IT Service Management

ISO/IEC 20000-1 is the international standard for an IT Service Management System (SMS) — a structured way to plan, deliver, operate and continually improve the IT services your organization provides. It is the only ISO standard against which an IT service provider can be formally certified for the quality of its service management.

In plain terms, it takes the good practices that many teams already recognize from ITIL — incident management, change management, service level management, problem management and the rest — and wraps them in a certifiable management system with clear ownership, measurable targets and a rhythm of review. ITIL gives you the practices; ISO/IEC 20000-1 gives you the framework that proves those practices are running consistently and improving over time.

Certification is granted by an accredited certification body after a two-stage audit, and the certificate is typically valid for three years with annual surveillance audits in between. Because it is technology-neutral, it fits an internal IT department, a managed service provider, a cloud or hosting company and a shared-services centre equally well.

ISO/IEC 20000-1 is not legally mandatory, but it has become a recognized mark of a mature, dependable IT service provider. If customers keep asking how you guarantee uptime, response times and consistent service, this is usually the answer they want. It is especially valuable for:

• Managed service providers and IT outsourcers whose whole value proposition is reliable, well-run services under contract.
• Internal IT and shared-services departments that want to run like a professional service provider to the rest of the business.
• Cloud, hosting and data-centre operators where availability and predictable support are the product.
• Software and SaaS companies that also run support, operations and change for live customer services.
• BPOs and service desks delivering IT support to multiple clients.
• Any provider bidding for government, enterprise or overseas contracts that name ISO/IEC 20000-1 as a prerequisite.

A useful test: if your customers judge you on how consistently you deliver and support services — not just what the technology does — this standard is worth having.

ISO/IEC 20000-1 follows the same high-level structure as other modern ISO management standards, so the core clauses will feel familiar if you already hold ISO 9001 or ISO 27001. In plain terms, it asks you to:

• Define the scope of your SMS — which services, teams and locations are covered, based on your context and the needs of interested parties.
• Show leadership and set a service management policy and objectives that top management genuinely owns.
• Plan the service management system — including how you handle services delivered on your behalf by other parties and suppliers.
• Run the service delivery processes — service level management, service reporting, capacity and availability, and service continuity.
• Operate the control and resolution processes — incident and service request management, problem management, change management, configuration and release management.
• Manage relationships — with customers, suppliers and internal groups — so expectations and responsibilities are clear.
• Monitor, measure, audit and review — internal audits, management reviews, and handling of nonconformities and continual improvement.

The depth of each process should match the size and risk of your services, not a checklist. A small internal IT team and a large multi-client provider can both be compliant with very different implementations — what matters is that the processes are defined, followed and improving.

The strongest reason most of our clients pursue ISO/IEC 20000-1 is commercial: it wins and protects service contracts. Procurement teams increasingly want independent proof that a provider can deliver consistently, not just promise it. A single certificate can replace long capability questionnaires and set you apart in competitive tenders.

Beyond deals, certification gives you a genuinely better-run operation. Building the SMS surfaces the gaps that quietly hurt service — changes made without control, incidents that recur because no one owns the underlying problem, service levels that were never really agreed or measured. Closing those gaps means fewer outages, faster resolution and happier customers.

Internally, the standard ends the guesswork. Service quality stops depending on a few heroes and becomes a repeatable system with clear ownership, agreed targets and a review rhythm. And because it shares its structure with ISO 9001 and ISO 27001, it becomes a natural companion if you already hold, or plan to pursue, those standards.

We've spent more than 30 years helping organizations get certified, with 900+ clients certified and a 100% first-time pass rate at the certification audit. Our 10-Step Approach turns ISO/IEC 20000-1 from an intimidating framework into a clear, week-by-week path.

We start by understanding your services, your customers and how your teams actually work today — not a generic template. Then we run a gap assessment against ISO/IEC 20000-1, map your existing ITIL-aligned practices onto the standard, and build a right-sized service management system. Our documentation is deliberately lean: a single-level system, typically under 200 pages, written for the people who run the service rather than to impress an auditor.

From there we help you implement and tune the processes, agree meaningful service levels, train your staff, run internal audits and a management review, then support you through both Stage 1 and Stage 2 of the certification audit. A typical project runs 4–9 months depending on your size and starting maturity. When we're done, you hold the certificate — and you own a system your team can actually run afterward, without depending on us forever.

• Assuming ITIL alone equals certification. Following ITIL practices is a great start, but ISO/IEC 20000-1 requires a defined, measurable management system around them. We bridge the two.
• Buying a template pack and calling it an SMS. Auditors spot generic documentation instantly, and it won't reflect how you really deliver services. We build the system around your operation.
• Service levels no one agreed or measures. SLAs that live in a drawer are a classic finding. We help you set targets that are real, agreed and reported.
• Change and problem management on paper only. If changes still happen informally and incidents keep recurring, the audit will expose it. We make the processes practical enough that people actually use them.
• Ignoring suppliers and other parties. Services you rely on others to deliver are still in scope. We make sure those relationships are governed.
• Over-documenting. Thick manuals no one reads become findings, not strengths. Lean, usable documentation passes audits and survives real life.
• Forgetting it's ongoing. Surveillance audits come every year. We leave you with a system that keeps working, not a one-off scramble.