/IEC 20000 Foundation course (PECB): a two-day introductory course by a training and certification provider covering the standard's concepts and requirements, ending in a certificate exam.
  • ITIL certifications (PeopleCert): the publisher's page for ITIL qualifications for individuals, useful for seeing how a framework differs from a certifiable standard.

Key takeaways

  • ISO/IEC 20000-1:2018 is a certifiable standard for an IT service management system; its edition 3.0 was published on 14 September 2018.
  • It certifies a defined scope of services at an organisation, not a product or a person.
  • ITIL is a framework with qualifications for individuals; the standard does not require you to use it.
  • It sits beside ISO/IEC 27001: service quality on one side, information security on the other.
  • Audits sample real incidents, changes and supplier records, so evidence matters more than documents.
  • Always read the scope on a supplier's certificate and confirm the certification body is accredited.

Sources