Frameworks and standards

ISO/IEC 20000: the international standard for service management

ISO/IEC 20000 lets organisations prove, through independent certification, that they manage their services to an internationally agreed standard. Here is what it involves and who it is for.

In brief

What is ISO/IEC 20000?

ISO/IEC 20000 is a family of international standards for service management. Its best-known part, ISO/IEC 20000-1, sets out the requirements for a service management system (SMS): the policies, processes, roles and records an organisation uses to plan, deliver and improve its services.

Unlike a framework such as ITIL, ISO/IEC 20000-1 is a set of requirements. An organisation can be audited against it and, if it meets them, awarded a certificate by an accredited certification body.

The current edition is ISO/IEC 20000-1:2018, updated by Amendment 1 in 2024 to ask organisations to consider whether climate change is relevant to their service management system. It follows the same high-level structure as other ISO management system standards, such as ISO 9001 and ISO/IEC 27001, which makes it easier to run them together.

Although it is most often used for IT services, the standard can be applied to any kind of service.

Key facts

Type: International standard (certifiable)
Published by: ISO and IEC, through joint committee ISO/IEC JTC 1/SC 40
Current edition: ISO/IEC 20000-1:2018, with Amendment 1:2024
Certification for organisations: Yes, by accredited certification bodies
Qualifications for people: Yes, from Foundation to Lead Auditor, offered by several examination bodies
Official site: iso.org

Core ideas

The key ideas in ISO/IEC 20000

A management systemService management is run as a system with clear scope, policy, objectives, roles and leadership commitment, not as a set of disconnected processes.

Plan, do, check, actThe SMS is planned, operated, monitored and improved in a continuous cycle, backed by internal audit and management review.

Defined scopeThe organisation decides which services, locations and teams are covered, and certification applies only to that scope.

Service portfolio and relationshipsRequirements cover the service catalogue, service levels, business relationships, suppliers, capacity, and service availability and continuity.

Resolution and fulfilmentIncident management, service requests and problem management must be defined, operated and measured.

Control of changeChange management, release and deployment, and configuration management keep services stable as they evolve.

Ownership and history

Who publishes ISO/IEC 20000, and where did it come from?

ISO/IEC 20000 is published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). It is developed by subcommittee SC 40 of their joint technical committee on information technology (ISO/IEC JTC 1), which also looks after IT governance standards.

The standard has British roots. It grew out of BS 15000, a British Standard first published in 2000, which was adopted internationally as ISO/IEC 20000 in 2005. Later editions followed in 2011 and 2018.

The series includes other useful parts, such as ISO/IEC 20000-2 (guidance on applying part 1), ISO/IEC 20000-3 (guidance on scope definition) and ISO/IEC 20000-10 (concepts and vocabulary), along with newer guidance on topics such as sustainability.

In the UK you can buy the standard from BSI, the national standards body, or directly from ISO.

Certifications

Certification for organisations and qualifications for people

There are two separate routes, and it helps not to confuse them.

OrganisationsISO/IEC 20000-1 certificationAn accredited certification body audits your service management system, usually in two stages. If successful, you receive a certificate, normally valid for three years, with surveillance audits at least once a year and a recertification audit at the end of the cycle.

OrganisationsChoosing a certification bodyIn the UK, look for a certification body accredited by UKAS for ISO/IEC 20000-1, so your certificate is widely recognised. Consultants who help you prepare should not also certify you.

PeopleQualifications for individualsExamination bodies such as APMG International, PECB, BSI and EXIN offer ISO/IEC 20000 courses at Foundation, Implementer or Professional, and Lead Auditor levels. Scheme names and formats vary by provider.

Benefits

Why organisations adopt ISO/IEC 20000

Independent proof of qualityA recognised certificate gives customers and partners confidence that your services are well managed.

Win and keep contractsCertification is increasingly requested in tenders, particularly in the public sector and for managed service providers.

Consistent, reliable servicesDefined processes, measures and reviews reduce variation and make performance more predictable.

Discipline that lastsRegular internal audits, management reviews and external surveillance keep improvement going year after year.

Easy to integrateThe shared ISO structure lets you combine it with ISO/IEC 27001, ISO 9001 or ISO 22301 in one integrated management system.

Better supplier managementThe standard requires you to manage suppliers and other parties involved in your services, not just your own teams.

Who it is for

Who should use ISO/IEC 20000?

ISO/IEC 20000 is a good fit when you need to demonstrate, not just claim, that your services are well managed. Typical users include:

managed service providers, outsourcers and cloud service providers;
in-house IT departments that want to prove their maturity to the business;
organisations bidding for public sector or regulated contracts;
organisations that already hold ISO/IEC 27001 or ISO 9001 and want to extend their management system.

If you do not need a certificate, you can still use the standard as a benchmark to check your practices against.

Roles that benefit most

IT and service delivery directors
Service management and process owners
Quality, compliance and internal audit teams
Bid and commercial teams
Supplier and contract managers

How it fits

How ISO/IEC 20000 works with other frameworks

ITIL is the most common way to meet the requirements. ISO/IEC 20000 says what you must do; ITIL offers detailed guidance on how.
ISO/IEC 27001 shares the same structure and several processes, so the two are often run as one integrated system.
COBIT provides the wider governance context in which the service management system operates.
DevOps teams can meet the change and release requirements through automated pipelines, as long as controls and evidence are designed in.

How Northera helps

Getting ready for certification

Our ISO/IEC 20000 readiness service assesses your current practices against the standard, builds a practical remediation plan, and prepares your team for the certification audit. We prepare organisations for certification but never certify them, which keeps our advice independent. See our services page for details.

Considering ISO/IEC 20000 certification?

Book a free scoping call and we will give you an honest view of how ready you are and what it will take.

Book a free scoping call