What is ISO/IEC 20000? IT service management explained

IT service management explained

Almost every organization now depends on IT services, from cloud platforms and business applications to networks and service desks.

When those services fail or perform poorly, the impact is felt immediately by customers and employees alike.

ISO/IEC 20000 is the international standard for service management. It helps organizations plan, deliver, and continually improve services in a structured, measurable way.

This guide explains what ISO/IEC 20000 is, how a service management system works, its key requirements, and how professionals can build expertise in it.

What is ISO/IEC 20000?

ISO/IEC 20000 is a series of standards for service management. Its core part, ISO/IEC 20000-1:2018, Information technology – Service management – Part 1: Service management system requirements, specifies requirements for establishing, implementing, maintaining, and continually improving a service management system (SMS).

An SMS is the set of policies, objectives, plans, processes, and resources an organization uses to deliver services that meet agreed requirements and add value for customers.

ISO/IEC 20000-1 is the part organizations can be certified against. Other parts of the series provide guidance, such as ISO/IEC 20000-2, which explains how to apply the requirements.

The 2018 edition is the current version. ISO reviewed and confirmed it in 2023, and a 2024 amendment added climate action considerations, as it did for other ISO management system standards.

Who uses ISO/IEC 20000?

Although the standard comes from the IT world, it applies to any organization that delivers services, whether to external customers or internal users. Typical users include:

• IT service providers and managed service providers
• Cloud, hosting, and data center providers
• Internal IT departments in large organizations
• Telecommunications companies
• Outsourcing and shared service centers
• Public sector organizations delivering digital services

Certification is often requested in tenders and outsourcing contracts as evidence that a provider manages its services reliably.

How ISO/IEC 20000-1 is structured

ISO/IEC 20000-1:2018 follows the common high-level structure used across ISO management system standards, such as ISO/IEC 27001 and ISO 9001. This makes it easier to integrate service management with other management systems.

• Context of the organization – understanding the organization, interested parties, and the scope of the SMS
• Leadership – top management commitment, the service management policy, and roles
• Planning – addressing risks and opportunities, setting objectives, and planning the SMS
• Support – resources, competence, awareness, communication, and documented information
• Operation – the service management processes themselves
• Performance evaluation – monitoring, internal audit, management review, and service reporting
• Improvement – nonconformities, corrective action, and continual improvement

Key service management processes

The operation clause covers the processes needed to deliver and support services. They are grouped into several areas:

Service portfolio

Planning services, managing the service catalogue, and controlling the assets and configuration items that services depend on.

Relationship and agreement

Business relationship management, service level management, and supplier management, ensuring that services meet agreed targets and that external and internal suppliers perform as expected.

Supply and demand

Budgeting and accounting for services, demand management, and capacity management, so that services have the resources they need now and in the future.

Service design, build, and transition

Change management, service design and transition, and release and deployment management, so that new or changed services are introduced in a controlled way.

Resolution and fulfilment

Incident management, service request management, and problem management, restoring services quickly and removing the root causes of recurring issues.

Service assurance

Service availability management, service continuity management, and information security management, protecting services against disruption and security threats.

Benefits of ISO/IEC 20000

• More reliable services – fewer incidents and faster recovery when issues occur
• Clear service levels – agreed targets that customers and providers both understand
• Better control of suppliers – consistent management of the third parties services depend on
• Competitive advantage – certification provides independent evidence of service management capability
• Continual improvement – services are measured, reviewed, and improved over time
• Integration – the shared structure makes it easier to combine ISO/IEC 20000 with ISO/IEC 27001 or ISO 9001

ISO/IEC 20000 and best-practice frameworks

Many organizations already use best-practice frameworks for IT service management. These frameworks describe good practices in detail, but they are not certifiable requirements.

ISO/IEC 20000-1 sets out what an organization must do, and can be independently audited. Best-practice frameworks often help organizations decide how to do it.

The two approaches complement each other: an organization can use the practices it already knows to meet the requirements of the standard.

ISO/IEC 20000 and ISO/IEC 27001

ISO/IEC 20000 and ISO/IEC 27001 are frequently implemented together, especially by IT service and cloud providers.

ISO/IEC 27001 focuses on protecting information, while ISO/IEC 20000 focuses on delivering services that meet agreed requirements. Both share the same high-level structure and many supporting processes, such as change, incident, and supplier management, so an integrated approach reduces duplication.

How to get started with ISO/IEC 20000

• Define the scope of the SMS: which services, locations, and customers it covers.
• Run a gap analysis against ISO/IEC 20000-1:2018.
• Secure top management commitment and set the service management policy and objectives.
• Design or improve processes, starting with those that most affect customers, such as incident and change management.
• Agree service levels and start measuring and reporting performance.
• Conduct an internal audit and management review before the certification audit.

Who should learn ISO/IEC 20000?

ISO/IEC 20000 knowledge is valuable for IT service managers, service delivery and operations managers, service desk leads, quality and compliance professionals, consultants, and auditors.

It is also useful for procurement and vendor managers who need to evaluate IT service providers.

For professionals already working in IT operations, ISO/IEC 20000 offers a recognized way to show that their service management knowledge meets an international benchmark.

Training paths for ISO/IEC 20000

Professionals can build ISO/IEC 20000 expertise through several PECB training paths available at MIC:

ISO/IEC 20000 Foundation

A good starting point for professionals who need to understand the main concepts and requirements of a service management system.

ISO/IEC 20000 Lead Implementer

This course develops the competence to plan, implement, manage, and maintain an SMS based on ISO/IEC 20000-1. It is particularly relevant to IT service managers, consultants, and project leaders.

ISO/IEC 20000 Lead Auditor

For professionals who want to develop the competence to audit an SMS against the requirements of ISO/IEC 20000-1.

Start your ISO/IEC 20000 learning journey with MIC

Reliable services are now a core expectation, and organizations need professionals who can manage them in a structured, measurable way.

My ISO Certification (MIC) provides access to official PECB training, with study materials, the exam, and the certification application fee included.

Ready to build service management expertise?

Explore the ISO/IEC 20000 Lead Implementer course and take the next step toward helping organizations deliver services customers can rely on.

---