ISO/IEC 20000-1 — Service management systems
What is ISO/IEC 20000-1?
ISO/IEC 20000-1 is the international standard for service management systems. The standard refers to it as the SMS. It sets requirements for organisations that provide services — IT companies, data centres, in-house IT departments and service desks — on how a service is planned, delivered, measured and changed.
The standard names the processes that must exist: the service catalogue, agreed service levels, management of incidents, service requests and problems, changes, capacity, continuity and information security. It is voluntary, but clients often ask for it in tenders.
What a service management system covers
ISO/IEC 20000-1 covers the service management system — not an individual tool or ticketing system, but the way a service is planned, delivered and changed. The standard names the processes that must exist:
- Service catalogue and planning — exactly what is provided and on what terms.
- Service level management, with agreed targets that are measured and reported on.
- Business relationship and supplier management, including subcontractors involved in delivery.
- Capacity and demand management, plus budgeting and accounting for services.
- Change management, service design and transition, and release and deployment.
- Management of incidents, service requests and problems.
- Availability, service continuity and information security.
- Configuration and asset management — everything that makes up the service.
Who asks for it and who implements it
The standard is meant for anyone who provides a service, whether externally or within their own organisation:
- IT companies and managed service providers;
- data centres and infrastructure and hosting providers;
- software companies that provide support alongside their product;
- in-house IT departments that provide services to the rest of the company;
- customer service and support centres that aren’t necessarily IT.
For some organisations the trigger is a tender requirement or a large customer who wants proof that support follows defined rules rather than depending on whoever happens to be available.
The road to certification
- Defining the scope — which services, for which customers and at which locations. The scope is stated on the certificate, so it must be precise.
- Listing the services and building the catalogue, with a description of what each one does and doesn’t include.
- Agreeing service levels — targets that can actually be measured with the tools you already have.
- Setting up the processes for incidents, service requests, problems and changes, with a clear distinction between them.
- Configuration management — a record of the components and how they relate to each other.
- Continuity and availability plans, and then testing them.
- Measurement and reporting to customers and management.
- Internal audit and management review, followed by the certification audit.
What changes in how support works
The system is judged by whether the service keeps running when the people who know everything by heart aren’t at work. The standard moves that knowledge out of people’s heads and into the system.
- Tickets have a route and a deadline, so they don’t depend on who the user happened to message.
- Recurring faults are logged as a problem and their cause is investigated, instead of the team firefighting them every time.
- Changes are approved and have a rollback plan, so there are fewer outages after upgrades.
- The customer gets a report on whether the agreed service level was met — based on data, not impressions.
- When someone leaves the company, the service doesn’t leave with them.
An incident and a problem are not the same
This is a distinction the standard requires you to keep, and one that often gets lost. An incident is an interruption to a service or a drop in its quality — the aim is to restore the service as quickly as possible, even with a workaround. A problem is the cause of one or more incidents — the aim is to remove it so that the incidents don’t recur.
When everything is logged as an incident, the team fixes the same fault fifty times and it looks like good performance, because every ticket was closed on time. Separating out problems makes the repetition visible. Alongside them there is the service request — an installation, an account, a permission — which isn’t a fault and isn’t measured against the same deadlines.
How it relates to ITIL
ITIL is a set of good practices that describes how services can be managed; ISO/IEC 20000-1 is a standard with requirements against which an organisation can be certified. ITIL isn’t certified at the level of the organisation — individuals are.
If you already follow ITIL, most of the processes already exist and implementation is shorter. But ITIL isn’t a prerequisite. The standard requires processes to exist and deliver results, not to carry particular names or follow a particular framework.
Climate change in the organisation’s context
Since February 2024, ISO/IEC 20000-1 has had an amendment (ISO/IEC 20000-1:2018/Amd 1:2024), one of the climate amendments ISO made to its management system standards. It requires the organisation to determine whether climate change is a relevant issue, and adds a note that relevant interested parties can have requirements related to climate change.
This isn’t a separate system or new documentation. What is required is that the consideration takes place and can be seen — in the context analysis and in the management review. If you conclude that climate change isn’t relevant to your service management system, that is an acceptable outcome too, provided it is clear the question was asked.
How long implementation takes
Implementing ISO/IEC 20000-1 usually takes 30 to 90 days. Exactly how long depends on the size of the organisation, the number of employees and how much of the above is already in place. If you already have a ticketing tool and an equipment register, most of the work is writing down the rules and starting to measure. We give an estimate for your case after a short conversation about the scope. On your side, for small and medium-sized organisations it takes 2 to 5 hours a week in total, spread across several people — more on this in our frequently asked questions.
What affects the price
Three things affect the cost of implementation:
- the size of the organisation;
- the number of employees;
- the standard being implemented — the amount of work differs from standard to standard.
We can only give an exact price after you get in touch and we have a short conversation about the scope. Without that, any figure would be guesswork, so we don’t give one here.
Frequently asked questions
Is ISO/IEC 20000-1 the same as ITIL?
No. ITIL is a framework of good practices with no certification for organisations; ISO/IEC 20000-1 is a standard against which an organisation is certified. Working to ITIL makes implementation easier, but it isn’t a prerequisite.
Do we have to buy a special tool?
The standard doesn’t prescribe a tool. It requires tickets, changes and configuration to be recorded and reported on. Smaller organisations do this with the tools they already have; at larger scale a dedicated tool becomes a practical necessity, but that is your decision.
What if part of the service is provided by a subcontractor?
The standard explicitly requires you to manage the other parties involved in the service life cycle. Responsibility towards the customer stays with you, so the requirements must be agreed in a contract and you must monitor whether the subcontractor meets them.
What if the service is provided by a supplier rather than by us?
ISO/IEC 20000-1 covers this explicitly: for services provided by another party, you remain accountable. The requirements must be set out in a contract, performance must be monitored and there must be a record of that monitoring. The supplier doesn’t have to be certified, but it does have to be monitored. There is one limit: if other parties provide or operate all the services, service components or processes in the scope, you cannot demonstrate conformity.
Can it be combined with ISO 27001?
Yes, and that is often how it’s done. Both standards share the same harmonised structure, and ISO/IEC 20000-1 itself requires information security to be managed within the service.
Do we need a service catalogue?
Yes. The standard explicitly requires a service catalogue — describing each service, its purpose and the dependencies between services. It is one of the documents ISO/IEC 20000-1 lists by name, alongside the service management plan, the SLAs and supplier contracts, so auditors look at it early.
General questions — cost and duration, who issues the certificate and how long it is valid — are covered in our frequently asked questions.
Related standards
- ISO 27001 — information security; ISO/IEC 20000-1 itself requires security controls within the service.
- ISO 22301 — business continuity; goes deeper into what ISO/IEC 20000-1 requires for service continuity.
- ISO 9001 — quality management systems, with a shared structure and documentation.
- Frequently asked questions about ISO standards — how certification works, how long a certificate is valid, what new editions mean.
- Overview of all standards — if you’re not sure what you need.
How STANDARDISO can help
We guide you through the whole process — from listing your services and building the catalogue, through agreeing service levels and the processes for incidents, service requests and problems, to reporting and the internal audit. The certificate is issued by an independent, accredited certification body.
We work from your real processes: the documentation describes what you actually do, rather than forcing your work into a template. We train your staff so they can keep using the system after the audit. Everyone on our team works in English, and we can prepare your documentation in English, Serbian or both.