ISO 20000-1 for managed service providers: a practical guide

ISO 20000-1 is the international standard for IT service management, and managed service providers (MSPs) are among its natural users. A certificate shows that you deliver, support and improve services through defined processes, not through the memory of a few good people.

Relevance is rarely in doubt. The real question is how to meet ISO 20000-1:2018 without stopping billable work for months.

Why ISO 20000-1 suits managed service providers

An MSP sells a promise: the client's IT will run, and if it does not, someone fixes it quickly and properly. Clients never see how you keep that promise. They see invoices, tickets and the occasional outage.

ISO 20000-1 makes the method visible. It describes a service management system (SMS): the policies, processes and records you use to plan, deliver, monitor and improve services. A certificate tells a buyer that the system exists and that someone has checked it.

Three situations show where this pays off:

• Tenders and procurement. Larger clients and public bodies often ask for evidence of structured service management. A certificate answers that line in the tender.
• Supplier reviews. Clients that are regulated or audited must assess their suppliers. A certificate shortens that review.
• Internal order. Growing MSPs reach a point where processes live in people's heads. The standard makes you write down what works and fix what does not.

ISO 20000-1 is not ISO 27001. The first covers how you run services, the second how you protect information. Many MSPs end up wanting both, because clients ask about them separately.

What the standard actually requires

ISO 20000-1:2018 follows the high level structure used by most ISO management system standards, so clauses 4 to 10 look familiar if you know ISO 9001 or ISO 27001.

Clauses 4 to 7: the foundation

• 4 Context of the organization. You define the interested parties, the services in scope and the boundaries of your SMS. For an MSP that means naming what you actually sell, such as helpdesk, monitoring, backup or cloud administration.
• 5 Leadership. Management sets a service management policy and assigns roles. In a small MSP that is usually the owner or managing director, and the role cannot be fully delegated.
• 6 Planning. You identify risks and opportunities, set service management objectives and plan how to reach them.
• 7 Support. Resources, competence, awareness, communication and documented information. You must show that your engineers know the processes and that records are kept under control.

Clause 8: where the MSP work happens

Clause 8 Operation is the core of the standard and takes most of an MSP's effort. It covers the service lifecycle in these process groups:

• Service portfolio: service catalogue, asset management and configuration management.
• Relationship and agreement: business relationship management, service level management and supplier management.
• Supply and demand: budgeting, demand management and capacity management.
• Service design, build and transition: change management, service design and release and deployment management.
• Resolution and fulfilment: incident management, service request management and problem management.
• Service assurance: service availability, service continuity and information security management.

Most MSPs already do many of these things. The ticketing system covers incidents and requests, the change calendar covers change management. What is usually missing is a written process, a named owner and records showing that it is followed.

Clauses 9 and 10: checking and improving

• 9 Performance evaluation. Monitoring, internal audit and management review. You measure service levels, review the results and act on what the data says.
• 10 Improvement. You handle nonconformities, take corrective action and improve the system continuously.

The standard rewards honesty here. An internal audit that finds a gap and documents the fix is worth more than a polished system nobody tests.

Where MSPs usually struggle

The gaps are predictable.

• Service level agreements without measurement. Contracts promise response and resolution times, but nobody reports against them in a structured way.
• Informal change handling. Engineers change client systems quickly and sensibly, yet without a recorded request, approval or rollback plan.
• Problem management mixed with incident management. Incidents get closed, the root cause is never investigated, and the same ticket returns every month.
• Supplier management on paper only. MSPs depend on vendors, distributors and cloud platforms. The standard expects you to manage those relationships and the services they provide to you.
• No management review. The owner knows how the business is doing, but no meeting is minuted against the objectives of the SMS.
• Scope drift. The scope statement says one thing and the contracts say another.

None of this needs expensive tooling. A short written procedure, a clear owner and a few recurring records close most of these gaps.

A readiness checklist for MSPs

Use this list to see where you stand before you start.

• The services in scope are listed and match what your contracts say.
• A service management policy exists and has been approved by management.
• Roles and responsibilities for service management are assigned in writing.
• A service catalogue describes each service, its hours and its service levels.
• Service level targets are measured and reported at least periodically.
• Incidents and service requests are logged, prioritised and closed in a ticketing system.
• A problem process investigates recurring incidents and records root causes.
• Changes follow a recorded request, assessment, approval and review.
• Assets and configuration items are recorded and kept current.
• Capacity and availability are monitored for the services you run.
• A continuity plan exists and has been tested or reviewed.
• Key suppliers are listed, with a record of how their performance is reviewed.
• Staff competence and training are documented.
• An internal audit has been carried out, and findings are recorded.
• Management has held a review of the system and minuted the outcome.

If you can tick most of these, you are close. If you tick few, the checklist doubles as your project plan.

Two ways to certify

The classic route is an on-site audit by a certification body. Auditors visit, interview staff, review records and issue a certificate if the system conforms. It suits organisations that need it for contractual reasons or want an external auditor to walk through the operation. Expect planning, calendar time and a considerable amount of management attention.

The second route is an online self-assessment. You answer structured questions about your SMS, and the result is reviewed before a certificate is issued. There is no visit and no audit week. How this differs from a traditional audit is covered in our guide on ISO certification without an audit.

Which route fits depends on who is asking. Some tenders name a specific type of certificate. Many clients simply want evidence that you work to a recognised standard and that it can be checked. Ask your most important clients what they expect before you decide.

Smaller providers face a practical limit as well: a team of ten cannot easily release its best engineers for an audit week. Our overview of ISO certification for small and medium businesses looks at this trade-off in more detail.

Certifying ISO 20000-1 with Zertify

Zertify offers the online route. The ISO 20000-1 page describes the standard and the assessment. You complete a self-assessment against ISO 20000-1:2018, and SICE (Swiss Institute of Certification and Education) reviews every assessment before the certificate is issued. G6 Agency AG issues the certificate under licence from SICE.

There is no on-site audit. Once the assessment is passed and paid, the certificate is issued within 4 hours. It is publicly verifiable, so a client or tender officer can confirm it independently.

The certificate is valid for three years and is confirmed every year with a short online re-audit, which is part of a yearly subscription. The structure is on the pricing page.

To begin, start the assessment. Have your service catalogue, your main procedures and a few recent records ready, so you answer from evidence and not from memory.

In what order to work

Starting from scratch, this sequence keeps the effort contained.

1. Define the scope. Decide which services are covered and write it down in plain language.
2. Run the checklist above. Mark each gap and give it an owner and a date.
3. Write only what you need. A one-page procedure that people follow beats a long manual that nobody reads.
4. Collect records for a few weeks. Tickets, change records, service reports and meeting minutes become your evidence.
5. Hold an internal audit and a management review. Do both once, honestly, and record the outcome.
6. Complete the assessment. Answer from the evidence you have collected.

Steps 2 to 5 deliver most of the value. The certificate confirms the work; the work is what improves your service.

What the certificate does and does not do

A certificate does not guarantee that you never have an outage. It shows that you have a system for service delivery and that the system is reviewed. For an MSP, that is a strong statement to put in front of a client.

It does not replace your contracts either. Service levels, liability and data protection terms stay in your agreements, and the certificate sits beside them as evidence of method.

Put it to work: mention it in proposals, add it to your website and use the standard's structure to answer client questionnaires. Keep the records alive, because the yearly confirmation asks about the current state, not the state on the day you first applied.